---
id: w6/m3/t004
title: "Delete workspace: danger zone with type-to-confirm guard matching captured Render UX"
worker: worker6
status: done
estimate: 25m
depends_on: [w6/m3/t003]
---

## Closeout

Shipped as `src/features/workspaces/components/delete-workspace-card.tsx`. Type-the-exact-name-to-confirm gates the Delete button (disabled until match — unit-tested, verified live: a mistyped/partial name keeps it disabled, a click while disabled never calls the mutation); the server re-checks the confirmation regardless (`deleteWorkspace`'s `confirmName != t.Name` guard), so the client gate is UX only, matching the design intent. On success, switches to a remaining workspace (computed from the pre-delete list, since the deleted one won't be in a post-delete refetch to fall back to) and navigates home; routes to `/new/workspace` if none remain. **Deviation from spec:** the confirm dialog does not enumerate live resource counts (services/databases) before deletion — `docs/render-artifacts/workspace-lifecycle.md`'s capture of Render's exact wording/enumeration was deferred in m1/t001 and never produced, so this milestone ships an honest, simpler danger-zone description ("permanently removes its services, databases, and env vars") rather than inventing counts Render's own capture never verified.

## Objective

The settings page's danger zone: **Delete workspace**, admin-only, with the confirmation mechanism m1/t001 captured from Render (type the workspace name; enumerate what will be destroyed — services, databases, env vars). Confirming calls `deleteWorkspace(confirmation)`; on success the user lands in their remaining workspace (or the first-run state if none — mirror captured behavior for the last-workspace case).

## Context

- The server re-checks the confirmation string (m1/t004) — the UI guard is UX, not the security boundary.
- List the workspace's live resource counts in the dialog (services/databases from existing queries) so the destruction warning is concrete.
- Post-delete: clear/repair the t001 selected-workspace context.

## Steps

1. Danger-zone section + confirm dialog (shadcn), destructive styling consistent with existing delete flows (w5/m4's service delete).
2. Wire the mutation; handle refusal errors (wrong name, non-admin, last-workspace rule) inline.
3. Post-success navigation + context reset.

## Files

- `dashboard/src/routes/` (workspace settings route)
- `dashboard/src/graphql/`

## Acceptance criteria

- [ ] Mistyped name keeps the button disabled / server refusal rendered inline
- [ ] Successful delete lands in a valid workspace context with the switcher updated
- [ ] Dialog enumerates real resource counts before deletion

## Out of scope

- Soft-delete/undo (follow-up if the Render capture shows a grace period).
