fix(flow-debugger): review follow-ups — redact runner-synthesized rows, spawner rule, budget doc, CLI ceiling note (arch-review remediation)

Code review of the merged arch-review remediation (Tasks 1-13) found four items.

1. FlowDebugRunner returned its OWN synthesized rows un-redacted. RunMethodAsync's
   inbound row and RunValueChangeAsync's root row were handed to WriteCentralAsync
   (whose writer redacts a private copy) and then put RAW into the returned Events —
   so a Live run's caller saw the unfiltered row while Replay of the same execution
   showed the redacted one, defeating F1's "Live shows what Replay reads back". Both
   methods now resolve IAuditRedactor once per run and place the filtered copy into
   the result (including the early-return path on a failed attribute write); the raw
   row still reaches the writer, which redacts itself.

2. FlowGraphBuilder's spawner search degenerated to "the last step of the parent".
   Since executions are ordered as contiguous blocks, position[p] < childPosition
   holds for EVERY parent step, so a run shaped ScriptRun -> Write(A) -> Wait ->
   Write(B) whose Write(A) fired the cascade drew the Spawn edge from Write(B). New
   rule, in order: (a) the last non-async, non-Response parent step occurring at or
   before the child's first step — parent and child of a trigger cascade share the
   site clock, so this picks the write that actually fired it; (b) the position rule
   as fallback, which is the mixed-clock case F5 was written for (a child clock
   behind its parent's, where no parent step satisfies (a)); (c) parentChain[0].
   The class remark's stale "Replay order is unchanged" claim is replaced with what
   actually happens to a central Database.* call made after Route.To().Call.

3. FlowTraceCollector's byte budget counts UTF-16 chars of DetailsJson only, so
   "well under the 4 MB gRPC default" overstated it. Documented honestly: ~1 MB of
   UTF-8 for ASCII payloads, ~3 MB worst case for non-ASCII, both under 4 MB before
   framing — and raise it only against a real serialized-size measurement.

4. CLI --timeout-seconds help + README row now say the management endpoint caps
   flow-debug run-method at ManagementService:LongRunningCommandTimeout (default
   5 min), so a larger client value still 504s at the server's ceiling.

Deferred-work register rows 112 (site-side inline trace truncation is invisible to
the operator — needs a proto field) and 113 (the F2 method-entry site scope gates
routed traffic only; ApiMethods have no site affinity to scope against) record what
this review deliberately did not fix.

Tests: FlowGraphBuilderTests gains the same-clock Write(A)/Wait/Write(B) cascade
(red before the rule change, and the clock-behind test still passes on rule (b));
FlowDebugRunnerTests extends the redactor test to the inbound row and adds two
value-change cases (settled poll, failed write). Commons 793, ManagementService 615,
CentralUI 1264, CLI 462 — all green.

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/FlowDebugRunnerTests.cs

@@ -394,6 +394,46 @@ public class FlowDebugRunnerTests
         Assert.Equal(2, result.Events.Count); // inbound row + the one sink event
         Assert.Equal("{\"SECRET\":\"ABC\"}", result.Events[1].DetailsJson);
         Assert.False(result.Truncated);
+        // Review follow-up: the row the RUNNER synthesizes is redacted too — the central writer
+        // only redacts its own private copy, so the caller's copy would otherwise be the raw one.
+        var written = Assert.Single(_central, e => e.AsRow().Kind == AuditKind.InboundRequest);
+        Assert.Equal(written.DetailsJson!.ToUpperInvariant(), result.Events[0].DetailsJson);
+        Assert.NotEqual(written.DetailsJson, result.Events[0].DetailsJson); // the raw row still reaches the writer
+    }
+
+    [Fact]
+    public async Task RunValueChange_SynthesizedRootRow_IsRedacted_WhenARedactorIsRegistered()
+    {
+        var (_, _, puller) = WireValueChange();
+        puller.PullAsync(default!, default!, default, default, default).ReturnsForAnyArgs(Array.Empty<AuditEvent>());
+        _services.AddSingleton<IAuditRedactor>(new UpperRedactor());
+
+        var result = await Runner().RunValueChangeAsync(_services.BuildServiceProvider(),
+            new FlowDebugRunValueChangeCommand(5, "Status", "Running", WaitSeconds: 1), Deployer, CancellationToken.None);
+
+        var root = Assert.Single(result.Events);
+        var written = Assert.Single(_central);
+        Assert.Equal(written.DetailsJson!.ToUpperInvariant(), root.DetailsJson);
+        Assert.NotEqual(written.DetailsJson, root.DetailsJson);
+    }
+
+    [Fact]
+    public async Task RunValueChange_FailedWrite_ReturnsTheRedactedRootRow()
+    {
+        WireValueChange();
+        _router.RouteToSetAttributesAsync("site-a", Arg.Any<RouteToSetAttributesRequest>(), Arg.Any<CancellationToken>())
+            .Returns(ci => new RouteToSetAttributesResponse(((RouteToSetAttributesRequest)ci[1]).CorrelationId, false, "no such attribute", DateTimeOffset.UtcNow));
+        _services.AddSingleton<IAuditRedactor>(new UpperRedactor());
+
+        var result = await Runner().RunValueChangeAsync(_services.BuildServiceProvider(),
+            new FlowDebugRunValueChangeCommand(5, "Status", "Running", WaitSeconds: 1), Deployer, CancellationToken.None);
+
+        Assert.False(result.Completed);
+        Assert.Equal("WRITE_FAILED", result.ErrorCode);
+        var root = Assert.Single(result.Events);
+        var written = Assert.Single(_central);
+        Assert.Equal(written.DetailsJson!.ToUpperInvariant(), root.DetailsJson);
+        Assert.NotEqual(written.DetailsJson, root.DetailsJson);
     }
 
     [Fact]