From ec9a57d6aa1bffb6307b0d645195eba35f459370 Mon Sep 17 00:00:00 2001
From: bj <bj@local>
Date: Mon, 8 Jun 2026 11:16:20 -0700
Subject: [PATCH] =?UTF-8?q?v0.9.3:=20fix=20F-5=20temp-file=20leak=20?=
 =?UTF-8?q?=E2=80=94=20RETURN=20trap=20now=20cleans=20both=20temps=20(rule?=
 =?UTF-8?q?s=5Ftmp=20+=20=5Fnorm=5Ftmp);=20+=20fail-safe=20CR-detection=20?=
 =?UTF-8?q?comment;=20MANIFEST=20regenerated?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Vera FAIL on v0.9.2 was the stdin-path temp leak (bash RETURN traps don't stack).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 MANIFEST            | 4 ++--
 VERSION             | 2 +-
 lib/hl7-sanitize.sh | 6 +++++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/MANIFEST b/MANIFEST
index a2adbe3..ab34df6 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -31,7 +31,7 @@ install-larry.sh	072a036ad5bbf80e866cfd2dd74de50f8defd69a3f835032579b0cb9d421ad5
 uninstall-larry.sh	c53ad2d8354c7adeb243b541f027f3f481e4a8661eecfd7af14d7ca53cfcaad9
 
 # Metadata
-VERSION	f34248c2449a022d41c918d1e995ad85859a1e9f0e6f89d0af23ae4a55519f71
+VERSION	38ecaa1e4c36c6691944c83df7671fca8b86f5cbf2d4e22c0012aa52df14b149
 MANUAL.md	5ff54d6d5fae826f8b3da1eb3be6476076bb15f9b1417a4de285e59ea37e1b1f
 CHANGELOG.md	934007dc1b08b6c90120f009e3cc7870815e7b251fdf8f6629aa4c004c866017
 
@@ -72,7 +72,7 @@ lib/lessons.sh	225e899ed72ce20906cc454c5f5db87d605859e5e17431731a2ce481623f4e16
 lib/journal.sh	11c62a2d47b6b67a2f423fd8b86c454126df18d2dc3e150233bbd08293e39fe7
 
 # HL7 utilities
-lib/hl7-sanitize.sh	5bb409b3e5eae545e362e1313cd47c6835d56177dfe2efafd519e4ceedb2a82b
+lib/hl7-sanitize.sh	efd333dc3e267cf2280433e53bbb910023d0bc4b30724181b53873b410d83005
 lib/hl7-desanitize.sh	2e5462a61ab1e8bd3fefb956bace8ca1ae33397a09024cbe766fa55c37a5aad6
 lib/hl7-diff.sh	d2cc179bf25dd8e808d46d4211d1926f36645cec8443d0ea910675093eb89d72
 lib/hl7-field.sh	a640f7cbd9521dc96171ee1dbdf909170262101a1d7a433f6f0ce2bea8d42b02
diff --git a/VERSION b/VERSION
index 2003b63..965065d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.9.2
+0.9.3
diff --git a/lib/hl7-sanitize.sh b/lib/hl7-sanitize.sh
index 874b285..5227abd 100755
--- a/lib/hl7-sanitize.sh
+++ b/lib/hl7-sanitize.sh
@@ -485,8 +485,12 @@ AWK_END
   else
     # stdin — buffer to a temp file so we can inspect for CR presence.
     local _norm_tmp; _norm_tmp=$(mktemp)
-    trap 'rm -f "$_norm_tmp"' RETURN
+    # F-5 fix: bash RETURN traps do NOT stack — this REPLACES the earlier rules_tmp trap
+    # (~line 357), so it MUST clean BOTH temps or $rules_tmp leaks one mktemp file per stdin call.
+    trap 'rm -f "$rules_tmp" "$_norm_tmp"' RETURN
     cat /dev/stdin > "$_norm_tmp"
+    # CR-detection via python3; if python3 is absent the test fails and the else (normalise)
+    # branch runs — the intentional FAIL-SAFE default (normalise, never skip sanitization).
     if python3 -c "import sys; d=open(sys.argv[1],'rb').read(); sys.exit(0 if b'\r' in d else 1)" "$_norm_tmp" 2>/dev/null; then
       awk -v RULES_FILE="$rules_tmp" -v TABLE="$table" -v STRICT="$strict" \
           -v UPDATE_TABLE="$update_table" \