feat(hub): delete a photo from the Photos app

On a right-clicked tile and in the lightbox bar, after a confirmation, for
the node's operator or the photo's uploader, as in Files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 6 insertions, 1 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 44592d2..052570a 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -4213,6 +4213,7 @@ process runs it — `systemctl --user` on Linux, Task Scheduler on Windows.
 | **The desktop cast relay takes the first chunk for the whole header** | The node's first chunk can be the ftyp alone, the moov in the next; the receiver then gives up. Fixed in the Android relay (§11.4), not in `cast-relay.js` |
 | **A cast restart may pull far ahead** | Seen once on an emulator with a synthetic film: after the restart's reinit the node reported `duration=None`, and the page pulled most of the film at network speed. Not reproduced on a real film; the suspicion is a read-ahead budget computed without a duration |
 | **"Copy stream URL" after picking a receiver casts to that receiver** | The player keeps the last device chosen, so the copy-only path reconnects it instead of only starting the relay |
+| **A photo deleted from the group comes back after a reinstall** | The backup's memory of what it sent is the phone's ledger (§9.12); a reinstall or cleared data empties it, and the folder no longer holds the deleted photo, so it is sent again. Clean fix: the node keeps a tombstone per folder on `file_delete` (name, size, SHA-256 taken before deleting), the index carries them, and the backup records a match as sent. Not done: a protocol field and a node table for a rare case |
 | **The home page says "No groups yet" when the hub cannot be reached** | An unreachable hub reads as an account with no groups, rather than as an error |
 | **`meshbay-node init` says "Settings → Link Node"** | The control is on the Profile page, as QUICKSTART says |
 | **C4** for accounts with browser access | Closed against operators by the pepper; **open against an active hub**, which holds the pepper and can fetch a bundle with a token it mints — the adversary T3 already concedes for browsers (§3.7) |
diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index 9daf71b..d8e793f 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -372,6 +372,10 @@ is a folder**. Thumbnails come from the node, already rotated correctly. A
 photo opens full size, with a slideshow button that moves on every five
 seconds and stops at the album's last photo.
 
+A photo you uploaded can be deleted: right-click it, or use the bin in the bar
+above an open photo (the way in on a phone). The node's operator can delete any
+photo. Both ask first.
+
 **Location data is never shown.** Photos shows when a picture was taken and
 what took it, and no coordinates anywhere. Worth knowing, though: the
 coordinates are still inside the photo itself, as your phone wrote them, so
@@ -403,7 +407,7 @@ of your groups, once a day.
   about to send and asks first.
 - Photos go into folders by year, then year and month (`2026/2026-10`). **A photo you delete
   from the phone stays in the group**, and one deleted from the group is not
-  sent again. A photo you edit on the phone is sent again beside the original,
+  sent again, unless the application is reinstalled. A photo you edit on the phone is sent again beside the original,
   with `-edited-` and the date in its name.
 - **Where a photo was taken is removed** from the copy that is sent.
 - If the backup cannot go on — the node's disk is full, the folder no longer