# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: patch -->

## What Changed

The delivery-failure sentinel's restore-purge default rises from 5 to 60 minutes (restorePurgeAgeMs; config knob unchanged), and the purge is now loud: it lists every victim row (delivery id, topic, queued-since, content preview) in the log and files a degradation report naming them before deleting. Previously it deleted queued-undelivered outbound messages silently with a count-only log line. New PendingRelayStore.listStaleClaimable supports the pre-delete listing.

## What to Tell Your User

Outgoing messages that get queued during a busy or restarting period can no longer silently vanish. Previously, a message that waited more than 5 minutes for delivery could be deleted at the next internal restart with no trace; now the window is an hour, and if anything IS ever purged after a genuinely long outage, the loss is recorded loudly so the agent knows to resend.

## Summary of New Capabilities

- restorePurgeAgeMs default 60min (was 5min) — outbound queue survives restart churn.
- Restore-purge victims are individually logged + reported via the degradation pipeline (no more silent outbound loss).

## Evidence

Live trace (2026-06-05, echo): five "restore-purged 1 stale rows (older than 300000ms)" lines in one day (08:02, 08:34, 13:48, 13:56, 14:53) — each a real queued-undelivered outbound message during fleet-release restart churn; the 14:53 victim was a user milestone report (delivery 283a03dd, queued 14:45, purged at the next sentinel boot, never delivered, absent from the outbound log). Outbound twin of the inbound replay-budget bug fixed in the lifeline. Pinned by 4 new store tests (listing both sides of the cutoff, terminal-state exclusion, exact list/purge parity).
