Purge on startup is a mostly redundant configuration, which can easily be misconfigured. We should default to non shared has purge on startup and shared has no purge on startup. For ISPN 15 we may want to allow the users to override this, but if they do we should put up a big WARN message to state this is considered a misconfiguration. In ISPN 16 we should not allow the user to override this.

For a non a shared store for consistency it only makes to do purge on startup. Otherwise old entries can be resurrected. When a user uses clean shutdown, then a shared store is not required. (We should verify that this actually works).

For a shared store it does not make sense to have a purge on startup as a new joiner will clear the shared persistent state. There is a possibility that a user may want a purge on first joiner, but unfortunately we cannot ensure that a node always joins the cluster immediately, so I do not think adding this option will be safe. Since the user controls the lifecycle of the clutser, it should be easier for them to do the clear themselves.