fix(site-runtime): Flow Debugger inline trace copy is redacted and byte-capped at the collector (arch-review F1, site half)

Every emit site hands FlowTraceCollector the same AuditEvent it hands the
writer, but redaction and payload capping lived inside the writers, which
return a NEW filtered record — so the inline copy that rides
ScriptCallResult.TraceEvents / RouteToCallResponse.TraceEvents was the RAW
event: no per-target SQL-parameter redaction, no header scrubbing, no 8 KB /
64 KB truncation. Live and Replay of the same execution could therefore show
different payloads, and the 500-event-only cap left the reply free to breach
the 4 MB gRPC receive limit — which would fail a real call, since the same
reply carries the script's return value.

The collector now applies the host IAuditRedactor itself (outside the lock;
the writers keep their own idempotent Apply) and enforces a byte budget
(DefaultMaxBytes = 1 MB over the redacted DetailsJson) alongside the event
cap, flagging Truncated when either trips. It moves to Commons
(Types/Debugging) so the central FlowDebugRunner can share it.

The redactor is a singleton, so ScriptRunLauncher resolves it from the ROOT
provider and keeps constructing the collector before the try — the traced
ScriptRun row is emitted from the catch blocks too, including the
shed-at-dequeue path that throws before the DI scope exists.

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Debugging/FlowTraceCollector.cs

@@ -1,6 +1,6 @@
 using ZB.MOM.WW.Audit;
 
-namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Scripts;
+namespace ZB.MOM.WW.ScadaBridge.Commons.Types.Debugging;
 
 /// <summary>
 /// Per-run sink for <c>ScriptTrace</c> audit events so a traced routed call can return them
@@ -14,17 +14,37 @@ namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Scripts;
 /// when the launcher takes the reply snapshot — a lifecycle row the S&amp;F forwarder writes
 /// minutes later, or an un-awaited call finishing after the run returned, must not mutate a
 /// list the reply has already been built from. <see cref="Add"/> is a no-op once completed.
+/// Arch-review F1 (2026-09-06): the inline copy is <b>REDACTED</b> — the collector applies the
+/// host's <see cref="IAuditRedactor"/> itself rather than storing the raw event the emitter also
+/// hands the writer, so Live shows exactly what Replay reads back (per-target SQL-parameter
+/// overrides, header scrubbing and the 8 KB / 64 KB payload caps all apply). The writers keep
+/// their own <c>Apply</c> call — redaction is idempotent, so the stored row is unaffected.
+/// The copy is also capped by BYTES as well as by count, because it rides a gRPC reply whose
+/// default 4 MB receive limit a few hundred large error rows would otherwise breach — and that
+/// same reply carries the script's return value, so an oversized trace would fail a real call.
 /// </summary>
 public sealed class FlowTraceCollector
 {
     /// <summary>Default inline cap per run (design §5.4 <c>MaxTraceEventsPerRun</c>).</summary>
     public const int DefaultMaxEvents = 500;
 
+    /// <summary>
+    /// Default inline byte budget per run — the summed redacted <see cref="AuditEvent.DetailsJson"/>
+    /// length, well under the 4 MB gRPC default receive limit the reply must fit in.
+    /// </summary>
+    public const int DefaultMaxBytes = 1_048_576;
+
     private readonly List<AuditEvent> _events = new();
     private readonly object _gate = new();
     private readonly int _max;
+    private readonly int _maxBytes;
+    private readonly IAuditRedactor? _redactor;
+    private int _bytes;
 
-    /// <summary>True once an <see cref="Add"/> was dropped because the cap was reached.</summary>
+    /// <summary>
+    /// True once an <see cref="Add"/> was dropped because the event cap or the byte budget
+    /// was reached.
+    /// </summary>
     public bool Truncated { get; private set; }
 
     /// <summary>
@@ -33,25 +53,41 @@ public sealed class FlowTraceCollector
     /// </summary>
     public bool Completed { get; private set; }
 
-    /// <summary>Creates a collector with the given inline cap (must be positive).</summary>
-    public FlowTraceCollector(int maxEvents = DefaultMaxEvents)
+    /// <summary>
+    /// Creates a collector with the given inline caps (both must be positive) and the redactor
+    /// the inline copy is filtered through. A null <paramref name="redactor"/> — a host that
+    /// never called <c>AddAuditLog</c>, or a test — collects raw but is still capped.
+    /// </summary>
+    public FlowTraceCollector(
+        int maxEvents = DefaultMaxEvents,
+        int maxBytes = DefaultMaxBytes,
+        IAuditRedactor? redactor = null)
     {
         if (maxEvents <= 0) throw new ArgumentOutOfRangeException(nameof(maxEvents), "must be positive");
+        if (maxBytes <= 0) throw new ArgumentOutOfRangeException(nameof(maxBytes), "must be positive");
         _max = maxEvents;
+        _maxBytes = maxBytes;
+        _redactor = redactor;
     }
 
     /// <summary>
-    /// Appends an event, or marks the collector truncated once the cap is reached. A no-op
-    /// after <see cref="Complete"/>.
+    /// Appends the REDACTED copy of an event, or marks the collector truncated once the event
+    /// cap or the byte budget is reached. A no-op after <see cref="Complete"/>.
     /// </summary>
     public void Add(AuditEvent evt)
     {
         ArgumentNullException.ThrowIfNull(evt);
+        // Redaction runs OUTSIDE the lock (arch-review F1): IAuditRedactor is a pure function
+        // but not necessarily a cheap one (regex scrubbing + payload truncation), and the
+        // collector is shared by every emit site of a run.
+        var filtered = _redactor is null ? evt : _redactor.Apply(evt);
+        var size = filtered.DetailsJson?.Length ?? 0;
         lock (_gate)
         {
             if (Completed) return;
-            if (_events.Count >= _max) { Truncated = true; return; }
-            _events.Add(evt);
+            if (_events.Count >= _max || _bytes + size > _maxBytes) { Truncated = true; return; }
+            _events.Add(filtered);
+            _bytes += size;
         }
     }
 

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Scripts/ScriptRunLauncher.cs

@@ -247,7 +247,15 @@ internal static class ScriptRunLauncher
         // caller to reply to — a trace-armed trigger run (replyTo == Nobody) writes every row to the
         // audit writer for PullTraceEvents and would only keep a never-read list alive. The
         // ScriptRun row itself is emitted below on every exit path of a traced run.
-        var collector = trace && !replyTo.IsNobody() ? new FlowTraceCollector() : null;
+        // Arch-review F1: the inline copy is redacted at the collector, so the collector carries
+        // the host's IAuditRedactor. That is a SINGLETON (AddAuditLog), resolved here from the
+        // ROOT provider for the same reason siteEventLogger below is — the traced ScriptRun row
+        // is emitted from the catch blocks too, including the shed-at-dequeue path that throws
+        // before the DI scope exists. Null in tests / hosts without AddAuditLog: raw, still capped.
+        var collector = trace && !replyTo.IsNobody()
+            ? new FlowTraceCollector(
+                redactor: serviceProvider?.GetService<ZB.MOM.WW.Audit.IAuditRedactor>())
+            : null;
         var startedUtc = DateTime.UtcNow;
         ScriptRuntimeContext? context = null;
         IAuditWriter? auditWriter = null;