- leak guard allowlists repo-relative paths (not basenames) so a raw query in tests/nested/<name>.py cannot slip through - self-scan removes only the guard functions' spans, then scans the remaining source as one blob with a pattern including standalone FROM/JOIN, so SQL split across physical lines is caught