ExitCode is the PROGRAM's own status — 0 succeeded, anything else is what it returned, and a Command runs under sh -c so its shell's conventions apply. A command that never reached an exit does not arrive here at all: a timeout or a stop cancels the channel, and that is an error on the call rather than a code of ours invented to fill this field.
Stderr is standard error, kept apart from Stdout so a caller reading a program's OUTPUT is not reading its diagnostics as data. Same 1 MiB cap, same redaction. A program that failed usually says why here and nowhere else.
Stdout is what the program wrote to standard output, collected whole rather than streamed — to watch it arrive instead, name a RunIn.Session and read that session's feed. Capped at 1 MiB, past which it ends in "truncated at 1MiB". Every string named in RunIn.Blind is replaced by "redacted" before it gets here, and before it reaches the session.
