Redact and cap subprocess diagnostics

docs/operations.md

@@ -149,6 +149,11 @@ reaped, and descendants that keep standard output or error open cannot keep
 the invocation blocked. Other operating systems fail closed rather than launch
 a command without tree ownership.
 
+Subprocess stdout and stderr diagnostics are separately redacted and capped at
+8 MiB per invocation. Narratio does not retain configured credential values in
+these logs or their error tails; reaching a capture limit terminates the command
+tree and reports which stream exceeded the limit.
+
 Run-local diagnostics are:
 
 - `runs/{run_id}/extract/notarius.receipt.json`