fix(host): wire S&F active-node delivery gate on site nodes (SelfIsPrimary); align S&F doc standby-passive wording

src/ZB.MOM.WW.ScadaBridge.Host/Actors/AkkaHostedService.cs

@@ -859,6 +859,22 @@ akka {{
             cancellationToken.ThrowIfCancellationRequested();
             await storeAndForwardService.StartAsync();
 
+            // Standby must be passive: only the active site node runs the S&F
+            // delivery sweep. Without this gate BOTH nodes deliver the same
+            // replicated Pending rows — systematic duplicate external calls and
+            // DB writes (arch review 02, Stability #2). Re-evaluated per sweep
+            // tick so failover resumes delivery within one RetryTimerInterval.
+            // IClusterNodeProvider.SelfIsPrimary is the canonical "this node is the
+            // oldest Up member (singleton host)" check from the cluster-infrastructure
+            // fix plan — the shared helper this seam was designed to accept. In a
+            // non-clustered test host the provider is unregistered, so the gate stays
+            // unset and the sweep is ungated (legacy behaviour, preserved).
+            var clusterNodeProvider = _serviceProvider.GetService<ZB.MOM.WW.ScadaBridge.HealthMonitoring.IClusterNodeProvider>();
+            if (clusterNodeProvider != null)
+            {
+                storeAndForwardService.SetDeliveryGate(() => clusterNodeProvider.SelfIsPrimary);
+            }
+
             // Register the store-and-forward delivery handlers so buffered
             // ExternalSystem calls, cached DB writes and notifications are actually
             // delivered by the retry sweep. Without this, every buffered message is