A scanner decides a handler is injectable by sending a quote and watching the response get longer, or shorter, or slower. That works often enough to be useful and it is why scanner findings need somebody to confirm them: the response is a shadow of what happened, and several innocent things cast the same shadow.
This app never does that. The store records the statement it parsed, how many statements it found, and which clauses came from the input rather than from the handler — so the question 'was this injected?' has an answer rather than an estimate.
GET /orders?status=pendingNo clauses contributed. The handler wrote the whole statement.
GET /orders?status=x%27%20OR%20%271%27%3D%271One OR contributed. That is the finding, and it is a fact rather than a symptom.
How the store knows: it has the statement, and it has every value that arrived in the request. It parses the statement as it stands, then parses the same statement with each untrusted value replaced by a harmless one, and compares the two shapes.
A payload that only supplied a value produces identical shapes. A payload that added a clause, closed a literal, commented out the tail or started a second statement produces a different one. There is no threshold in it and nothing to tune.