fix(cli): flow-debug help text names the script entry; replay role note; run-script guard tests

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29
2026-09-08 01:17:32 -04:00
parent 067a858ce9
commit 45c6b27d99
3 changed files with 31 additions and 8 deletions
@@ -2278,8 +2278,10 @@ A Live run executes the real thing — the method script on the active central n
 site script (called directly, or fired by writing its trigger attribute), or a real attribute
 write at the site — with tracing switched on for the whole chain, so every routed site script
 run, attribute write and attribute wait it causes is recorded as a `ScriptTrace` audit row and
-returned inline. Replay reads those rows back for any past execution. All four sub-commands
-require the **Deployer** role.
+returned inline. Replay reads those rows back for any past execution. The three run commands
+(`run-method`, `run-script`, `run-value-change`) require the **Deployer** role; `replay`
+accepts the wider `AuthorizationPolicies.FlowDebuggerAccessRoles` set (Deployer,
+Administrator, Viewer — arch-review F3), since it only reads the audit chain.

 The three run commands are answered by the node the CLI is pointed at. Through the Traefik
 load balancer that is the active node; pointed at a standby node directly they refuse with