Is a sanitized parameter still cleaned when my function is used in a stream, passed as a callback, or reached through an operator?

  safe input   -> its own copy of the String (the caller's String is never shared)
  a threat     -> an unset String, and one log line per detector on stderr

defines module qa.sanitizeddeep.everyroute

  defines function

    <?-
      Declares its parameter sanitized, so it cleans 'text' itself on entry.
      Every route that reaches it - call, stream stage, callback - gets the cleaned value.
    -?>
    describe()
      -> text as sanitized String
      <- rtn as String: "rejected"

      if text?
        rtn: `accepted: ${text}`

    <?-
      A callback: built-in Optional code calls it, there is no EK9 call site.
    -?>
    showIt()
      -> text as sanitized String
      stdout <- Stdout()
      stdout.println(`callback set: ${text?}`)

    <?-
      Builds an injection attempt at run time from two harmless pieces.
    -?>
    composedAttack()
      <- rtn as String: String()
      opening <- "'; DROP"
      closing <- " TABLE users--"
      rtn: opening + closing

  defines class

    <?-
      An operator is a receiver too: its sanitized parameter is cleaned on entry.
    -?>
    Guard
      default Guard()

      operator + as pure
        -> text as sanitized String
        <- rtn as String: "rejected"

        if text?
          rtn: `accepted: ${text}`

      default operator ?

  defines program

    EveryRouteDemo()
      stdout <- Stdout()
      visitorNote <- "Hello from a visitor"
      attack <- composedAttack()

      stdout.println(`direct: ${describe(visitorNote)}`)
      stdout.println(`direct: ${describe(attack)}`)

      results <- cat [attack] | map with describe | collect as List of String
      for result in results
        stdout.println(`stream: ${result}`)

      Optional(attack).whenPresent(showIt)

      guard <- Guard()
      stdout.println(`operator: ${guard + attack}`)

describe(sanitized visitorNote)

describe(visitorNote)