Redact and cap subprocess diagnostics

docs/internal/adapters.md

@@ -59,9 +59,12 @@ configured filesystem secrets before adapter initialization.
 - Shared subprocess execution starts an owned process group on Linux/macOS or a
   kill-on-close job object on Windows. Cancellation and deadlines request
   termination, use a bounded forceful fallback, and wait for the leader before
-  returning. Unlogged stdout/stderr use direct null-device descriptors so a
-  descendant cannot retain an adapter pipe after its leader exits. Unsupported
-  platforms reject owned command execution.
+  returning. Child environments contain only the execution baseline and
+  adapter-specified values; configured credentials are explicit sensitive
+  values. Stdout and stderr are redacted while streaming into separate 8 MiB
+  diagnostic captures; a bounded wait closes a stream retained by a departed
+  leader's descendant. Reaching either limit terminates the owned tree.
+  Unsupported platforms reject owned command execution.
 
 ## Implementation And Tests