docs+rig(flow-debugger): step logs v1.4 specs, register rows, FlowLogDemo seed + verification step J

docs/requirements/Component-InboundAPI.md

@@ -152,7 +152,7 @@ The `sbk_<keyId>_<secret>` design already supports zero-downtime rotation — a
 | `TIMEOUT` | 500 | The method script exceeded its execution timeout. |
 | `SITE_UNREACHABLE` | 500 | The target site did not respond to the routed request within the routing timeout (no contact / down / partitioned) — typed from the routed Ask expiring (`AskTimeoutException`), never inferred from an error-message substring. A `Success=false` response means the site answered and is classified `SCRIPT_ERROR`. |
 | `SCRIPT_COMPILE_FAILED` | 500 | The method's script failed to compile (returned consistently on every node until a compiling version is saved). |
-| `SCRIPT_ERROR` | 500 | Catch-all for any other script-execution failure (details are logged centrally, never leaked to the caller). |
+| `SCRIPT_ERROR` | 500 | Catch-all for any other script-execution failure (details are logged centrally, never leaked to the caller — the exception's `ToString()` is captured on the audit row as `ErrorDetail`, never in the response body). |
 
 ### Extended Type System
 - API method parameter and return type definitions support an **extended type system** beyond the four template attribute types (Boolean, Integer, Float, String):
@@ -295,6 +295,33 @@ Containment rules (enforced, not advisory):
 For everything else, scripts interact with the system through the curated `Route` and
 `Parameters` surfaces above.
 
+#### Logging (`Log`)
+
+Method scripts get the same leveled `Log` global site scripts do (design
+`docs/plans/2026-09-09-flow-debugger-step-logs-design.md` D4/D5) — `InboundScriptContext.Log`,
+backed by `InboundScriptLogger`:
+
+- `Log.Debug(message, exception?)` / `Log.Info` / `Log.Warn` / `Log.Error` — synchronous, `void`,
+  never throws into the script.
+- **Always** forwards to the central node's `ILogger`. A `ScriptTrace` / `ScriptLog` audit row is
+  written **only when the request is traced** (a Flow Debugger Live run, or a real call to a method
+  with `TraceAllCalls`), through the executor's inline trace sink and `ICentralAuditWriter`; an
+  ordinary call pays a log entry and nothing more.
+- Lines with no explicit step id are attributed to the request's anchor row (the `InboundRequest`
+  row, or the debugger's synthesized `RouteCall` root), so they render on the inbound node.
+- **Bounded:** `ScadaBridge:InboundApi:MaxLogLinesPerRun` (default 200, validated `> 0`) caps the
+  rows one request may emit, messages are clipped at 2 000 characters, and one closing `warn` row
+  names the dropped count.
+
+#### Script exception detail
+
+`InboundScriptResult` carries an internal `ErrorDetail` (`ex.ToString()` of the fault the method
+script threw). It is written to the request's audit row — by `FlowDebugRunner` for a Live run, and
+on the ordinary HTTP path via `HttpContext.Items[AuditWriteMiddleware.ErrorDetailItemKey]` so a
+`TraceAllCalls` Replay has it too — and is projected onto `FlowStep.ErrorDetail` for the Flow
+Debugger's exception block. **It is never returned to the HTTP caller:** the response body stays the
+generic `SCRIPT_ERROR` envelope, unchanged.
+
 ### Routing Behavior
 - The `Route.To()` helper resolves the instance's site assignment from the configuration database and routes the request to the correct site cluster via the Communication Layer.
 - The call is **synchronous from the API caller's perspective** — the API method blocks until the site responds or the **method-level timeout** is reached.