The direct answer
Choose the diagnostic representation before retaining an AI-worker failure: a live exception and a captured traceback summary have different reference and content boundaries. Disabling local-variable capture does not sanitize messages, source information, notes or chains. Clearing live traceback frames is a separate lifecycle action and does not establish recall of an already captured or formatted report.
Choose what waits for the operator
A trusted preprocessing worker rejects an ordinary input. The operator needs enough diagnostic context to locate a fixed-code failure later, but keeping the original exception object is not the same choice as keeping a prepared summary. The review must identify which representation enters the protected diagnostic store.
The structured-audit guide deliberately rejects raw exception metadata on its dedicated event path. Keep that rule. This worksheet defines a different, protected internal diagnostic lane; it grants no permission to put a traceback in routine logs, send it to support or include it in a model request.
Freeze the documented capture boundary
The selected Python traceback reference identifies version 3.15.2. It describes TracebackException as retaining information for later rendering without traceback and frame references. from_exception() supports capture_locals=False; captured locals are object representations and appear in tracebacks. clear_frames() clears frame-local variables in a supplied traceback.
The same body exposes cause/context summaries and notes. format(chain=False) omits cause/context from formatting; that is not a statement that they were never captured. Exception-only formatting can still include the message and notes. These documented distinctions support separate capture, display and cleanup decisions.
Our proposed profile selects one ordinary built-in ValueError from fixed trusted worker code, a fixed application-owned message and no notes, chain, group or custom exception subclass. The supported capture adapter uses TracebackException.from_exception with local capture disabled. Actual release, effective options and complete bounds must be established before this plan can admit a diagnostic. None was inspected here.
Give the live reference and summary different owners
Invent worker W-A, failure category INPUT_REJECTED, diagnostic D-A and operator role O-A. The only illustrative message is “Input rejected.” It contains no input text, path, identifier, credential or customer information. A fixed trusted call-site label gives the operator a useful starting point without pretending that every exception message is equally harmless.
The positive is conditional: a supported adapter captures the permitted summary, the application inventories its actual fields and bounds, and D-A enters only an admitted protected store with an owner and retention policy. Separately identify who still holds the original exception or traceback. Creating D-A cannot attest that those other references were released.
| Representation | Proposed owner | Admission question |
|---|---|---|
| Original exception/traceback | W-A lifecycle owner | Is retaining the live object actually necessary, and who releases it? |
| D-A no-locals summary | Protected diagnostic owner | Are all remaining fields, source metadata and bounds permitted? |
| Older D-B with captured locals | Separate report owner | Which representations already exist, with what access and retention? |
| Formatted text F-A | Output-store owner | Was this copy authorized and inventoried independently? |
| Frame-cleanup disposition | W-A lifecycle owner | What documented operation covered which original traceback? |
This separation changes a concrete design choice: do not queue the original exception merely because a later display will hide locals. If the protected summary is sufficient, review that representation at capture time and track original-object ownership independently.
Do not confuse omission, deferred lookup and cleanup
The FrameSummary documentation includes source filenames and lines; deferred line lookup postpones source access rather than excluding that information. A no-locals setting therefore supplies no general sensitive-content filter.
In this application plan, unknown message, note, chain or source content blocks diagnostic admission. Do not fall back to arbitrary stringification or assume a trusted worker always raises harmless messages. The fixed-message positive needs an actual reviewed code path; an intended wrapper is not evidence that every failure follows it.
Likewise, a later setting change cannot establish that D-B or F-A was never created. Their disposition needs their own store and owner evidence. A supported frame-cleanup action should be recorded for its stated scope, without expanding it into garbage-collection timing, secure wiping, universal memory release or deletion of report copies.
No cleanup-call sequence is supplied. The actual original traceback association, supported lifecycle point and cleanup outcome remain prerequisites. Unknown or failed cleanup cannot be promoted to success because another diagnostic operation returned normally.
Walk eight inert diagnostic cards
Each independent card is PROPOSED_UNRUN. There are no constructed exceptions, frames, summaries or formatted reports behind these labels.
| Card | Condition | Proposed decision |
|---|---|---|
| 1. Useful ordinary summary | Fixed W-A error, no-locals capture, approved fields, supported bounds and all prerequisites. | Conditionally retain D-A for protected internal review only. |
| 2. Live object queued | The retained value is the original exception/traceback. | Review that live-reference lifetime; do not claim the selected summary boundary. |
| 3. Earlier locals snapshot | D-B already contains local representations. | Inventory and restrict D-B separately; later options do not prove recall. |
| 4. Frame cleanup offered | A cleanup disposition is presented as erasure of every report. | Reject the expanded claim; reconcile original traceback and each copy separately. |
| 5. Unreviewed message or source | Local capture is off, but other diagnostic content is unknown. | Hold D-A rather than label it sanitized. |
| 6. Chain hidden at display | Rendering omits a chain. | No inference that capture or retention omitted it. |
| 7. Unsupported lifecycle | Actual capture bounds, traceback association or cleanup coverage is uncertain. | Preserve the unknown; no supported positive. |
| 8. New destination | D-A is proposed for a model, external support or routine audit route. | Outside this internal lane; use separately authorized synthetic minimization. |
Keep the useful result and evidence narrow
The desired result is an operator locating one known preprocessing failure without retaining live traceback objects unnecessarily or collecting local representations by default. It is not a promise that diagnostics cannot disclose data. Actual exception provenance, permitted source metadata, total capture/output bounds, storage access, retention and original-reference lifetime are unimplemented requirements; absent evidence holds the plan.
For an external issue, the synthetic support-reproducer workflow remains a separate decision. Do not resend a real traceback to demonstrate that it contains too much information. A summary’s content hash would identify bytes, not authorize a recipient or certify safe handling.
For these proposed cases, no exception was raised, captured, formatted or cleared; no traceback import, local repr(), queue, worker, model or API experiment occurred. Ordinary editorial artifact handling is separate. Boundary remains prelaunch with planned request-path checks, not a shipped diagnostic-capture, cleanup or report-recall controller.
Primary sources
Official references supporting the guidance. Examples in this guide are synthetic and are not reports of a production incident.