Resolve all 46 low-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Deployment/FlowDebugger.razor.cs

@@ -704,12 +704,12 @@ public partial class FlowDebugger : ComponentBase, IDisposable
     private static int CountLogRows(IReadOnlyList<AuditEvent>? events)
         => events?.Count(FlowStepProjector.IsLogLine) ?? 0;
 
-    /// <summary>Union of two audit-row lists by <see cref="AuditEvent.EventId"/>; a row present in both takes the fresh copy.</summary>
+    /// <summary>Preserves fresh Replay order, then appends live-only rows; duplicate event IDs use the fresh copy.</summary>
     internal static IReadOnlyList<AuditEvent> MergeEvents(IReadOnlyList<AuditEvent>? known, IReadOnlyList<AuditEvent>? fresh)
     {
         var byId = new Dictionary<Guid, AuditEvent>();
-        foreach (var e in known ?? []) byId[e.EventId] = e;
         foreach (var e in fresh ?? []) byId[e.EventId] = e;
+        foreach (var e in known ?? []) byId.TryAdd(e.EventId, e);
         return byId.Values.ToList();
     }
 
@@ -811,11 +811,11 @@ public partial class FlowDebugger : ComponentBase, IDisposable
     /// <summary>
     /// Server-side re-check before relaying — the action must not fire for a site outside the caller's
     /// permitted set even though the node is on screen. Notifications are central-owned (no site).
-    /// A site the page cannot resolve is allowed through, as on the Site Calls page.
+    /// An unresolvable site is denied for a scoped caller.
     /// </summary>
     private async Task<bool> IsStepSiteAllowedAsync(FlowStep step)
     {
-        if (step.Kind == FlowStepKind.Notify || string.IsNullOrEmpty(step.SiteId))
+        if (step.Kind == FlowStepKind.Notify)
             return true;
         if (await SiteScope.IsSystemWideAsync())
             return true;
@@ -832,7 +832,7 @@ public partial class FlowDebugger : ComponentBase, IDisposable
             }
         }
         if (site is null)
-            return true;
+            return false;
         return (await SiteScope.PermittedSiteIdsAsync()).Contains(site.Id);
     }