feat: let the operator purge a group's chat (MNP 6.1)

Signed chat_purge from the Chat settings deletes every stored message;
epoch keys and attachments stay. The ack is broadcast so open chat
panels empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md
index 0045f78..1355aaa 100644
--- a/docs/MESHBAY_NODE_PROTOCOL.md
+++ b/docs/MESHBAY_NODE_PROTOCOL.md
@@ -1173,6 +1173,7 @@ broadcast, every connected peer in the group learns the change without reconnect
 | `chat_link_preview` | `on\|off` | operator | `chat_link_preview_ack{enabled}` | yes |
 | `search_listed` | `on\|off` | operator | `search_listed_ack{listed}` | yes |
 | `chat_epoch` | `group_id` | operator | `chat_epoch_ack{epoch}` | yes |
+| `chat_purge` | `group_id`, always the connection's group | operator | `chat_purge_ack{removed}` | yes: every open chat panel empties |
 
 **Upload policy is not in this table**, and that is the design: whether a member may
 write is a property of each root (its `writable` flag), not a switch over the group. A single
@@ -2126,6 +2127,7 @@ it back (§3.5).
 | `client_diag` | C→N | auth | the video player's own view of a stream, written to the node's log beside its own (a stream event at INFO, the periodic state at DEBUG); the node acts on none of it and sends no reply |
 | `member_revoke` / `_ack` | C→N / N→C | signed | stop serving the key to someone |
 | `chat_epoch` / `_ack` | C→N / N⇒C | signed | open a new chat epoch by hand |
+| `chat_purge` / `_ack` | C→N / N⇒C | signed | delete the group's stored chat; epoch keys and attachments stay (6.1) |
 | `app_directories` / `_ack` | C→N / N⇒C | signed | one application's folders, keyed by app name |
 | `chat_directory` / `_ack` | C→N / N⇒C | signed | where chat attachments are written |
 | `chat_link_preview` / `_ack` | C→N / N⇒C | signed | whether the node unfurls posted links |
@@ -2175,7 +2177,7 @@ message:
 
 ## 13. Versioning and compatibility
 
-MNP versions independently of the package version. Current: **`6.0`**; oldest peer
+MNP versions independently of the package version. Current: **`6.1`**; oldest peer
 accepted: **`4.0`**.
 
 4.0 is the floor: a member presents a short-lived node-audience token bound to one node
@@ -2198,6 +2200,9 @@ ten operator messages no client ever sent (§10.4, "The node's own controls"). T
 also refuses to sign them, so a node older than 6.0 cannot be driven into them by a
 script in its page either.
 
+6.1 adds the signed `chat_purge` (§10.4), additively: a 6.0 node gives no
+answer, as for any unknown type, and nothing else changes.
+
 The two numbers are separate on purpose. `MNP_VERSION` says what this build speaks;
 `MNP_MIN_SUPPORTED` says what it will talk to, and moving the second is a decision about
 whether an older peer can still do anything useful: