purge-database verifiedcritical
Wipe the cluster database
Empties the cluster database and rebuilds an empty schema — every throttle, DKIM key, pool, pause and suppression is gone.
In detail
The most dangerous thing the binary can do, sitting in the help output between two harmless neighbours. Because the database is shared by the whole cluster, running it on one node destroys the configuration of all of them; because those tables hold DKIM private keys, recovery means reissuing keys and republishing DNS, not just re-entering settings. We excluded it — along with anything matching purge or repair — from the probe run that established which directives the binary accepts, precisely so that an automated sweep could not reach it. Hub must never run it, and its presence is the reason our own tooling should never pass user-supplied strings to the binary as flags.