Purged messages apparently reappear on a destination after fail-over and fail-back

In a master-slave, shared-nothing broker pair, Messages that have been purged administratively using the JMX removeAllMessages() API can apparently be restored after a fail-over and fail-back. In fact, what is happening is that the purge is not taking effect on the broker in the backup role, so the pre-purge message store ends up on the master after the fail-back.

The following sequence of steps reproduce the problem. This sequence is based on the events reported by the customer, and it's likely that the problem could be reproduced with fewer steps, although I could not find a way.

0. Set up two brokers using the configuration from examples/features/ha/replicated-failback. Add an address like this to both brokers:

<address name="purge">
<multicast>
<queue name="purge" purge-on-no-consumers="false"/>
</multicast>
</address>

1 Start with purge-on-no-consumers=false
2 Start master
3 Start slave
4 send 100 messages to topic "purge" using qpid JMS client
5 Stop master
6 Stop slave
7 Set purge on-on-consumers=true
8 Start master
9 Start slave
10 In console on master, note that "purge" has 100 messages, as expected at this point
11 In console on master, use removeAllMessages() on destination
12 Note that console shows zero messages on the destination
13 Without attaching any clients, ctrl+c the master
14 Slave starts as live
15 In console on slave (which is now live) note that the destination has 100 messages
16 Start master
17 Master takes over live role, slave now backup
18 In console on master (which is now live) note that the destination has 100 messages

It seems that the removeAllMessages() method in step 11 did not cause the broker "slave", which was a backup at that time, to receive an updated message store from "master".