docs: Flow Debugger design reconciled with the implementation (arch-review F12, F13)

The Flow Debugger design doc still described the pre-remediation shape: a
debug-stream subscription for the value-change entry, Deployer everywhere, an
unredacted inline trace copy and "~7 audit rows per call". Reconciled with what
shipped on this branch (Tasks 1-12):

- design D6 / §5.4 / §9 / §10: RequireFlowDebugger page policy with Deployer-only
  execution (F3), the PullTraceEvents polling path with AttributeValueUpdate
  fields 7/8 recorded as RESERVED and unconsumed (F12), the redacting + byte-
  capped shared FlowTraceCollector (F1), route-time site scope (F2), the derived
  client waits (F4), the 7-10 row estimate, the doubled central audit write per
  routed call, and the inbound-row-after-the-run ordering.
- sitestream.proto: fields 7/8 marked reserved-but-populated, numbers not to be
  reused (comment only; no regeneration needed).
- Component-InboundAPI: SkipBodyCapture on the RouteCall row (F11),
  SchemaRefResolver's public visibility, WithSiteScope / SITE_SCOPE_DENIED (F2),
  Replay's wider role set (F3).
- Component-CentralUI: page policy vs Deployer-only controls (F3), route-time
  site scope (F2), client wait derivation (F4).
- "7-10 audit rows per call (3 of them trace-only)" everywhere the estimate is
  quoted: the method form, both CLI --trace-all-calls help strings, the CLI
  README, the ApiMethod entity doc, the manual migration script and the two
  Flow Debugger plans.
- arch-review doc: new §7 Resolution listing F1-F13 with the fixing commit, plus
  the tracking-store test race fixed alongside them (86451382).

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/ApiMethodCommands.cs

@@ -62,7 +62,7 @@ public static class ApiMethodCommands
         var returnDefOption = new Option<string?>("--return-def") { Description = "Return type definition" };
         var traceAllCallsOption = new Option<bool>("--trace-all-calls")
         {
-            Description = "Trace every production call to this method for the Flow Debugger (adds ~7 audit rows per call; low-volume integration methods only)"
+            Description = "Trace every production call to this method for the Flow Debugger (adds 7-10 audit rows per call; low-volume integration methods only)"
         };
 
         var cmd = new Command("create") { Description = "Create an API method" };
@@ -98,7 +98,7 @@ public static class ApiMethodCommands
         // bool? so an update that omits the flag leaves the stored value unchanged.
         var traceAllCallsOption = new Option<bool?>("--trace-all-calls")
         {
-            Description = "Trace every production call to this method for the Flow Debugger (true/false; omitted = unchanged; adds ~7 audit rows per call)"
+            Description = "Trace every production call to this method for the Flow Debugger (true/false; omitted = unchanged; adds 7-10 audit rows per call)"
         };
 
         var cmd = new Command("update") { Description = "Update an API method" };

src/ZB.MOM.WW.ScadaBridge.CLI/README.md

@@ -2119,7 +2119,7 @@ scadabridge --url <url> api-method create --name <string> --script <string> [--t
 | `--timeout` | no | `30` | Timeout in seconds |
 | `--parameters` | no | — | Parameter definitions JSON |
 | `--return-def` | no | — | Return type definition JSON |
-| `--trace-all-calls` | no | off | Trace every production call for the Flow Debugger. **Adds ~7 audit rows per call** — low-volume integration methods only |
+| `--trace-all-calls` | no | off | Trace every production call for the Flow Debugger. **Adds 7–10 audit rows per call** (3 of them trace-only) — low-volume integration methods only |
 
 #### `api-method update`
 
@@ -2137,7 +2137,7 @@ scadabridge --url <url> api-method update --id <int> --script <string> [--timeou
 | `--timeout` | no | `30` | Timeout in seconds |
 | `--parameters` | no | — | Parameter definitions JSON |
 | `--return-def` | no | — | Return type definition JSON |
-| `--trace-all-calls` | no | unchanged | `true`/`false` — trace every production call for the Flow Debugger. **Adds ~7 audit rows per call.** Omitted = the stored value is left as-is (the one field the replace-all rule does not apply to) |
+| `--trace-all-calls` | no | unchanged | `true`/`false` — trace every production call for the Flow Debugger. **Adds 7–10 audit rows per call** (3 of them trace-only). Omitted = the stored value is left as-is (the one field the replace-all rule does not apply to) |
 
 Script changes take effect immediately — the updated code is recompiled in-memory on the active central node. No restart is required.
 

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/ApiMethodForm.razor

@@ -47,7 +47,7 @@
                         </label>
                         <div class="form-text">
                             Every call to this method records its routed site steps as audit rows the
-                            Flow Debugger can replay. Adds ~7 audit rows per call; for low-volume
+                            Flow Debugger can replay. Adds 7–10 audit rows per call; for low-volume
                             integration methods.
                         </div>
                     </div>

src/ZB.MOM.WW.ScadaBridge.Commons/Entities/InboundApi/ApiMethod.cs

@@ -17,7 +17,7 @@ public class ApiMethod
 
     /// <summary>
     /// When true every production call to this method is fully traced (Flow Debugger design
-    /// 2026-09-05 §5.2); intended for low-volume integration methods — ~7 audit rows per call.
+    /// 2026-09-05 §5.2); intended for low-volume integration methods — 7-10 audit rows per call.
     /// </summary>
     public bool TraceAllCalls { get; set; }
 

src/ZB.MOM.WW.ScadaBridge.Communication/Protos/sitestream.proto

@@ -100,8 +100,10 @@ message AttributeValueUpdate {
   Quality quality = 5;
   google.protobuf.Timestamp timestamp = 6;
   // Flow Debugger (design 2026-09-05 §5.3/§5.4): the writing execution's id ("D" GUID
-  // form; empty represents null) and the trace flag, so the debug stream can hand the
-  // debugger the spawned run's parent. Additive; an older site never sets them.
+  // form; empty represents null) and the trace flag. Additive; an older site never sets them.
+  // RESERVED — populated by the site, consumed by nothing (arch-review F12): the value-change
+  // entry polls the site's PullTraceEvents RPC instead of subscribing to the debug stream, so
+  // these two fields are kept for a future debug-stream path. Do not reuse the field numbers.
   string source_execution_id = 7;
   bool trace = 8;
 }