The line/window-scoped tradeoff you called out is the right thing to flag, and the case that bites in real codebases is usually a DAO or repository wrapper - the query lives in get_by_id(user_id) two files away from the request handler, so the taint never crosses back into the same function window and sqlfence stays quiet on exactly the pattern that ships in most services with a data layer. Worth documenting as a known gap rather than letting a clean run imply full coverage - I'd rather a linter say "can't tell, wrapped call" on that shape than go silent on it.