merge: external-system retry policy end-to-end (register row 27) — MaxRetries/RetryDelay now travel artifact→gRPC→site schema→S&F enqueue, CLI --max-retries/--retry-delay-seconds, ArtifactDiff compares them

docs/deployment/topology-guide.md

@@ -291,6 +291,18 @@ will run, but they will not converge, and the divergence is silent.
 
 Stop both nodes of a site pair, upgrade both, then start both.
 
+**A release that adds a column to a replicated table is the same constraint, enforced louder.**
+`ReplicatedTable.ComputeDigest` hashes every column name and declared type, and the sync handshake
+compares those digests fail-closed — so a mixed-version pair whose builds disagree about a table's
+columns does not diverge silently, it refuses to sync with a `LocalDbSchemaMismatchException`.
+Stopping and starting both nodes together, which is already the rule above, is the whole fix; no
+manual trigger or oplog migration is needed, because `RegisterReplicated` re-reads
+`PRAGMA table_info` on every boot and rebuilds the capture triggers (DROP + CREATE) over the
+current column set. The site schema's own `AddColumnIfMissing` runs before registration on that
+same boot, so a node picks up the new columns and the matching triggers in one start.
+(Most recent instance: `external_systems` gained `max_retries` / `retry_delay_ms` for the
+per-system store-and-forward retry policy.)
+
 **Related bound — do not leave one node of a pair offline for long.** A node absent for longer than
 `LocalDb:Replication:TombstoneRetention` (default **7 days**) can **resurrect deleted rows** when
 it rejoins: deletes replicate as HLC-ordered tombstones, and once a tombstone is pruned there is