A query asks for twenty orders and each order's `customer`. The `customer` resolver has a single `findById` call in it — no loop, nothing obviously wrong. Why does this still hit the database twenty times, and whose "fault" is that, the resolver or the query?

Neither, really — it's how GraphQL execution works by design. The engine resolves orders once, gets a list of twenty, and then for every field selected under Order that has its own resolver, it calls that resolver once per item in the list — not because the code loops, but because the engine itself walks the list and invokes the field's resolver method twenty separate times, each with a different parent Order. A single-findById resolver is completely correct in isolation; the N+1 comes from the engine calling that correct, simple method twenty times, once per object the parent field returned, and it does the same thing at every level for every field with its own resolver — customer.tier, lines.product, all of it.