diff --git a/CHANGELOG.md b/CHANGELOG.md
index e91923a..357de3c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,13 @@ and versions are tracked in the repo-root `VERSION` file.
   alpha, beta, release-candidate, and GA identifiers while locking publication
   until the verified-artifact and pre-GA release-candidate gates are complete.
 
+### Security
+
+- Added explicit sensitive-command diagnostics for the standard command runner
+  and GitHub helpers, allowing callers to publish a safe operation label while
+  keeping protected argument values out of dry-run, retry, timeout, and final
+  failure records.
+
 ### Fixed
 
 - Hardened file-section processing, allowed-dirty-path checks, temporary
diff --git a/lib/bash/gh/README.md b/lib/bash/gh/README.md
index 52c50d6..7afb4f4 100644
--- a/lib/bash/gh/README.md
+++ b/lib/bash/gh/README.md
@@ -21,12 +21,13 @@ import "/path/to/base-bash-libs/lib/bash/gh/lib_gh.sh"
   lines from the GitHub CLI and then logs a caller-provided login hint, or the
   default `gh auth login -h github.com` hint.
 - `gh_report_command_failure <status> [gh args...]`
-  Logs a failed `gh` command and appends auth diagnostics. The original status
+  Logs a failed `gh` command and appends auth diagnostics. Protected reporting
+  uses the control-first sensitive form documented below. The original status
   is returned.
 - `gh_run [gh args...]`
   Runs `gh "$@"` after command availability checks. On command failure, it
   reports the failed command and auth diagnostics while preserving the original
-  exit status.
+  exit status. Protected calls use the sensitive form documented below.
 - `gh_repo_from_remote_url <remote_url> <result_var>`
   Parses supported GitHub SSH and HTTPS remote URLs into `owner/repo`. Returns
   non-zero for non-GitHub or malformed remotes and leaves the result variable
@@ -42,7 +43,8 @@ import "/path/to/base-bash-libs/lib/bash/gh/lib_gh.sh"
   errors such as secondary rate limits, `Retry-After`, abuse detection, and
   502/503/504-style failures. `BASE_GH_API_MAX_ATTEMPTS` defaults to `2`.
   `BASE_GH_API_RETRY_DELAY_SECONDS` defaults to `2` when the error output does
-  not include a `Retry-After` value.
+  not include a `Retry-After` value. Protected calls use the sensitive form
+  documented below.
 
 All GitHub helper failures return a nonzero status and preserve the underlying
 `gh` status where applicable. The remote parser and origin inference helpers
@@ -53,13 +55,60 @@ Public functions validate the documented argument count before expanding
 required positional parameters. Invalid calls return `1`, including when the
 caller has enabled `nounset`; optional flags such as `--optional` are rejected
 when misspelled. The variadic `gh_run` and `gh_api_with_retry` helpers continue
-to pass all arguments through to `gh` unchanged.
+to pass GitHub arguments after any protected-diagnostic control prefix through
+to `gh` unchanged.
 
 The library does not change the caller's `errexit`, `nounset`, `pipefail`,
 `shopt`, `IFS`, `OPTIND`, cwd, umask, traps, or positional parameters. Its
 diagnostic parsing uses a command-scoped empty `IFS`, and failed `gh` commands
 retain their original status from `1` through `255`.
 
+## Secret-safe command diagnostics
+
+Ordinary `gh_run` and `gh_report_command_failure` failures render every GitHub
+argument with Bash `%q`. This preserves argument boundaries and produces a
+copyable diagnostic, but it is not secret-safe. Headers, fields, URL userinfo,
+positional values, and `--option=value` forms are all rendered as supplied.
+
+Use `--sensitive` whenever any GitHub argument may contain a credential or
+other value that must not enter terminal or persistent logs:
+
+```bash
+gh_run --sensitive --safe-display "create release" -- \
+    release create "$tag" --notes "$private_notes"
+
+gh_api_with_retry --sensitive --safe-display "update project item" -- \
+    graphql --header "Authorization: Bearer $token" \
+    --raw-field "query=$query"
+
+gh_report_command_failure --sensitive --safe-display "publish release" -- \
+    "$status" release create "$tag" --notes "$private_notes"
+```
+
+A protected call requires the explicit `--` separator. `--safe-display` is
+valid only with `--sensitive`; its value must be a non-empty printable ASCII
+label that does not begin with `-` and that the caller has already determined
+is safe to log. The label appears as, for example, `create release [sensitive
+GitHub operation; arguments hidden]`. Without a label the helpers use only the
+generic bracketed description.
+
+Protected diagnostics never render the GitHub argv. This applies to final
+failure records, retry notices, persistent logs, and the nested authentication
+check performed by `gh_run` and `gh_report_command_failure`. A protected
+`gh_api_with_retry` may inspect captured failure text internally to decide
+whether and when to retry, but it does not replay that text on failure.
+Successful API output remains functional stdout and is returned unchanged.
+
+Sensitivity is explicit rather than heuristic. The helpers do not try to infer
+which `--header`, `--field`, `--raw-field`, `--option=value`, URL, extension,
+alias, or positional argument contains a secret. They also do not sanitize
+output emitted by the executed command, whether that command is a shell
+function, builtin, or external subprocess. Caller-enabled shell tracing such
+as `set -x`, operating-system process listings, and an unsafe label supplied
+through `--safe-display` are also outside this guarantee. Callers remain
+responsible for those channels and should prefer non-argv credential
+mechanisms whenever the invoked tool supports them.
+
 ## Boundary
 
 This library is intentionally generic. It does not know about Base branch
diff --git a/lib/bash/gh/lib_gh.sh b/lib/bash/gh/lib_gh.sh
index a5603cc..f216a67 100644
--- a/lib/bash/gh/lib_gh.sh
+++ b/lib/bash/gh/lib_gh.sh
@@ -28,6 +28,129 @@ gh_require_cli() {
     }
 }
 
+__gh_sensitive_controls_usage__() {
+    local __gh_controls_helper_name="${1-}"
+
+    case "$__gh_controls_helper_name" in
+        gh_report_command_failure)
+            log_error -l base_bash_libs.gh \
+                "Usage: gh_report_command_failure <status> [gh args...] or gh_report_command_failure --sensitive [--safe-display <label>] -- <status> [gh args...]"
+            ;;
+        *)
+            log_error -l base_bash_libs.gh \
+                "Usage: $__gh_controls_helper_name [--sensitive [--safe-display <label>] --] [gh args...]"
+            ;;
+    esac
+}
+
+# Parse the optional protected-diagnostic prefix without interpreting ordinary
+# GitHub arguments. Once either control is present, an explicit `--` is
+# required so a malformed protected call cannot accidentally render an argv.
+__gh_parse_sensitive_controls__() {
+    local __gh_controls_consumed_result_name="${1-}"
+    local __gh_controls_sensitive_result_name="${2-}"
+    local __gh_controls_display_result_name="${3-}"
+    local __gh_controls_helper_name="${4-}"
+    shift 4
+
+    local __gh_controls_consumed=0 __gh_controls_sensitive=0
+    local __gh_controls_safe_display="" __gh_controls_display_seen=0
+    local __gh_controls_separator_seen=0
+
+    case "${1-}" in
+        --sensitive | --safe-display)
+            ;;
+        *)
+            printf -v "$__gh_controls_consumed_result_name" '%s' 0
+            printf -v "$__gh_controls_sensitive_result_name" '%s' 0
+            printf -v "$__gh_controls_display_result_name" '%s' ""
+            return 0
+            ;;
+    esac
+
+    while (($#)); do
+        case "${1-}" in
+            --sensitive)
+                if ((__gh_controls_sensitive)); then
+                    __gh_sensitive_controls_usage__ "$__gh_controls_helper_name"
+                    return 1
+                fi
+                __gh_controls_sensitive=1
+                __gh_controls_consumed=$((__gh_controls_consumed + 1))
+                shift
+                ;;
+            --safe-display)
+                if ((__gh_controls_display_seen)) || (($# < 2)) ||
+                    ! __std_is_safe_display__ "${2-}"; then
+                    log_error -l base_bash_libs.gh \
+                        "$__gh_controls_helper_name: --safe-display requires one non-empty printable ASCII label that does not begin with '-'."
+                    return 1
+                fi
+                __gh_controls_safe_display="$2"
+                __gh_controls_display_seen=1
+                __gh_controls_consumed=$((__gh_controls_consumed + 2))
+                shift 2
+                ;;
+            --)
+                __gh_controls_separator_seen=1
+                __gh_controls_consumed=$((__gh_controls_consumed + 1))
+                shift
+                break
+                ;;
+            *)
+                # Do not echo the malformed token: it may itself contain a
+                # credential in an option=value form.
+                log_error -l base_bash_libs.gh \
+                    "$__gh_controls_helper_name: protected diagnostic controls must end with -- before GitHub arguments."
+                return 1
+                ;;
+        esac
+    done
+
+    if ((!__gh_controls_sensitive)); then
+        log_error -l base_bash_libs.gh \
+            "$__gh_controls_helper_name: --safe-display is valid only with --sensitive."
+        return 1
+    fi
+    if ((!__gh_controls_separator_seen)); then
+        log_error -l base_bash_libs.gh \
+            "$__gh_controls_helper_name: --sensitive requires -- before GitHub arguments."
+        return 1
+    fi
+
+    printf -v "$__gh_controls_consumed_result_name" '%s' "$__gh_controls_consumed"
+    printf -v "$__gh_controls_sensitive_result_name" '%s' "$__gh_controls_sensitive"
+    printf -v "$__gh_controls_display_result_name" '%s' "$__gh_controls_safe_display"
+}
+
+__gh_auth_status_diagnostics__() {
+    local __gh_auth_sensitive="${1-0}" __gh_auth_safe_display="${2-}"
+    local __gh_auth_login_hint="${3-Run 'gh auth login -h github.com' and retry.}"
+    local __gh_auth_output __gh_auth_line __gh_auth_display
+
+    gh_require_cli || return 1
+
+    if __gh_auth_output="$(gh auth status -h github.com 2>&1)"; then
+        return 0
+    fi
+
+    if ((__gh_auth_sensitive)); then
+        if ! __std_render_command_display__ __gh_auth_display 1 "$__gh_auth_safe_display" \
+            "[sensitive GitHub operation; arguments hidden]"; then
+            __gh_auth_display="[sensitive GitHub operation; arguments hidden]"
+        fi
+        log_error -l base_bash_libs.gh \
+            "GitHub authentication status could not be confirmed while diagnosing $__gh_auth_display; raw auth diagnostics hidden."
+    else
+        while IFS= read -r __gh_auth_line || [[ -n "$__gh_auth_line" ]]; do
+            [[ -n "$__gh_auth_line" ]] &&
+                log_error -l base_bash_libs.gh "gh auth status: $__gh_auth_line"
+        done <<<"$__gh_auth_output"
+    fi
+    [[ -z "$__gh_auth_login_hint" ]] || log_error -l base_bash_libs.gh "$__gh_auth_login_hint"
+    return 1
+}
+
 # Public callers may provide the optional login hint even though the internal
 # failure reporter uses the default.
 # shellcheck disable=SC2120
@@ -37,58 +160,85 @@ gh_auth_status_diagnostics() {
         return 1
     fi
 
-    local login_hint="${1:-Run 'gh auth login -h github.com' and retry.}"
-    local auth_output line
+    __gh_auth_status_diagnostics__ 0 "" "${1:-Run 'gh auth login -h github.com' and retry.}"
+}
 
-    gh_require_cli || return 1
+__gh_report_command_failure__() {
+    local __gh_report_status="${1-1}" __gh_report_sensitive="${2-0}"
+    local __gh_report_safe_display="${3-}" __gh_report_display
+    shift 3
 
-    auth_output="$(gh auth status -h github.com 2>&1)" || {
-        while IFS= read -r line || [[ -n "$line" ]]; do
-            [[ -n "$line" ]] && log_error -l base_bash_libs.gh "gh auth status: $line"
-        done <<<"$auth_output"
-        [[ -z "$login_hint" ]] || log_error -l base_bash_libs.gh "$login_hint"
-        return 1
-    }
+    if ! __std_render_command_display__ __gh_report_display "$__gh_report_sensitive" \
+        "$__gh_report_safe_display" "[sensitive GitHub operation; arguments hidden]" gh "$@"; then
+        if ((__gh_report_sensitive)); then
+            __gh_report_display="[sensitive GitHub operation; arguments hidden]"
+        else
+            __gh_report_display=gh
+        fi
+    fi
+
+    log_error -l base_bash_libs.gh \
+        "GitHub command failed: $__gh_report_display (exit $__gh_report_status)"
+    __gh_auth_status_diagnostics__ "$__gh_report_sensitive" "$__gh_report_safe_display" \
+        "Run 'gh auth login -h github.com' and retry." || true
+    return "$__gh_report_status"
 }
 
 gh_report_command_failure() {
+    local __gh_report_public_consumed=0 __gh_report_public_sensitive=0
+    local __gh_report_public_safe_display=""
+    local __gh_report_public_status
+
+    __gh_parse_sensitive_controls__ __gh_report_public_consumed \
+        __gh_report_public_sensitive __gh_report_public_safe_display \
+        gh_report_command_failure "$@" || return 1
+    ((__gh_report_public_consumed == 0)) || shift "$__gh_report_public_consumed"
+
     if (($# < 1)); then
-        log_error -l base_bash_libs.gh "Usage: gh_report_command_failure <status> [gh args...]"
+        __gh_sensitive_controls_usage__ gh_report_command_failure
         return 1
     fi
-
-    local status="$1"
+    __gh_report_public_status="$1"
     shift
-    local printable_args=""
 
-    if [[ ! "$status" =~ ^[0-9]{1,3}$ ]]; then
-        log_error -l base_bash_libs.gh "Usage: gh_report_command_failure <status> [gh args...]"
+    if [[ ! "$__gh_report_public_status" =~ ^[0-9]{1,3}$ ]]; then
+        __gh_sensitive_controls_usage__ gh_report_command_failure
         return 1
     fi
-    status=$((10#$status))
-    if ((status < 1 || status > 255)); then
-        log_error -l base_bash_libs.gh "Usage: gh_report_command_failure <status> [gh args...]"
+    __gh_report_public_status=$((10#$__gh_report_public_status))
+    if ((__gh_report_public_status < 1 || __gh_report_public_status > 255)); then
+        __gh_sensitive_controls_usage__ gh_report_command_failure
         return 1
     fi
 
-    if (($#)); then
-        printf -v printable_args '%q ' "$@"
-        printable_args="${printable_args% }"
-        log_error -l base_bash_libs.gh "GitHub command failed: gh $printable_args"
-    else
-        log_error -l base_bash_libs.gh "GitHub command failed: gh"
-    fi
-    gh_auth_status_diagnostics || true
-    return "$status"
+    __gh_report_command_failure__ "$__gh_report_public_status" \
+        "$__gh_report_public_sensitive" "$__gh_report_public_safe_display" "$@" || true
+    return "$__gh_report_public_status"
 }
 
 gh_run() {
-    local status=0
+    local __gh_run_consumed=0 __gh_run_sensitive=0 __gh_run_safe_display=""
+    local __gh_run_status=0
+
+    __gh_parse_sensitive_controls__ __gh_run_consumed __gh_run_sensitive \
+        __gh_run_safe_display gh_run "$@" || return 1
+    ((__gh_run_consumed == 0)) || shift "$__gh_run_consumed"
+    # A caller may provide `gh` as a shell function. Lock the normalized
+    # diagnostic policy before invoking it so Bash's dynamic scope cannot let
+    # that function downgrade protected failure reporting.
+    local -r __gh_run_locked_sensitive="$__gh_run_sensitive"
+    local -r __gh_run_locked_safe_display="$__gh_run_safe_display"
 
     gh_require_cli || return 1
-    gh "$@" || status=$?
-    ((status == 0)) && return 0
-    gh_report_command_failure "$status" "$@"
+    if gh "$@"; then
+        return 0
+    else
+        __gh_run_status=$?
+    fi
+
+    __gh_report_command_failure__ "$__gh_run_status" "$__gh_run_locked_sensitive" \
+        "$__gh_run_locked_safe_display" "$@" || true
+    return "$__gh_run_status"
 }
 
 __gh_parse_repo_from_remote_url__() {
@@ -243,39 +393,66 @@ __gh_api_retry_delay_seconds() {
 }
 
 gh_api_with_retry() {
-    local max_attempts="${BASE_GH_API_MAX_ATTEMPTS:-2}"
-    local attempt=1
-    local output status delay
+    local __gh_api_consumed=0 __gh_api_sensitive=0 __gh_api_safe_display=""
+    local __gh_api_max_attempts="${BASE_GH_API_MAX_ATTEMPTS:-2}"
+    local __gh_api_attempt=1
+    local __gh_api_output __gh_api_status __gh_api_delay __gh_api_display=""
+
+    __gh_parse_sensitive_controls__ __gh_api_consumed __gh_api_sensitive \
+        __gh_api_safe_display gh_api_with_retry "$@" || return 1
+    ((__gh_api_consumed == 0)) || shift "$__gh_api_consumed"
 
     gh_require_cli || return 1
-    if [[ ! "$max_attempts" =~ ^[0-9]+$ ]] || ((max_attempts < 1)); then
+    if [[ ! "$__gh_api_max_attempts" =~ ^[0-9]+$ ]] || ((__gh_api_max_attempts < 1)); then
         log_warn -l base_bash_libs.gh "BASE_GH_API_MAX_ATTEMPTS must be a positive integer; using 2."
-        max_attempts=2
+        __gh_api_max_attempts=2
+    fi
+    if ((__gh_api_sensitive)); then
+        if ! __std_render_command_display__ __gh_api_display 1 "$__gh_api_safe_display" \
+            "[sensitive GitHub operation; arguments hidden]" gh api "$@"; then
+            __gh_api_display="[sensitive GitHub operation; arguments hidden]"
+        fi
     fi
 
-    while ((attempt <= max_attempts)); do
-        if output="$(gh api "$@" 2>&1)"; then
-            status=0
+    while ((__gh_api_attempt <= __gh_api_max_attempts)); do
+        if __gh_api_output="$(gh api "$@" 2>&1)"; then
+            __gh_api_status=0
         else
-            status=$?
+            __gh_api_status=$?
         fi
-        if ((status == 0)); then
-            [[ -z "$output" ]] || printf '%s\n' "$output"
+        if ((__gh_api_status == 0)); then
+            [[ -z "$__gh_api_output" ]] || printf '%s\n' "$__gh_api_output"
             return 0
         fi
 
-        if ((attempt == max_attempts)) || ! __gh_api_failure_retryable "$output"; then
-            [[ -z "$output" ]] || printf '%s\n' "$output" >&2
-            return "$status"
+        if ((__gh_api_attempt == __gh_api_max_attempts)) ||
+            ! __gh_api_failure_retryable "$__gh_api_output"; then
+            if ((__gh_api_sensitive)); then
+                log_error -l base_bash_libs.gh \
+                    "GitHub API call failed on attempt $__gh_api_attempt of $__gh_api_max_attempts: $__gh_api_display (exit $__gh_api_status; captured output hidden)."
+            else
+                [[ -z "$__gh_api_output" ]] || printf '%s\n' "$__gh_api_output" >&2
+            fi
+            return "$__gh_api_status"
         fi
 
-        if ((max_attempts == 2)); then
-            log_warn -l base_bash_libs.gh "GitHub API call failed on attempt $attempt; retrying once."
+        if ((__gh_api_sensitive)); then
+            if ((__gh_api_max_attempts == 2)); then
+                log_warn -l base_bash_libs.gh \
+                    "GitHub API call failed for $__gh_api_display on attempt $__gh_api_attempt; retrying once."
+            else
+                log_warn -l base_bash_libs.gh \
+                    "GitHub API call failed for $__gh_api_display on attempt $__gh_api_attempt; retrying (attempt $((__gh_api_attempt + 1)) of $__gh_api_max_attempts)."
+            fi
+        elif ((__gh_api_max_attempts == 2)); then
+            log_warn -l base_bash_libs.gh \
+                "GitHub API call failed on attempt $__gh_api_attempt; retrying once."
         else
-            log_warn -l base_bash_libs.gh "GitHub API call failed on attempt $attempt; retrying (attempt $((attempt + 1)) of $max_attempts)."
+            log_warn -l base_bash_libs.gh \
+                "GitHub API call failed on attempt $__gh_api_attempt; retrying (attempt $((__gh_api_attempt + 1)) of $__gh_api_max_attempts)."
         fi
-        delay="$(__gh_api_retry_delay_seconds "$output")"
-        __std_sleep_interval__ "$delay"
-        attempt=$((attempt + 1))
+        __gh_api_delay="$(__gh_api_retry_delay_seconds "$__gh_api_output")"
+        __std_sleep_interval__ "$__gh_api_delay"
+        __gh_api_attempt=$((__gh_api_attempt + 1))
     done
 }
diff --git a/lib/bash/gh/tests/lib_gh.bats b/lib/bash/gh/tests/lib_gh.bats
index 973cc80..dc86aae 100644
--- a/lib/bash/gh/tests/lib_gh.bats
+++ b/lib/bash/gh/tests/lib_gh.bats
@@ -94,6 +94,62 @@ create_fake_git() {
     [[ "$output" == *"Usage: gh_report_command_failure <status> [gh args...]"* ]]
 }
 
+@test "GitHub sensitive controls fail closed before executing or echoing malformed arguments" {
+    local secret="parser-canary with spaces"
+    local unicode_label=$'unicode-label-canary\xe2\x80\xa8\xe2\x80\xae'
+    local invocation_file="$TEST_TMPDIR/parser-invoked"
+
+    create_fake_gh <<'EOF'
+#!/usr/bin/env bash
+printf 'invoked\n' > "${TEST_TMPDIR:?}/parser-invoked"
+exit 0
+EOF
+
+    capture_command gh_run --sensitive "--opaque=$secret" -- issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"protected diagnostic controls must end with --"* ]]
+    [[ "$output" != *"$secret"* ]]
+
+    capture_command gh_api_with_retry --safe-display "safe API operation" -- repos/owner/repo
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"--safe-display is valid only with --sensitive"* ]]
+
+    capture_command gh_run --sensitive --safe-display "--token=$secret" -- issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"one non-empty printable ASCII label"* ]]
+    [[ "$output" != *"$secret"* ]]
+
+    capture_command gh_run --sensitive --safe-display "-H$secret" -- issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"one non-empty printable ASCII label"* ]]
+    [[ "$output" != *"$secret"* ]]
+
+    capture_command gh_api_with_retry --sensitive --safe-display "-fsecret=$secret" -- repos/owner/repo
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"one non-empty printable ASCII label"* ]]
+    [[ "$output" != *"$secret"* ]]
+
+    capture_command gh_run --sensitive --safe-display "$unicode_label" -- issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"one non-empty printable ASCII label"* ]]
+    [[ "$output" != *"unicode-label-canary"* ]]
+
+    capture_command gh_report_command_failure --sensitive 77 issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"protected diagnostic controls must end with --"* ]]
+
+    capture_command gh_report_command_failure --sensitive -- "status=$secret" issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"Usage: gh_report_command_failure"* ]]
+    [[ "$output" != *"$secret"* ]]
+
+    capture_command gh_run --sensitive --safe-display $'unsafe\nparser-secret' -- issue list
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"one non-empty printable ASCII label"* ]]
+    [[ "$output" != *"parser-secret"* ]]
+    [ ! -e "$invocation_file" ]
+}
+
 @test "GitHub diagnostics are independent of and preserve caller IFS" {
     local output_file="$TEST_TMPDIR/auth-diagnostics.out"
     local rc
@@ -147,6 +203,25 @@ EOF
         [ "$status" -eq 7 ]
         [[ "$output" == *"GitHub command failed: gh issue list"* ]]
         [[ "$output" != *"unbound variable"* ]]
+
+        bats_run "$BASH" -c '
+            mode="$1"
+            case "$mode" in *e*) set -e ;; esac
+            case "$mode" in *u*) set -u ;; esac
+            case "$mode" in *p*) set -o pipefail ;; esac
+            source "$2"
+            source "$3"
+            PATH="$4:$PATH"
+            gh_run --sensitive --safe-display "strict protected operation" -- issue list
+            rc=$?
+            exit "$rc"
+        ' bash "$mode" "$BASE_BASH_DIR/std/lib_std.sh" "$BASE_BASH_DIR/gh/lib_gh.sh" "$TEST_TMPDIR/bin"
+
+        [ "$status" -eq 7 ]
+        [[ "$output" == *"strict protected operation [sensitive GitHub operation; arguments hidden]"* ]]
+        [[ "$output" == *"(exit 7)"* ]]
+        [[ "$output" != *"gh auth status: not logged in"* ]]
+        [[ "$output" != *"unbound variable"* ]]
     done
 }
 
@@ -282,6 +357,97 @@ EOF
     [[ "$output" == *"Run 'gh auth login -h github.com' and retry."* ]]
 }
 
+@test "gh_run sensitive diagnostics hide every argv form and nested auth output from all log sinks" {
+    local secret="gh-run-canary with spaces"
+    local primary_log="$TEST_TMPDIR/gh-run-sensitive.log"
+    local received_args="$TEST_TMPDIR/gh-run-sensitive.args"
+    local primary_content
+
+    export GH_TEST_SECRET="$secret"
+    BASE_CLI_PRIMARY_LOG="$primary_log"
+    create_fake_gh <<'EOF'
+#!/usr/bin/env bash
+if [[ "${1-}" == "auth" && "${2-}" == "status" ]]; then
+    printf 'auth diagnostic exposed %s\n' "${GH_TEST_SECRET:?}" >&2
+    exit 4
+fi
+printf '<%s>\n' "$@" > "${TEST_TMPDIR:?}/gh-run-sensitive.args"
+exit 73
+EOF
+
+    capture_command gh_run --sensitive --safe-display "create protected issue" -- \
+        api graphql \
+        "spaced value $secret" \
+        "--option=$secret" \
+        --header "Authorization: Bearer $secret" \
+        "https://user:$secret@github.example.test/resource" \
+        --field "token=$secret"
+
+    [ "$status" -eq 73 ]
+    [[ "$output" == *"create protected issue [sensitive GitHub operation; arguments hidden]"* ]]
+    [[ "$output" == *"GitHub command failed:"* ]]
+    [[ "$output" == *"(exit 73)"* ]]
+    [[ "$output" == *"raw auth diagnostics hidden"* ]]
+    [[ "$output" == *"Run 'gh auth login -h github.com' and retry."* ]]
+    [[ "$output" != *"$secret"* ]]
+    [[ "$(cat "$received_args")" == *"$secret"* ]]
+
+    primary_content="$(cat "$primary_log")"
+    [[ "$primary_content" == *"create protected issue"* ]]
+    [[ "$primary_content" == *"(exit 73)"* ]]
+    [[ "$primary_content" == *"raw auth diagnostics hidden"* ]]
+    [[ "$primary_content" != *"$secret"* ]]
+}
+
+@test "gh_run locks sensitive diagnostics against a dynamically scoped gh function" {
+    local secret="dynamic-scope-gh-canary"
+
+    gh() {
+        if [[ "${1-}" == "auth" && "${2-}" == "status" ]]; then
+            printf 'auth diagnostic exposed %s\n' "$secret" >&2
+            return 4
+        fi
+        __gh_run_sensitive=0
+        __gh_run_safe_display=""
+        return 67
+    }
+
+    capture_command gh_run --sensitive --safe-display "protected function call" -- \
+        api graphql --header "Authorization: Bearer $secret"
+    unset -f gh
+
+    [ "$status" -eq 67 ]
+    [[ "$output" == *"protected function call [sensitive GitHub operation; arguments hidden]"* ]]
+    [[ "$output" == *"(exit 67)"* ]]
+    [[ "$output" == *"raw auth diagnostics hidden"* ]]
+    [[ "$output" != *"$secret"* ]]
+}
+
+@test "gh_report_command_failure accepts control-first sensitive reporting through status 255" {
+    local secret="public-reporter-canary"
+
+    export GH_TEST_SECRET="$secret"
+    create_fake_gh <<'EOF'
+#!/usr/bin/env bash
+if [[ "${1-}" == "auth" && "${2-}" == "status" ]]; then
+    printf 'auth diagnostic exposed %s\n' "${GH_TEST_SECRET:?}" >&2
+    exit 4
+fi
+exit 99
+EOF
+
+    capture_command gh_report_command_failure \
+        --sensitive --safe-display "publish protected release" -- \
+        255 api repos/owner/repo --header "Authorization: Bearer $secret"
+
+    [ "$status" -eq 255 ]
+    [[ "$output" == *"publish protected release [sensitive GitHub operation; arguments hidden]"* ]]
+    [[ "$output" == *"(exit 255)"* ]]
+    [[ "$output" == *"raw auth diagnostics hidden"* ]]
+    [[ "$output" != *"$secret"* ]]
+    [[ "$output" != *"--header"* ]]
+}
+
 @test "gh_run reports command failure under set -e" {
     local script="$TEST_TMPDIR/gh-run-set-e.sh"
 
@@ -327,6 +493,7 @@ EOF
 
     [ "$status" -eq 7 ]
     [[ "$output" == *"GitHub command failed: gh issue create --title Example\\ Title --body body\\ value"* ]]
+    [[ "$output" == *"(exit 7)"* ]]
     [[ "$output" != *"GitHub command failed: gh issue create --title Example Title --body body value"* ]]
 }
 
@@ -565,6 +732,65 @@ EOF
     [ "$(cat "$TEST_TMPDIR/gh-api-count")" = "2" ]
 }
 
+@test "gh_api_with_retry sensitive retries and final failures never replay captured secrets" {
+    local secret="gh-api-canary with spaces"
+    local primary_log="$TEST_TMPDIR/gh-api-sensitive.log"
+    local primary_content
+
+    export GH_TEST_SECRET="$secret"
+    export BASE_CLI_PRIMARY_LOG="$primary_log"
+    export BASE_GH_API_MAX_ATTEMPTS=2
+    export BASE_GH_API_RETRY_DELAY_SECONDS=0
+    create_fake_gh <<'EOF'
+#!/usr/bin/env bash
+state_file="${TEST_TMPDIR:?}/gh-api-sensitive-count"
+count=0
+[[ -f "$state_file" ]] && read -r count < "$state_file"
+count=$((count + 1))
+printf '%s\n' "$count" > "$state_file"
+printf 'secondary rate limit; retry-after: 0; captured=%s\n' "${GH_TEST_SECRET:?}" >&2
+exit 29
+EOF
+
+    capture_command gh_api_with_retry --sensitive --safe-display "rotate deployment key" -- \
+        repos/owner/repo \
+        "spaced value $secret" \
+        "--option=$secret" \
+        --header "Authorization: Bearer $secret" \
+        "https://user:$secret@github.example.test/resource" \
+        --raw-field "token=$secret"
+
+    [ "$status" -eq 29 ]
+    [ "$(cat "$TEST_TMPDIR/gh-api-sensitive-count")" = "2" ]
+    [[ "$output" == *"rotate deployment key [sensitive GitHub operation; arguments hidden]"* ]]
+    [[ "$output" == *"retrying once"* ]]
+    [[ "$output" == *"attempt 2 of 2"* ]]
+    [[ "$output" == *"exit 29"* ]]
+    [[ "$output" == *"captured output hidden"* ]]
+    [[ "$output" != *"$secret"* ]]
+
+    primary_content="$(cat "$primary_log")"
+    [[ "$primary_content" == *"rotate deployment key"* ]]
+    [[ "$primary_content" == *"retrying once"* ]]
+    [[ "$primary_content" == *"exit 29"* ]]
+    [[ "$primary_content" != *"$secret"* ]]
+}
+
+@test "gh_api_with_retry sensitive success preserves functional stdout" {
+    local secret="successful-api-argv-canary"
+
+    create_fake_gh <<'EOF'
+#!/usr/bin/env bash
+printf '{"ok":true}\n'
+EOF
+
+    capture_command gh_api_with_retry --sensitive --safe-display "read protected API data" -- \
+        repos/owner/repo --header "Authorization: Bearer $secret"
+
+    [ "$status" -eq 0 ]
+    [ "$output" = '{"ok":true}' ]
+}
+
 @test "gh_api_with_retry avoids shadowed sleep functions between retries" {
     local shadow_file="$TEST_TMPDIR/shadowed-sleep-called"
 
diff --git a/lib/bash/std/README.md b/lib/bash/std/README.md
index 3e6f909..1329cb1 100644
--- a/lib/bash/std/README.md
+++ b/lib/bash/std/README.md
@@ -337,10 +337,12 @@ set_log_category_level -l base_bash_libs.git DEBUG
 `base_bash_libs` DEBUG gate. The deprecated `--verbose-wrapper` continues to
 enable both at VERBOSE during the compatibility window.
 
-`lib_std.sh` does not log the process argument vector automatically. Arguments
-may contain credentials or other sensitive data; applications that need
-invocation diagnostics should apply schema-aware redaction before calling
-`log_debug`.
+Merely sourcing `lib_std.sh` does not log the caller process argument vector.
+Explicit command execution is different: ordinary `std_run` dry-run and
+failure diagnostics intentionally render the command arguments with Bash
+`%q`. Arguments may contain credentials or other sensitive data, so use
+`std_run --sensitive` for a protected command and apply schema-aware redaction
+before writing any caller-owned invocation diagnostic.
 
 Use `log_is_enabled` to avoid constructing an expensive diagnostic unless a
 terminal or persistent sink will consume it:
@@ -403,7 +405,8 @@ It improves on ad hoc command strings because it:
 
 - executes commands as argument arrays, not through `eval`
 - preserves spaces and special characters
-- logs a copy-pastable command in dry-run mode
+- logs a copy-pastable command in ordinary dry-run and failure diagnostics
+- can replace sensitive command text with a protected marker and safe label
 - can bound each attempt with `--timeout`
 - can retry transient failures with `--max-attempts` and `--retry-delay`
 - exits through `exit_if_error` by default when a command fails
@@ -419,6 +422,51 @@ std_run brew install jq
 `is_dry_run` when a script needs to branch on the same normalized dry-run state
 without executing a command through `std_run`.
 
+Protect framework-generated diagnostics for a command whose arguments contain
+credentials or other sensitive values with `--sensitive`. Protected calls must
+use `--` to separate runner options from the command:
+
+```bash
+std_run \
+    --sensitive \
+    --safe-display "upload release asset" \
+    -- \
+    curl \
+        --header "Authorization: Bearer $token" \
+        --form "asset=@$archive" \
+        "$upload_url"
+```
+
+The rendered operation is:
+
+```text
+upload release asset [sensitive command; arguments hidden]
+```
+
+Without `--safe-display`, diagnostics contain only
+`[sensitive command; arguments hidden]`. A safe display must be non-empty,
+contain only printable ASCII bytes, and not begin with `-`. The byte-oriented
+rule rejects line separators, bidirectional text controls, and other
+locale-dependent non-printing characters. Rejecting a leading hyphen prevents
+a missing label from consuming an option-like command argument. The label is
+copied into terminal and persistent diagnostics exactly as the caller supplies
+it, so the caller is responsible for ensuring that the label itself contains
+no secret.
+
+`--sensitive` changes diagnostics only. It does not alter argument boundaries,
+execution, status propagation, timeout, retry, dry-run, or `--quiet` behavior,
+and it does not attempt heuristic redaction. In particular, it cannot protect:
+
+- output emitted by the executed command, including shell functions, builtins,
+  and subprocesses
+- shell tracing such as `set -x`
+- command arguments visible through the operating system process list
+- secrets placed in the caller-supplied safe display or other explicit logs
+
+Configure or redirect an executed command that may echo secrets, and disable
+tracing around sensitive invocations. Ordinary commands continue to use `%q`
+so their diagnostics retain exact, copy-pastable argument boundaries.
+
 Handle a failing command yourself with `--no-exit`:
 
 ```bash
@@ -481,6 +529,12 @@ first:
 std_run -- --command-name arg
 ```
 
+The separator is optional for ordinary commands whose name does not begin with
+`--`, but mandatory whenever `--sensitive` is selected. `--safe-display` is
+valid only with `--sensitive`. Invalid protected controls return `1` without
+executing the command, and their diagnostics do not repeat an offending token
+after sensitive mode has been selected.
+
 Timeout execution prefers `timeout` or `gtimeout` when available and otherwise
 uses a Bash fallback so scripts work on macOS and Linux.
 
diff --git a/lib/bash/std/lib_std.sh b/lib/bash/std/lib_std.sh
index 8a7d00d..e5f27dd 100644
--- a/lib/bash/std/lib_std.sh
+++ b/lib/bash/std/lib_std.sh
@@ -1149,6 +1149,61 @@ __std_is_non_negative_integer__() {
     ((__std_non_negative_normalized >= 0))
 }
 
+__std_is_safe_display__() {
+    (($# == 1)) || return 1
+
+    local __std_safe_display_value="${1-}"
+    local __std_safe_display_allowed_ascii
+    local __std_safe_display_character __std_safe_display_index
+
+    # Spell out the printable ASCII set instead of changing LC_ALL. Bash
+    # variables use dynamic scope, so even a function-local locale binding can
+    # collide with a caller's readonly LC_ALL. Quoted substring membership is
+    # independent of character classes and locale collation.
+    __std_safe_display_allowed_ascii=$' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
+
+    [[ -n "$__std_safe_display_value" && "$__std_safe_display_value" != -* ]] || return 1
+    for ((__std_safe_display_index = 0;
+        __std_safe_display_index < ${#__std_safe_display_value};
+        __std_safe_display_index++)); do
+        __std_safe_display_character="${__std_safe_display_value:__std_safe_display_index:1}"
+        [[ "$__std_safe_display_allowed_ascii" == *"$__std_safe_display_character"* ]] || return 1
+    done
+}
+
+__std_render_command_display__() {
+    (($# >= 4)) || return 1
+
+    local __std_render_display_result_name="${1-}"
+    local __std_render_display_sensitive="${2-}"
+    local __std_render_display_safe_value="${3-}"
+    local __std_render_display_protected_description="${4-}"
+    local __std_render_display_value=""
+    shift 4
+
+    case "$__std_render_display_sensitive" in
+        1)
+            if [[ -n "$__std_render_display_safe_value" ]]; then
+                __std_is_safe_display__ "$__std_render_display_safe_value" || return 1
+                __std_render_display_value="$__std_render_display_safe_value $__std_render_display_protected_description"
+            else
+                __std_render_display_value="$__std_render_display_protected_description"
+            fi
+            ;;
+        0)
+            if (($#)); then
+                printf -v __std_render_display_value '%q ' "$@"
+                __std_render_display_value="${__std_render_display_value% }"
+            fi
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+
+    printf -v "$__std_render_display_result_name" '%s' "$__std_render_display_value"
+}
+
 __std_join_run_policy__() {
     local result_name="$1" timeout_seconds="$2" max_attempts="$3" retry_delay="$4"
     local policies=()
@@ -1169,14 +1224,28 @@ __std_join_run_policy__() {
 }
 
 __std_run_once__() {
-    local timeout_seconds="$1" timeout_path="$2"
-    shift 2
-
-    if [[ -n "$timeout_seconds" ]]; then
-        if [[ -n "$timeout_path" ]]; then
-            "$timeout_path" "$timeout_seconds" "$@"
+    local __std_run_once_timeout_seconds="$1" __std_run_once_timeout_path="$2"
+    # These mutable locals shadow the caller's authoritative state while a
+    # shell-function command runs in Bash's dynamic scope. Assignments made by
+    # the command are absorbed here and discarded when this helper returns.
+    local __std_run_attempt_number="$3"
+    # shellcheck disable=SC2034 # Deliberate dynamic-scope collision shields.
+    local __std_run_immutable_command_display
+    # shellcheck disable=SC2034 # Deliberate dynamic-scope collision shields.
+    local __std_run_policy_exit_on_failure __std_run_policy_quiet
+    # shellcheck disable=SC2034 # Deliberate dynamic-scope collision shields.
+    local __std_run_policy_timeout_seconds __std_run_policy_timeout_path
+    # shellcheck disable=SC2034 # Deliberate dynamic-scope collision shields.
+    local __std_run_policy_max_attempts __std_run_policy_retry_delay
+    # shellcheck disable=SC2034 # Deliberate dynamic-scope collision shields.
+    local __std_run_exit_code __std_run_message
+    shift 3
+
+    if [[ -n "$__std_run_once_timeout_seconds" ]]; then
+        if [[ -n "$__std_run_once_timeout_path" ]]; then
+            "$__std_run_once_timeout_path" "$__std_run_once_timeout_seconds" "$@"
         else
-            __std_run_with_timeout_fallback__ "$timeout_seconds" "$@"
+            __std_run_with_timeout_fallback__ "$__std_run_once_timeout_seconds" "$@"
         fi
     else
         "$@"
@@ -1215,9 +1284,13 @@ __std_run_status_message__() {
 #   - Optional Quiet Probe: If an initial argument is `--quiet`, handled
 #     failures do not log warnings. This is intended for expected probe
 #     failures and is most useful with `--no-exit`.
+#   - Protected Diagnostics: `--sensitive` prevents framework-generated
+#     diagnostics from rendering the command arguments. `--safe-display`
+#     supplies an optional caller-vetted, single-line operation label.
 #
 # Usage:
 #   std_run [options] command [arg1] [arg2] ...
+#   std_run --sensitive [--safe-display label] [options] -- command [arg1] ...
 #
 # Options:
 #   --no-exit   If provided as an initial argument, the script will not
@@ -1233,6 +1306,12 @@ __std_run_status_message__() {
 #               Alias for --max-attempts.
 #   --retry-delay N
 #               Sleep N seconds between failed attempts. Defaults to 0.
+#   --sensitive  Hide the command and all arguments from framework-generated
+#               dry-run, retry, timeout, and final-failure diagnostics. A
+#               literal `--` must separate runner options from the command.
+#   --safe-display LABEL
+#               Add a printable ASCII operation label that is non-empty and
+#               does not begin with `-`. Valid only with `--sensitive`.
 #
 # Examples:
 #   # Run a simple command. Exits if `ls` fails.
@@ -1250,11 +1329,16 @@ __std_run_status_message__() {
 #   DRY_RUN=true
 #   std_run rm -rf /some/important/path
 #
+#   # Protect credentials in framework-generated diagnostics.
+#   std_run --sensitive --safe-display "upload release asset" -- \
+#       curl -H "Authorization: Bearer $token" "$upload_url"
+#
 ################################################################################
 __std_run_impl__() {
     local helper_name="$1"
     shift
     local exit_on_failure=1 quiet=0 timeout_seconds="" timeout_path="" max_attempts=1 retry_delay=0
+    local sensitive=0 safe_display="" safe_display_set=0 option_terminator_seen=0
 
     # Parse optional run flags before the command.
     while (($#)); do
@@ -1294,13 +1378,30 @@ __std_run_impl__() {
                 __std_decimal_integer_value__ retry_delay "$1"
                 shift
                 ;;
+            --sensitive)
+                sensitive=1
+                shift
+                ;;
+            --safe-display)
+                safe_display_set=1
+                shift
+                if (($# == 0)) || [[ "${1-}" == -* ]]; then
+                    log_error -l base_bash_libs.std \
+                        "$helper_name: --safe-display requires a non-empty printable ASCII label that does not begin with -."
+                    return 1
+                fi
+                safe_display="$1"
+                shift
+                ;;
             --)
+                option_terminator_seen=1
                 shift
                 break
                 ;;
             *)
                 if [[ "${1-}" == --* ]]; then
-                    log_error -l base_bash_libs.std "$helper_name: unknown option '$1'. Use -- before commands that begin with --."
+                    log_error -l base_bash_libs.std \
+                        "$helper_name: unknown runner option. Use -- before commands that begin with --."
                     return 1
                 fi
                 break
@@ -1308,28 +1409,62 @@ __std_run_impl__() {
         esac
     done
 
+    if ((safe_display_set && ! sensitive)); then
+        log_error -l base_bash_libs.std "$helper_name: --safe-display is valid only with --sensitive."
+        return 1
+    fi
+    if ((safe_display_set)) && ! __std_is_safe_display__ "$safe_display"; then
+        log_error -l base_bash_libs.std \
+            "$helper_name: --safe-display requires a non-empty printable ASCII label that does not begin with -."
+        return 1
+    fi
+    if ((sensitive && ! option_terminator_seen)); then
+        log_error -l base_bash_libs.std \
+            "$helper_name: --sensitive requires -- before the command."
+        return 1
+    fi
+
     # Check if the command is empty.
     if [[ $# -eq 0 ]]; then
         log_error -l base_bash_libs.std "$helper_name: No command provided."
         return 1
     fi
 
-    local printable_command
-    printf -v printable_command "%q " "$@"
-    printable_command="${printable_command% }"
+    local __std_run_immutable_command_display
+    __std_render_command_display__ __std_run_immutable_command_display "$sensitive" "$safe_display" \
+        '[sensitive command; arguments hidden]' "$@" || {
+        log_error -l base_bash_libs.std "$helper_name: could not render a safe command diagnostic."
+        return 1
+    }
+    readonly __std_run_immutable_command_display
+
+    # Bash functions execute in the caller's dynamic scope. Freeze every
+    # parsed value that remains authoritative after command execution, and use
+    # only these uniquely prefixed copies below. A command may happen to assign
+    # generic names such as `timeout_seconds` or `quiet`; those assignments
+    # must not alter retry behavior or become framework-generated diagnostics.
+    local -r __std_run_policy_exit_on_failure="$exit_on_failure"
+    local -r __std_run_policy_quiet="$quiet"
+    local -r __std_run_policy_timeout_seconds="$timeout_seconds"
+    local -r __std_run_policy_max_attempts="$max_attempts"
+    local -r __std_run_policy_retry_delay="$retry_delay"
 
     # --- Dry-Run Handling ---
     if is_dry_run; then
         local policy_description
-        __std_join_run_policy__ policy_description "$timeout_seconds" "$max_attempts" "$retry_delay"
-
-        # Use printf with the %q format specifier. This is the safest way to
-        # print a command and its arguments in a way that is unambiguous and
-        # could be copied and pasted back into a shell.
+        __std_join_run_policy__ policy_description \
+            "$__std_run_policy_timeout_seconds" \
+            "$__std_run_policy_max_attempts" \
+            "$__std_run_policy_retry_delay"
+
+        # Ordinary commands use a copy-pastable %q rendering. Sensitive
+        # commands use only the caller-vetted label or the protected marker;
+        # the renderer does not inspect or format their command arguments.
         if [[ -n "$policy_description" ]]; then
-            log_info -l base_bash_libs.std "[DRY-RUN] Would run with ${policy_description}: ${printable_command}"
+            log_info -l base_bash_libs.std \
+                "[DRY-RUN] Would run with ${policy_description}: ${__std_run_immutable_command_display}"
         else
-            log_info -l base_bash_libs.std "[DRY-RUN] Would run: ${printable_command}"
+            log_info -l base_bash_libs.std "[DRY-RUN] Would run: ${__std_run_immutable_command_display}"
         fi
         return 0
     fi
@@ -1338,48 +1473,58 @@ __std_run_impl__() {
     # Execute the command. Using "$@" is the key. It expands each argument
     # as a separate, quoted string, preserving spaces and special characters.
     # This is the safe, modern alternative to using `eval`.
-    if [[ -n "$timeout_seconds" ]]; then
+    if [[ -n "$__std_run_policy_timeout_seconds" ]]; then
         std_command_path timeout_path timeout || std_command_path timeout_path gtimeout || timeout_path=""
     fi
+    local -r __std_run_policy_timeout_path="$timeout_path"
 
-    local attempt=1 exit_code=0 message
-    while ((attempt <= max_attempts)); do
-        if __std_run_once__ "$timeout_seconds" "$timeout_path" "$@"; then
+    local __std_run_attempt_number=1 __std_run_exit_code=0 __std_run_message
+    while ((__std_run_attempt_number <= __std_run_policy_max_attempts)); do
+        if __std_run_once__ \
+            "$__std_run_policy_timeout_seconds" \
+            "$__std_run_policy_timeout_path" \
+            "$__std_run_attempt_number" \
+            "$@"; then
             return 0
         else
-            exit_code=$?
+            __std_run_exit_code=$?
         fi
 
-        if ((attempt < max_attempts)); then
-            if ((! quiet)); then
-                __std_run_status_message__ message "$exit_code" "$timeout_seconds" "$printable_command"
-                log_warn -l base_bash_libs.std "${message} (attempt ${attempt} of ${max_attempts}; retrying)."
+        if ((__std_run_attempt_number < __std_run_policy_max_attempts)); then
+            if ((! __std_run_policy_quiet)); then
+                __std_run_status_message__ __std_run_message \
+                    "$__std_run_exit_code" "$__std_run_policy_timeout_seconds" \
+                    "$__std_run_immutable_command_display"
+                log_warn -l base_bash_libs.std \
+                    "${__std_run_message} (attempt ${__std_run_attempt_number} of ${__std_run_policy_max_attempts}; retrying)."
             fi
-            if ((retry_delay > 0)); then
-                __std_sleep_interval__ "$retry_delay"
+            if ((__std_run_policy_retry_delay > 0)); then
+                __std_sleep_interval__ "$__std_run_policy_retry_delay"
             fi
         fi
 
-        attempt=$((attempt + 1))
+        __std_run_attempt_number=$((__std_run_attempt_number + 1))
     done
 
-    if ((exit_code)); then
-        if ((max_attempts > 1)); then
-            if ((exit_code == 124)) && [[ -n "$timeout_seconds" ]]; then
-                message="Command timed out after ${timeout_seconds}s on final attempt (${max_attempts} attempts): ${printable_command}"
+    if ((__std_run_exit_code)); then
+        if ((__std_run_policy_max_attempts > 1)); then
+            if ((__std_run_exit_code == 124)) && [[ -n "$__std_run_policy_timeout_seconds" ]]; then
+                __std_run_message="Command timed out after ${__std_run_policy_timeout_seconds}s on final attempt (${__std_run_policy_max_attempts} attempts): ${__std_run_immutable_command_display}"
             else
-                message="Command failed after ${max_attempts} attempts (exit ${exit_code}): ${printable_command}"
+                __std_run_message="Command failed after ${__std_run_policy_max_attempts} attempts (exit ${__std_run_exit_code}): ${__std_run_immutable_command_display}"
             fi
         else
-            __std_run_status_message__ message "$exit_code" "$timeout_seconds" "$printable_command"
+            __std_run_status_message__ __std_run_message \
+                "$__std_run_exit_code" "$__std_run_policy_timeout_seconds" \
+                "$__std_run_immutable_command_display"
         fi
-        if ((exit_on_failure)); then
-            exit_if_error "$exit_code" "$message"
+        if ((__std_run_policy_exit_on_failure)); then
+            exit_if_error "$__std_run_exit_code" "$__std_run_message"
         else
-            if ((! quiet)); then
-                log_warn -l base_bash_libs.std "$message (continuing)."
+            if ((! __std_run_policy_quiet)); then
+                log_warn -l base_bash_libs.std "$__std_run_message (continuing)."
             fi
-            return $exit_code
+            return "$__std_run_exit_code"
         fi
     fi
 
diff --git a/lib/bash/std/tests/lib_std.bats b/lib/bash/std/tests/lib_std.bats
index 219528c..15be533 100644
--- a/lib/bash/std/tests/lib_std.bats
+++ b/lib/bash/std/tests/lib_std.bats
@@ -1443,6 +1443,48 @@ EOF
     [[ "$output" != *"std_run_with_timeout=function"* ]]
 }
 
+@test "command display helpers validate labels and keep protected argv opaque" {
+    local rendered
+    local unsafe_display
+
+    __std_is_safe_display__ "upload release asset"
+    for unsafe_display in \
+        "" \
+        "-option-like" \
+        $'line\nbreak' \
+        $'carriage\rreturn' \
+        $'tab\tlabel' \
+        $'delete\177label' \
+        $'next-line-\302\205' \
+        $'line-separator-\342\200\250' \
+        $'paragraph-separator-\342\200\251' \
+        $'bidi-override-\342\200\256'; do
+        if __std_is_safe_display__ "$unsafe_display"; then
+            return 1
+        fi
+    done
+
+    __std_render_command_display__ rendered 1 "upload release asset" \
+        '[sensitive command; arguments hidden]' \
+        "CANARY spaced value" "--token=CANARY-inline"
+    [ "$rendered" = "upload release asset [sensitive command; arguments hidden]" ]
+    [[ "$rendered" != *"CANARY"* ]]
+
+    __std_render_command_display__ rendered 1 "" \
+        '[sensitive command; arguments hidden]' "CANARY-default"
+    [ "$rendered" = "[sensitive command; arguments hidden]" ]
+
+    __std_render_command_display__ rendered 0 "" \
+        '[sensitive command; arguments hidden]' printf '%s\n' "value with spaces"
+    [ "$rendered" = 'printf %s\\n value\ with\ spaces' ]
+
+    local LC_ALL=C
+    readonly LC_ALL
+    __std_is_safe_display__ "readonly locale remains supported" \
+        2>"$TEST_TMPDIR/safe-display-readonly-locale.err"
+    [ ! -s "$TEST_TMPDIR/safe-display-readonly-locale.err" ]
+}
+
 @test "std_run returns an error when no command is provided" {
     local stderr_file="$TEST_TMPDIR/run-empty.err"
     local rc
@@ -1468,7 +1510,8 @@ EOF
     fi
 
     [ "$rc" -eq 1 ]
-    [[ "$(cat "$stderr_file")" == *"std_run: unknown option '--typo'."* ]]
+    [[ "$(cat "$stderr_file")" == *"std_run: unknown runner option."* ]]
+    [[ "$(cat "$stderr_file")" != *"--typo"* ]]
     [[ "$(cat "$stderr_file")" == *"Use -- before commands that begin with --."* ]]
 }
 
@@ -1487,6 +1530,88 @@ EOF
     [ "$(cat "$output_file")" = "ran" ]
 }
 
+@test "std_run rejects malformed sensitive controls without executing or exposing arguments" {
+    local marker="$TEST_TMPDIR/sensitive-invalid.marker"
+    local script="$TEST_TMPDIR/sensitive-invalid.sh"
+    local stderr_file="$TEST_TMPDIR/sensitive-invalid.err"
+    local canary="CANARY-malformed-control-secret"
+    local rc
+
+    create_script "$script" <<EOF
+#!/usr/bin/env bash
+printf 'executed\n' > "$marker"
+EOF
+
+    if std_run --safe-display "operation" -- "$script" "$canary" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive --safe-display "" -- "$script" "$canary" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive --safe-display "unicode-$canary"$'\342\200\250' -- "$script" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive --safe-display $'unsafe\nlabel' -- "$script" "$canary" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive "$script" "--token=$canary" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive "--token=$canary" "$script" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive --safe-display "-H$canary" -- "$script" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive --safe-display "--token=$canary" -- "$script" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    if std_run --sensitive --safe-display -- "$script" "$canary" 2>>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    [ "$rc" -eq 1 ]
+
+    [ ! -e "$marker" ]
+    [[ "$(cat "$stderr_file")" != *"$canary"* ]]
+    [[ "$(cat "$stderr_file")" == *"--safe-display is valid only with --sensitive"* ]]
+    [[ "$(cat "$stderr_file")" == *"--sensitive requires -- before the command"* ]]
+    [[ "$(cat "$stderr_file")" == *"unknown runner option"* ]]
+}
+
 @test "std_run honors dry-run mode without executing the command" {
     local target="$TEST_TMPDIR/dry-run.txt"
     DRY_RUN=true
@@ -1497,6 +1622,60 @@ EOF
     [ ! -e "$target" ]
 }
 
+@test "std_run sensitive dry-run hides varied canaries from terminal and persistent diagnostics" {
+    local marker="$TEST_TMPDIR/sensitive-dry-run.marker"
+    local script="$TEST_TMPDIR/sensitive-dry-run.sh"
+    local stderr_file="$TEST_TMPDIR/sensitive-dry-run.err"
+    local primary_log="$TEST_TMPDIR/sensitive-dry-run.log"
+    local diagnostic_file canary
+    local -a canaries=(
+        "CANARY spaced value"
+        "CANARY-inline-value"
+        "CANARY-header-value"
+        "CANARY-url-userinfo"
+        "CANARY-form-field"
+    )
+
+    create_script "$script" <<EOF
+#!/usr/bin/env bash
+printf 'executed\n' > "$marker"
+EOF
+
+    DRY_RUN=1
+    BASE_CLI_PRIMARY_LOG="$primary_log" std_run \
+        --sensitive --safe-display "upload release asset" \
+        --timeout 30 --max-attempts 3 --retry-delay 2 -- \
+        "$script" \
+        "${canaries[0]}" \
+        "--token=${canaries[1]}" \
+        --header "Authorization: Bearer ${canaries[2]}" \
+        "https://user:${canaries[3]}@example.test/path" \
+        --field "password=${canaries[4]}" 2>"$stderr_file"
+    unset DRY_RUN
+
+    [ ! -e "$marker" ]
+    [ -s "$stderr_file" ]
+    [ -s "$primary_log" ]
+    for diagnostic_file in "$stderr_file" "$primary_log"; do
+        grep -Fq "upload release asset [sensitive command; arguments hidden]" "$diagnostic_file"
+        grep -Fq "30s timeout, 3 attempts, 2s retry delay" "$diagnostic_file"
+        for canary in "${canaries[@]}"; do
+            ! grep -Fq -- "$canary" "$diagnostic_file"
+        done
+    done
+}
+
+@test "std_run ordinary dry-run retains copy-pastable argument rendering" {
+    local stderr_file="$TEST_TMPDIR/ordinary-dry-run.err"
+
+    DRY_RUN=1
+    std_run printf '%s\n' "value with spaces" "--option=ordinary value" 2>"$stderr_file"
+    unset DRY_RUN
+
+    [[ "$(cat "$stderr_file")" == *'printf %s\\n value\ with\ spaces --option=ordinary\ value'* ]]
+    [[ "$(cat "$stderr_file")" != *"arguments hidden"* ]]
+}
+
 @test "std_run treats common truthy dry-run values as dry-run mode" {
     local case_name target value var_name
 
@@ -1704,6 +1883,158 @@ EOF
     [ "$(cat "$counter_file")" = "3" ]
 }
 
+@test "std_run sensitive retries and final failure keep terminal and persistent diagnostics secret-safe" {
+    local counter_file="$TEST_TMPDIR/sensitive-retry-count.txt"
+    local script="$TEST_TMPDIR/sensitive-retry.sh"
+    local stderr_file="$TEST_TMPDIR/sensitive-retry.err"
+    local primary_log="$TEST_TMPDIR/sensitive-retry.log"
+    local canary="CANARY-retry-final-secret"
+    local diagnostic_file rc
+
+    create_script "$script" <<'EOF'
+#!/usr/bin/env bash
+count=0
+[[ -f "$1" ]] && read -r count < "$1"
+count=$((count + 1))
+printf '%s\n' "$count" > "$1"
+exit 73
+EOF
+
+    if BASE_CLI_PRIMARY_LOG="$primary_log" std_run \
+        --no-exit --max-attempts 2 \
+        --sensitive --safe-display "publish release metadata" -- \
+        "$script" "$counter_file" "value with $canary" "--token=$canary" 2>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+
+    [ "$rc" -eq 73 ]
+    [ "$(cat "$counter_file")" = "2" ]
+    for diagnostic_file in "$stderr_file" "$primary_log"; do
+        grep -Fq "publish release metadata [sensitive command; arguments hidden]" "$diagnostic_file"
+        grep -Fq "attempt 1 of 2; retrying" "$diagnostic_file"
+        grep -Fq "failed after 2 attempts (exit 73)" "$diagnostic_file"
+        ! grep -Fq -- "$canary" "$diagnostic_file"
+    done
+}
+
+@test "std_run immutable display survives hostile shell-function variable collisions" {
+    local stderr_file="$TEST_TMPDIR/sensitive-function-collision.err"
+    local primary_log="$TEST_TMPDIR/sensitive-function-collision.log"
+    local canary="CANARY-dynamic-scope-display-secret"
+    local collision_invocations=0 diagnostic_file rc
+
+    hostile_display_command() {
+        collision_invocations=$((collision_invocations + 1))
+        printable_command="$canary"
+        command_display="$canary"
+        __std_run_command_display="$canary"
+        timeout_seconds="$canary"
+        timeout_path="$canary"
+        max_attempts=99
+        retry_delay=99
+        quiet=1
+        exit_on_failure=1
+        __std_run_immutable_command_display="$canary"
+        __std_run_policy_exit_on_failure=1
+        __std_run_policy_quiet=1
+        __std_run_policy_timeout_seconds="$canary"
+        __std_run_policy_timeout_path="$canary"
+        __std_run_policy_max_attempts=99
+        __std_run_policy_retry_delay=99
+        __std_run_attempt_number=99
+        __std_run_exit_code="$canary"
+        __std_run_message="$canary"
+        return 124
+    }
+
+    if BASE_CLI_PRIMARY_LOG="$primary_log" std_run \
+        --no-exit --max-attempts 2 \
+        --sensitive --safe-display "run protected shell function" -- \
+        hostile_display_command "--token=$canary" 2>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+    unset -f hostile_display_command
+
+    [ "$rc" -eq 124 ]
+    [ "$collision_invocations" -eq 2 ]
+    for diagnostic_file in "$stderr_file" "$primary_log"; do
+        grep -Fq "Command failed (exit 124)" "$diagnostic_file"
+        grep -Fq "attempt 1 of 2; retrying" "$diagnostic_file"
+        grep -Fq "failed after 2 attempts (exit 124)" "$diagnostic_file"
+        grep -Fq "run protected shell function [sensitive command; arguments hidden]" "$diagnostic_file"
+        ! grep -Fq -- "$canary" "$diagnostic_file"
+    done
+}
+
+@test "std_run protected default fatal path preserves status and hides argv" {
+    local command_script="$TEST_TMPDIR/sensitive-fatal-command.sh"
+    local runner_script="$TEST_TMPDIR/sensitive-fatal-runner.sh"
+    local primary_log="$TEST_TMPDIR/sensitive-fatal.log"
+    local canary="CANARY-default-fatal-secret"
+
+    create_script "$command_script" <<'EOF'
+#!/usr/bin/env bash
+exit 255
+EOF
+    create_script "$runner_script" <<'EOF'
+#!/usr/bin/env bash
+source "$1"
+primary_log="$2"
+command_script="$3"
+canary="$4"
+BASE_CLI_PRIMARY_LOG="$primary_log"
+export BASE_CLI_PRIMARY_LOG
+std_run --sensitive --safe-display "publish protected release" -- \
+    "$command_script" "value with $canary" "--token=$canary"
+printf 'after\n'
+EOF
+
+    bats_run bash "$runner_script" "$STDLIB_PATH" "$primary_log" "$command_script" "$canary"
+
+    [ "$status" -eq 255 ]
+    [[ "$output" == *"Command failed (exit 255)"* ]]
+    [[ "$output" == *"publish protected release [sensitive command; arguments hidden]"* ]]
+    [[ "$output" == *"Encountered a fatal error"* ]]
+    [[ "$output" != *"$canary"* ]]
+    [[ "$output" != *"after"* ]]
+    grep -Fq "Command failed (exit 255)" "$primary_log"
+    grep -Fq "publish protected release [sensitive command; arguments hidden]" "$primary_log"
+    ! grep -Fq -- "$canary" "$primary_log"
+}
+
+@test "std_run sensitive timeout retains status and timing without exposing arguments" {
+    local script="$TEST_TMPDIR/sensitive-timeout.sh"
+    local stderr_file="$TEST_TMPDIR/sensitive-timeout.err"
+    local primary_log="$TEST_TMPDIR/sensitive-timeout.log"
+    local canary="CANARY-timeout-secret"
+    local diagnostic_file rc
+
+    create_script "$script" <<'EOF'
+#!/usr/bin/env bash
+sleep 3
+EOF
+
+    if BASE_CLI_PRIMARY_LOG="$primary_log" std_run \
+        --no-exit --timeout 1 \
+        --sensitive --safe-display "wait for protected service" -- \
+        "$script" "value with $canary" "https://user:$canary@example.test" 2>"$stderr_file"; then
+        rc=0
+    else
+        rc=$?
+    fi
+
+    [ "$rc" -eq 124 ]
+    for diagnostic_file in "$stderr_file" "$primary_log"; do
+        grep -Fq "Command timed out after 1s" "$diagnostic_file"
+        grep -Fq "wait for protected service [sensitive command; arguments hidden]" "$diagnostic_file"
+        ! grep -Fq -- "$canary" "$diagnostic_file"
+    done
+}
+
 @test "std_run combines per-attempt timeout with retry" {
     local counter_file="$TEST_TMPDIR/timeout-retry-count.txt"
     local output_file="$TEST_TMPDIR/timeout-retry-output.txt"
diff --git a/tests/bash-option-contract.sh b/tests/bash-option-contract.sh
index e1d6584..533e00c 100755
--- a/tests/bash-option-contract.sh
+++ b/tests/bash-option-contract.sh
@@ -214,6 +214,7 @@ contract_std_api_smoke() {
     local contract_log_file="$contract_tmp/log-input"
     local contract_created_dir="$contract_tmp/created/child"
     local contract_created_file="$contract_tmp/created/file"
+    local contract_output="" contract_status=0
 
     check_bash_version
     base_bash_libs_require_version 0.0.0
@@ -253,7 +254,48 @@ contract_std_api_smoke() {
     DRY_RUN=1
     contract_quiet_success "std_run dry run" \
         std_run --no-exit --quiet command-that-must-not-run
+    contract_output="$(
+        std_run --no-exit --sensitive --safe-display "option contract upload" -- \
+            command-that-must-not-run \
+            "CONTRACT_CANARY spaced value" \
+            "--token=CONTRACT_CANARY_EQUALS" \
+            "Authorization: Bearer CONTRACT_CANARY_HEADER" 2>&1
+    )"
+    [[ "$contract_output" == *"option contract upload"* ]] ||
+        contract_fail "sensitive std_run omitted its safe display label"
+    [[ "$contract_output" != *"CONTRACT_CANARY"* ]] ||
+        contract_fail "sensitive std_run exposed a protected argument"
     unset DRY_RUN
+
+    # shellcheck disable=SC2034 # Deliberate dynamic-scope collision canaries.
+    contract_sensitive_std_failure() {
+        printable_command="CONTRACT_CANARY_DYNAMIC_DISPLAY"
+        timeout_seconds="CONTRACT_CANARY_DYNAMIC_TIMEOUT"
+        attempt="CONTRACT_CANARY_DYNAMIC_ATTEMPT"
+        __std_run_immutable_command_display="CONTRACT_CANARY_INTERNAL_DISPLAY"
+        __std_run_attempt_number="CONTRACT_CANARY_INTERNAL_ATTEMPT"
+        return 73
+    }
+    if contract_output="$(
+        std_run --no-exit --max-attempts 2 \
+            --sensitive --safe-display "option contract protected failure" -- \
+            contract_sensitive_std_failure \
+            "CONTRACT_CANARY spaced value" \
+            "--token=CONTRACT_CANARY_EQUALS" 2>&1
+    )"; then
+        contract_status=0
+    else
+        contract_status=$?
+    fi
+    unset -f contract_sensitive_std_failure
+    contract_assert_equal "sensitive std_run failure status" 73 "$contract_status"
+    [[ "$contract_output" == *"option contract protected failure"* ]] ||
+        contract_fail "sensitive std_run failure omitted its safe display label"
+    [[ "$contract_output" == *"failed after 2 attempts (exit 73)"* ]] ||
+        contract_fail "sensitive std_run failure omitted final attempt context"
+    [[ "$contract_output" != *"CONTRACT_CANARY"* ]] ||
+        contract_fail "sensitive std_run failure exposed a protected value"
+
     contract_expect_status "is_dry_run false predicate" 1 is_dry_run
     # shellcheck disable=SC2034 # is_dry_run reads the compatibility global by name.
     dry_run=yes
@@ -485,7 +527,7 @@ contract_gh_stub() {
 }
 
 contract_git_gh_api_smoke() {
-    local contract_result="" contract_output=""
+    local contract_result="" contract_output="" contract_status=0
 
     git() { contract_git_stub "$@"; }
     gh() { contract_gh_stub "$@"; }
@@ -533,6 +575,21 @@ contract_git_gh_api_smoke() {
         gh_report_command_failure 7 api contract
     CONTRACT_GH_STATUS=255
     contract_expect_status "gh_run failure status" 255 contract_quiet_call gh_run api contract
+    if contract_output="$(
+        gh_run --sensitive --safe-display "option contract GitHub call" -- \
+            api repos/basefoundry/base-bash-libs \
+            -H "Authorization: Bearer CONTRACT_CANARY_HEADER" \
+            -f "secret=CONTRACT_CANARY_FIELD" 2>&1
+    )"; then
+        contract_status=0
+    else
+        contract_status=$?
+    fi
+    contract_assert_equal "sensitive gh_run failure status" 255 "$contract_status"
+    [[ "$contract_output" == *"option contract GitHub call"* ]] ||
+        contract_fail "sensitive gh_run omitted its safe display label"
+    [[ "$contract_output" != *"CONTRACT_CANARY"* ]] ||
+        contract_fail "sensitive gh_run exposed a protected argument"
     unset CONTRACT_GH_STATUS
 
     contract_expect_status "gh_require_cli usage" 1 contract_quiet_call gh_require_cli one two