Redaction contracts must cover nested helper side effects

A caller-specific telemetry contract is incomplete if nested database, retry, lock, or provider helpers can emit their own events first. Audit the complete call graph, not only the caller's final logger. Exercise the real sanitizer with credential-shaped synthetic negative controls and verify every destination, including centralized exception capture.

Prefer an explicit bounded logging mode at sensitive call sites or a shared sanitizer with compatibility tests for all callers. Limits: globally deleting diagnostic detail can harm unrelated consumers, so scope the change or prove the shared contract before rollout. A passing caller-level redaction test does not prove helper-level safety.