fix(store-and-forward): resolve StoreAndForward-006,007,008,009 — transactional parked reads, PipeTo, fault-isolated activity events; 002/011/012 deferred

tests/ScadaLink.StoreAndForward.Tests/StoreAndForwardServiceTests.cs

@@ -372,6 +372,50 @@ public class StoreAndForwardServiceTests : IAsyncLifetime, IDisposable
         Assert.Contains("Queued", activities);
     }
 
+    // ── StoreAndForward-009: faulting activity subscriber must not corrupt delivery ──
+
+    [Fact]
+    public async Task EnqueueAsync_ImmediateDeliverySuccess_FaultingActivitySubscriber_StillReportsDelivered()
+    {
+        // StoreAndForward-009: a throwing OnActivity subscriber (e.g. the site event
+        // log) must not be misclassified as a transient delivery failure. Pre-fix the
+        // subscriber's exception escaped RaiseActivity, was caught by EnqueueAsync's
+        // transient-failure handler, and a successfully delivered message was buffered.
+        _service.OnActivity += (_, _, _) => throw new InvalidOperationException("logging blew up");
+        _service.RegisterDeliveryHandler(StoreAndForwardCategory.ExternalSystem,
+            _ => Task.FromResult(true));
+
+        var result = await _service.EnqueueAsync(
+            StoreAndForwardCategory.ExternalSystem, "api", """{}""");
+
+        Assert.True(result.Accepted);
+        Assert.False(result.WasBuffered); // delivered, NOT buffered
+
+        var msg = await _storage.GetMessageByIdAsync(result.MessageId);
+        Assert.Null(msg); // nothing left in the buffer
+    }
+
+    [Fact]
+    public async Task RetryMessageAsync_FaultingActivitySubscriber_DoesNotIncrementRetryCount()
+    {
+        // StoreAndForward-009: a throwing subscriber raised after a successful retry
+        // delivery must not be caught by the retry-failure handler and counted as a
+        // transient failure.
+        var result = await _service.EnqueueAsync(
+            StoreAndForwardCategory.ExternalSystem, "api", """{}""",
+            attemptImmediateDelivery: false, maxRetries: 5);
+
+        _service.RegisterDeliveryHandler(StoreAndForwardCategory.ExternalSystem,
+            _ => Task.FromResult(true));
+        _service.OnActivity += (_, _, _) => throw new InvalidOperationException("logging blew up");
+
+        await _service.RetryPendingMessagesAsync();
+
+        // The retry succeeded; the message must be gone, not re-buffered with a bumped count.
+        var msg = await _storage.GetMessageByIdAsync(result.MessageId);
+        Assert.Null(msg);
+    }
+
     // ── WP-10: Per-source-entity retry settings ──
 
     [Fact]