fix(store-and-forward): gate the retry sweep behind an active-node delivery gate (standby must be passive)

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardService.cs

@@ -85,6 +85,21 @@ public class StoreAndForwardService
     private Timer? _retryTimer;
     private int _retryInProgress;
 
+    /// <summary>
+    /// Active-node delivery gate. When set, the retry sweep runs ONLY when the
+    /// gate reports true — the standby node applies replicated buffer operations
+    /// but must never deliver (Component-StoreAndForward.md "standby-passive"
+    /// model). Re-evaluated on every sweep tick so a failover resumes delivery
+    /// within one RetryTimerInterval without re-wiring. Null (tests, central
+    /// hosts) preserves the ungated legacy behaviour. A throwing gate is treated
+    /// as standby — safe-by-default, mirroring SiteCommunicationActor's
+    /// DefaultIsActiveCheck fallback.
+    /// </summary>
+    private Func<bool>? _deliveryGate;
+
+    /// <summary>Installs the active-node delivery gate (see <see cref="_deliveryGate"/>).</summary>
+    public void SetDeliveryGate(Func<bool> gate) => _deliveryGate = gate;
+
     /// <summary>
     /// The in-flight retry sweep <see cref="Task"/>, or
     /// <c>null</c> when no sweep is currently running. Captured when the timer
@@ -568,6 +583,24 @@ public class StoreAndForwardService
 
         try
         {
+            var gate = _deliveryGate;
+            if (gate != null)
+            {
+                bool isActive;
+                try { isActive = gate(); }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex,
+                        "S&F delivery gate threw; treating this node as standby for this sweep");
+                    isActive = false;
+                }
+                if (!isActive)
+                {
+                    _logger.LogDebug("S&F retry sweep skipped: this node is not the active site node");
+                    return;
+                }
+            }
+
             var messages = await _storage.GetMessagesForRetryAsync();
             if (messages.Count == 0) return;