From fd1abdb832e8b5e0557583aa8816e8d524add627 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Thu, 12 Mar 2026 11:18:38 +0100
Subject: [PATCH 01/24] Add realm delete workflow

---
 .github/workflows/ci.yaml                     |   1 +
 .../components/operator-mode/delete-modal.gts |  18 +-
 .../operator-mode/workspace-chooser/index.gts |   1 +
 .../workspace-chooser/workspace.gts           | 504 +++++++++++++++++-
 packages/host/app/services/matrix-service.ts  |  13 +
 packages/host/app/services/realm-server.ts    |  27 +
 packages/host/app/services/realm.ts           |  10 +
 .../workspace-chooser-delete-test.gts         | 184 +++++++
 .../tests/helpers/realm-server-mock/routes.ts |  52 ++
 .../handlers/handle-delete-realm.ts           | 238 +++++++++
 .../handlers/handle-unpublish-realm.ts        |  50 +-
 .../handlers/realm-destruction-utils.ts       |  53 ++
 packages/realm-server/routes.ts               |   6 +
 packages/realm-server/tests/index.ts          |   1 +
 .../server-endpoints/delete-realm-test.ts     | 216 ++++++++
 15 files changed, 1296 insertions(+), 78 deletions(-)
 create mode 100644 packages/host/tests/acceptance/workspace-chooser-delete-test.gts
 create mode 100644 packages/realm-server/handlers/handle-delete-realm.ts
 create mode 100644 packages/realm-server/handlers/realm-destruction-utils.ts
 create mode 100644 packages/realm-server/tests/server-endpoints/delete-realm-test.ts

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index bdc816cdd5c..a35b7034f93 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -510,6 +510,7 @@ jobs:
             "server-endpoints/authentication-test.ts",
             "server-endpoints/bot-commands-test.ts",
             "server-endpoints/bot-registration-test.ts",
+            "server-endpoints/delete-realm-test.ts",
             "server-endpoints/download-realm-test.ts",
             "server-endpoints/index-responses-test.ts",
             "server-endpoints/maintenance-endpoints-test.ts",
diff --git a/packages/host/app/components/operator-mode/delete-modal.gts b/packages/host/app/components/operator-mode/delete-modal.gts
index c2f2b3aba3a..5081d184c95 100644
--- a/packages/host/app/components/operator-mode/delete-modal.gts
+++ b/packages/host/app/components/operator-mode/delete-modal.gts
@@ -17,8 +17,10 @@ interface Signature {
     onCancel: () => void;
     isDeleteRunning?: boolean;
     error?: string;
+    size?: 'x-small' | 'small' | 'medium' | 'large' | 'full-screen';
   };
   Blocks: {
+    default: [];
     content: [];
   };
 }
@@ -28,15 +30,19 @@ let component: TemplateOnlyComponent<Signature> = <template>
     data-test-delete-modal-container
     data-test-delete-modal={{@itemToDelete.id}}
     @layer='urgent'
-    @size='x-small'
+    @size={{if @size @size 'x-small'}}
     @isOpen={{true}}
     @onClose={{@onCancel}}
     style={{cssVar boxel-modal-offset-top='40vh'}}
   >
     <section class='delete'>
-      <p class='content' data-test-delete-msg>
-        {{yield to='content'}}
-      </p>
+      <div class='content' data-test-delete-msg>
+        {{#if (has-block 'content')}}
+          {{yield to='content'}}
+        {{else}}
+          {{yield}}
+        {{/if}}
+      </div>
       <p class='content disclaimer'>This action is not reversible.</p>
       <footer class='buttons'>
         {{#if @isDeleteRunning}}
@@ -74,9 +80,9 @@ let component: TemplateOnlyComponent<Signature> = <template>
       margin: 0;
       font: 500 var(--boxel-font);
       letter-spacing: var(--boxel-lsp-xs);
+      line-height: 1.4;
       text-align: center;
-      overflow: hidden;
-      text-overflow: ellipsis;
+      white-space: normal;
     }
     .content + .content {
       margin-top: var(--boxel-sp-xs);
diff --git a/packages/host/app/components/operator-mode/workspace-chooser/index.gts b/packages/host/app/components/operator-mode/workspace-chooser/index.gts
index ff6b9abb1d9..c5393e949d1 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/index.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/index.gts
@@ -43,6 +43,7 @@ export default class WorkspaceChooser extends Component<Signature> {
           {{#each this.realmServer.userRealmURLs as |realmURL|}}
             <Workspace
               @realmURL={{realmURL}}
+              @showMenu={{true}}
               data-test-workspace={{realmURL}}
             />
           {{/each}}
diff --git a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
index bf24317ea3b..941a2e1329b 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
@@ -1,25 +1,43 @@
+import { array } from '@ember/helper';
 import { on } from '@ember/modifier';
 import { action } from '@ember/object';
 import { service } from '@ember/service';
 import Component from '@glimmer/component';
 import { cached } from '@glimmer/tracking';
+import { tracked } from '@glimmer/tracking';
 
-import { task } from 'ember-concurrency';
+import { dropTask, task } from 'ember-concurrency';
+import pluralize from 'pluralize';
 
-import { RealmIcon } from '@cardstack/boxel-ui/components';
-import { cssVar } from '@cardstack/boxel-ui/helpers';
-import { Group, IconGlobe, Lock } from '@cardstack/boxel-ui/icons';
+import {
+  BoxelDropdown,
+  ContextButton,
+  Menu,
+  RealmIcon,
+} from '@cardstack/boxel-ui/components';
+import { cssVar, menuItem } from '@cardstack/boxel-ui/helpers';
+import { Group, IconGlobe, IconTrash, Lock } from '@cardstack/boxel-ui/icons';
 
+import {
+  hasExecutableExtension,
+  SupportedMimeType,
+} from '@cardstack/runtime-common';
+
+import DeleteModal from '@cardstack/host/components/operator-mode/delete-modal';
+import type MatrixService from '@cardstack/host/services/matrix-service';
+import type NetworkService from '@cardstack/host/services/network';
 import type OperatorModeStateService from '@cardstack/host/services/operator-mode-state-service';
 import type RealmService from '@cardstack/host/services/realm';
+import type RealmServerService from '@cardstack/host/services/realm-server';
 
 import ItemContainer from './item-container';
 import WorkspaceLoadingIndicator from './workspace-loading-indicator';
 
 interface Signature {
-  Element: HTMLButtonElement;
+  Element: HTMLDivElement;
   Args: {
     realmURL: string;
+    showMenu?: boolean;
   };
 }
 
@@ -28,34 +46,144 @@ export default class Workspace extends Component<Signature> {
     {{#if this.loadRealmTask.isRunning}}
       <WorkspaceLoadingIndicator />
     {{else}}
-      <ItemContainer
-        data-test-workspace={{this.name}}
-        {{on 'click' this.openWorkspace}}
-      >
-        <div
-          class='icon'
-          style={{cssVar
-            workspace-background-image-url=this.backgroundImageURL
-          }}
+      <div class='workspace-card'>
+        <ItemContainer
+          class='workspace-card__button'
+          data-test-workspace={{this.name}}
+          {{on 'click' this.openWorkspace}}
         >
-          <RealmIcon
-            class='workspace-realm-icon'
-            @realmInfo={{this.realmInfo}}
-          />
-          <div class='visibility-icon'>
-            <this.visibilityIcon width='100%' height='100%' />
+          <div
+            class='icon'
+            style={{cssVar
+              workspace-background-image-url=this.backgroundImageURL
+            }}
+          >
+            <RealmIcon
+              class='workspace-realm-icon'
+              @realmInfo={{this.realmInfo}}
+            />
+            <div class='visibility-icon'>
+              <this.visibilityIcon width='100%' height='100%' />
+            </div>
+          </div>
+          <div class='info'>
+            <span class='name' data-test-workspace-name>{{this.name}}</span>
+            <span
+              class='visibility'
+              data-test-workspace-visibility
+            >{{this.visibility}}</span>
+          </div>
+        </ItemContainer>
+
+        {{#if @showMenu}}
+          <div class='workspace-menu'>
+            <BoxelDropdown @contentClass='workspace-menu__content'>
+              <:trigger as |bindings|>
+                <ContextButton
+                  class='workspace-menu__trigger'
+                  data-test-workspace-menu-trigger={{@realmURL}}
+                  @icon='context-menu'
+                  @label='Workspace options'
+                  @size='small'
+                  @variant='ghost'
+                  @width='24px'
+                  @height='24px'
+                  {{bindings}}
+                />
+              </:trigger>
+              <:content as |dd|>
+                <Menu
+                  class='workspace-menu__list'
+                  @closeMenu={{dd.close}}
+                  @items={{array
+                    (menuItem
+                      'Delete workspace'
+                      this.openDeleteModal
+                      dangerous=true
+                      disabled=this.deleteWorkspaceDisabled
+                      icon=IconTrash
+                    )
+                  }}
+                />
+              </:content>
+            </BoxelDropdown>
           </div>
-        </div>
-        <div class='info'>
-          <span class='name' data-test-workspace-name>{{this.name}}</span>
-          <span
-            class='visibility'
-            data-test-workspace-visibility
-          >{{this.visibility}}</span>
-        </div>
-      </ItemContainer>
+        {{/if}}
+      </div>
+      {{#if this.showDeleteModal}}
+        <DeleteModal
+          @itemToDelete={{this.workspaceToDelete}}
+          @onCancel={{this.closeDeleteModal}}
+          @onConfirm={{this.confirmDeleteWorkspace}}
+          @isDeleteRunning={{this.deleteWorkspaceTask.isRunning}}
+          @error={{this.deleteError}}
+          @size='small'
+        >
+          <:content>
+            <div class='workspace-delete-copy'>
+              <header class='workspace-delete-header'>
+                <p class='workspace-delete-eyebrow'>Delete workspace</p>
+                <p class='workspace-delete-title'>{{this.name}}</p>
+              </header>
+
+              {{#if this.loadDeleteSummaryTask.isRunning}}
+                <p class='workspace-delete-summary-card'>
+                  Checking what will be removed from this workspace...
+                </p>
+              {{else if this.deleteSummaryText}}
+                <p class='workspace-delete-summary-card'>
+                  Contains
+                  {{this.deleteSummaryText}}.
+                </p>
+              {{/if}}
+
+              <div class='workspace-delete-danger-panel'>
+                <p class='workspace-delete-warning'>
+                  This permanently deletes the workspace and any custom domains
+                  tied to it.
+                </p>
+
+                {{#if this.hasPublishedRealms}}
+                  <div class='workspace-delete-published'>
+                    <p class='workspace-delete-published-title'>
+                      Published
+                      {{pluralize 'realm' this.publishedRealmURLs.length}}
+                      that will also be removed
+                    </p>
+                    <ul class='workspace-delete-published-list'>
+                      {{#each this.publishedRealmURLs as |publishedRealmURL|}}
+                        <li>
+                          <a
+                            href={{publishedRealmURL}}
+                            target='_blank'
+                            rel='noopener noreferrer'
+                          >
+                            {{publishedRealmURL}}
+                          </a>
+                        </li>
+                      {{/each}}
+                    </ul>
+                  </div>
+                {{/if}}
+
+                <p
+                  class='workspace-delete-warning workspace-delete-warning--strong'
+                >
+                  Links to cards in this workspace may stop working elsewhere.
+                </p>
+              </div>
+            </div>
+          </:content>
+        </DeleteModal>
+      {{/if}}
     {{/if}}
     <style scoped>
+      .workspace-card {
+        position: relative;
+      }
+      .workspace-card__button {
+        display: flex;
+      }
       .icon {
         background-color: var(--boxel-500);
         background-image: var(--workspace-background-image-url);
@@ -117,11 +245,131 @@ export default class Workspace extends Component<Signature> {
         font: 500 var(--boxel-font-xs);
         text-transform: capitalize;
       }
+      .workspace-menu {
+        position: absolute;
+        top: var(--boxel-sp-xs);
+        right: var(--boxel-sp-xs);
+        z-index: 1;
+      }
+      .workspace-menu__trigger {
+        --boxel-icon-button-width: 2.65rem;
+        --boxel-icon-button-height: 1.85rem;
+        --boxel-icon-button-padding: 0 0.38rem;
+        color: var(--boxel-light-100);
+        background: rgb(24 25 32 / 86%);
+        border: 1px solid rgb(255 255 255 / 62%);
+        border-radius: 6px;
+        box-shadow: 0 6px 14px rgb(0 0 0 / 22%);
+        backdrop-filter: blur(10px);
+      }
+      .workspace-menu__trigger :deep(svg) {
+        width: 1.7rem;
+        height: 1.7rem;
+      }
+      .workspace-menu__trigger:hover,
+      .workspace-menu__trigger[aria-expanded='true'] {
+        color: var(--boxel-dark);
+        background: var(--boxel-highlight);
+        border-color: rgb(255 255 255 / 78%);
+      }
+      :global(.workspace-menu__content) {
+        min-width: 11rem;
+      }
+      .workspace-menu__list {
+        --boxel-menu-item-content-padding: var(--boxel-sp-xs) var(--boxel-sp-sm);
+      }
+      .workspace-delete-copy {
+        display: flex;
+        flex-direction: column;
+        gap: var(--boxel-sp);
+        max-width: 31rem;
+        margin: 0 auto;
+        text-align: left;
+      }
+      .workspace-delete-copy p {
+        margin: 0;
+      }
+      .workspace-delete-header {
+        padding-bottom: var(--boxel-sp-xs);
+        border-bottom: 1px solid rgb(0 0 0 / 10%);
+      }
+      .workspace-delete-eyebrow {
+        color: var(--boxel-danger);
+        font: 700 var(--boxel-font-xs);
+        letter-spacing: 0.08em;
+        text-transform: uppercase;
+      }
+      .workspace-delete-title {
+        color: var(--boxel-dark);
+        font: 700 var(--boxel-font-lg);
+      }
+      .workspace-delete-summary-card {
+        padding: var(--boxel-sp-xs) var(--boxel-sp-sm);
+        color: var(--boxel-dark);
+        background: rgb(0 0 0 / 4%);
+        border: 1px solid rgb(0 0 0 / 8%);
+        border-radius: 0.75rem;
+        font: 600 var(--boxel-font-sm);
+      }
+      .workspace-delete-danger-panel {
+        display: flex;
+        flex-direction: column;
+        gap: var(--boxel-sp-xs);
+        padding: var(--boxel-sp-sm);
+        background: rgb(255 80 80 / 6%);
+        border: 1px solid rgb(255 80 80 / 16%);
+        border-radius: 0.9rem;
+      }
+      .workspace-delete-warning {
+        color: var(--boxel-700);
+        font: 500 var(--boxel-font-sm);
+        line-height: 1.4;
+      }
+      .workspace-delete-warning--strong {
+        color: var(--boxel-dark);
+        font-weight: 600;
+      }
+      .workspace-delete-published {
+        display: flex;
+        flex-direction: column;
+        gap: var(--boxel-sp-5xs);
+        padding: var(--boxel-sp-xs);
+        background: rgb(255 255 255 / 88%);
+        border-radius: 0.7rem;
+      }
+      .workspace-delete-published-title {
+        color: var(--boxel-dark);
+        font: 700 var(--boxel-font-xs);
+        letter-spacing: 0.02em;
+      }
+      .workspace-delete-published-list {
+        margin: 0;
+        padding-left: 1rem;
+        text-align: left;
+      }
+      .workspace-delete-published-list li + li {
+        margin-top: var(--boxel-sp-5xs);
+      }
+      .workspace-delete-published-list a {
+        color: var(--boxel-blue);
+        font: 500 var(--boxel-font-xs);
+        line-height: 1.4;
+        word-break: break-all;
+        text-decoration-thickness: 1px;
+        text-underline-offset: 0.12em;
+      }
     </style>
   </template>
 
   @service declare private operatorModeStateService: OperatorModeStateService;
+  @service declare private matrixService: MatrixService;
+  @service declare private network: NetworkService;
   @service declare private realm: RealmService;
+  @service declare private realmServer: RealmServerService;
+
+  @tracked private showDeleteModal = false;
+  @tracked private deleteError: string | undefined;
+  @tracked private deleteSummary: WorkspaceDeleteSummary | undefined;
 
   constructor(...args: [any, any]) {
     super(...args);
@@ -167,7 +415,205 @@ export default class Workspace extends Component<Signature> {
     }
   }
 
+  private get workspaceToDelete() {
+    return {
+      id: this.args.realmURL,
+      name: this.name,
+    };
+  }
+
+  private get createdByCurrentUser() {
+    let currentUserName = this.matrixService.userName;
+    if (!currentUserName) {
+      return false;
+    }
+    let segments = new URL(this.args.realmURL).pathname
+      .split('/')
+      .filter(Boolean);
+    if (segments.length < 2) {
+      return false;
+    }
+    return segments[segments.length - 2] === currentUserName;
+  }
+
+  private get canDeleteWorkspace() {
+    return this.createdByCurrentUser && this.realm.canWrite(this.args.realmURL);
+  }
+
+  private get deleteWorkspaceDisabled() {
+    return !this.canDeleteWorkspace;
+  }
+
+  private get deleteSummaryText() {
+    if (!this.deleteSummary) {
+      return null;
+    }
+    let { cards, definitions, files } = this.deleteSummary;
+    return formatWorkspaceDeleteSummary([
+      { label: 'card', count: cards },
+      { label: 'definition', count: definitions },
+      { label: 'file', count: files },
+    ]);
+  }
+
+  private get publishedRealmURLs() {
+    let { lastPublishedAt } = this.realmInfo;
+    if (!lastPublishedAt || typeof lastPublishedAt !== 'object') {
+      return [];
+    }
+
+    return Object.entries(lastPublishedAt)
+      .sort(([, leftPublishedAt], [, rightPublishedAt]) => {
+        return Number(rightPublishedAt) - Number(leftPublishedAt);
+      })
+      .map(([publishedRealmURL]) => publishedRealmURL);
+  }
+
+  private get hasPublishedRealms() {
+    return this.publishedRealmURLs.length > 0;
+  }
+
   @action async openWorkspace() {
     await this.operatorModeStateService.openWorkspace(this.args.realmURL);
   }
+
+  @action openDeleteModal() {
+    if (!this.canDeleteWorkspace) {
+      return;
+    }
+    this.deleteSummary = undefined;
+    this.deleteError = undefined;
+    this.showDeleteModal = true;
+    this.loadDeleteSummaryTask.perform();
+  }
+
+  @action closeDeleteModal() {
+    if (this.deleteWorkspaceTask.isRunning) {
+      return;
+    }
+    this.showDeleteModal = false;
+    this.deleteError = undefined;
+  }
+
+  @action confirmDeleteWorkspace() {
+    this.deleteWorkspaceTask.perform();
+  }
+
+  private loadDeleteSummaryTask = dropTask(async () => {
+    try {
+      let response = await this.network.authedFetch(
+        `${this.args.realmURL}_mtimes`,
+        {
+          headers: {
+            Accept: SupportedMimeType.Mtimes,
+          },
+        },
+      );
+      if (!response.ok) {
+        throw new Error(
+          `Failed to fetch workspace contents: ${response.status}`,
+        );
+      }
+      let json = (await response.json()) as {
+        data: {
+          attributes: {
+            mtimes: Record<string, number>;
+          };
+        };
+      };
+      this.deleteSummary = summarizeWorkspaceContents(
+        Object.keys(json.data.attributes.mtimes),
+      );
+    } catch (error) {
+      console.error(error);
+      this.deleteSummary = undefined;
+    }
+  });
+
+  private deleteWorkspaceTask = dropTask(async () => {
+    this.deleteError = undefined;
+
+    try {
+      let isActiveWorkspace =
+        this.operatorModeStateService.realmURL === this.args.realmURL ||
+        this.operatorModeStateService
+          .getOpenCardIds()
+          .some((cardId) => cardId.startsWith(this.args.realmURL)) ||
+        this.operatorModeStateService.codePathString?.startsWith(
+          this.args.realmURL,
+        );
+
+      await this.realmServer.deleteRealm(this.args.realmURL);
+      await this.matrixService.removeRealmFromAccountData(this.args.realmURL);
+      this.realm.removeRealm(this.args.realmURL);
+
+      if (isActiveWorkspace) {
+        this.operatorModeStateService.clearStacks();
+        await this.operatorModeStateService.updateCodePath(null);
+        this.operatorModeStateService.openWorkspaceChooser();
+      }
+
+      this.showDeleteModal = false;
+    } catch (error: any) {
+      this.deleteError = error.message;
+    }
+  });
+}
+
+interface WorkspaceDeleteSummary {
+  cards: number;
+  definitions: number;
+  files: number;
+}
+
+function summarizeWorkspaceContents(
+  fileURLs: string[],
+): WorkspaceDeleteSummary {
+  return fileURLs.reduce(
+    (summary, fileURL) => {
+      let path = new URL(fileURL).pathname;
+      if (path.endsWith('/.realm.json')) {
+        return summary;
+      }
+      if (path.endsWith('.json')) {
+        summary.cards++;
+      } else if (hasExecutableExtension(path)) {
+        summary.definitions++;
+      } else {
+        summary.files++;
+      }
+      return summary;
+    },
+    {
+      cards: 0,
+      definitions: 0,
+      files: 0,
+    } as WorkspaceDeleteSummary,
+  );
+}
+
+function formatWorkspaceDeleteSummary(
+  counts: { label: string; count: number }[],
+): string {
+  let nonZeroCounts = counts
+    .filter(({ count }) => count > 0)
+    .map(({ label, count }) => `${count} ${pluralize(label, count)}`);
+
+  if (nonZeroCounts.length === 0) {
+    return 'no cards, definitions, or files';
+  }
+
+  return joinWithAnd(nonZeroCounts);
+}
+
+function joinWithAnd(parts: string[]): string {
+  if (parts.length <= 1) {
+    return parts[0] ?? '';
+  }
+
+  if (parts.length === 2) {
+    return `${parts[0]} and ${parts[1]}`;
+  }
+
+  return `${parts.slice(0, -1).join(', ')}, and ${parts.at(-1)}`;
 }
diff --git a/packages/host/app/services/matrix-service.ts b/packages/host/app/services/matrix-service.ts
index 26525fbe365..0dca49e5880 100644
--- a/packages/host/app/services/matrix-service.ts
+++ b/packages/host/app/services/matrix-service.ts
@@ -640,6 +640,19 @@ export default class MatrixService extends Service {
     await this.realmServer.setAvailableRealmURLs(newRealms);
   }
 
+  public async removeRealmFromAccountData(realmURLString: string) {
+    let { realms = [] } =
+      ((await this.client.getAccountDataFromServer(
+        APP_BOXEL_REALMS_EVENT_TYPE,
+      )) as { realms: string[] }) ?? {};
+
+    let newRealms = realms.filter((realmURL) => realmURL !== realmURLString);
+    await this.client.setAccountData(APP_BOXEL_REALMS_EVENT_TYPE, {
+      realms: newRealms,
+    });
+    await this.realmServer.setAvailableRealmURLs(newRealms);
+  }
+
   async setDisplayName(displayName: string) {
     await this.client.setDisplayName(displayName);
   }
diff --git a/packages/host/app/services/realm-server.ts b/packages/host/app/services/realm-server.ts
index 9d62147bca0..97fa45d2afe 100644
--- a/packages/host/app/services/realm-server.ts
+++ b/packages/host/app/services/realm-server.ts
@@ -166,6 +166,33 @@ export default class RealmServerService extends Service {
     return new URL(realmURL);
   }
 
+  async deleteRealm(realmURL: string) {
+    await this.login();
+
+    let response = await this.network.fetch(`${this.url.href}_delete-realm`, {
+      method: 'DELETE',
+      headers: {
+        Accept: SupportedMimeType.JSONAPI,
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${this.token}`,
+      },
+      body: JSON.stringify({
+        data: {
+          type: 'realm',
+          id: realmURL,
+        },
+      }),
+    });
+
+    if (!response.ok) {
+      let err = `Could not delete realm '${realmURL}': ${
+        response.status
+      } - ${await response.text()}`;
+      console.error(err);
+      throw new Error(err);
+    }
+  }
+
   logout(): void {
     this.loginTask.cancelAll();
     this.tokenRefresher.cancelAll();
diff --git a/packages/host/app/services/realm.ts b/packages/host/app/services/realm.ts
index 9685d68b5fe..598e4e886cc 100644
--- a/packages/host/app/services/realm.ts
+++ b/packages/host/app/services/realm.ts
@@ -827,6 +827,16 @@ export default class RealmService extends Service {
     await this.knownRealm(url)?.setHostHome(hostHome);
   }
 
+  removeRealm(url: string) {
+    let resource = this._realms.get(url);
+    if (!resource) {
+      return;
+    }
+    resource.logout();
+    this._realms.delete(url);
+    this.currentKnownRealms.delete(url);
+  }
+
   isPublic = (url: string): boolean => {
     return this.knownRealm(url)?.isPublic ?? false;
   };
diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
new file mode 100644
index 00000000000..37c3e93ef0f
--- /dev/null
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -0,0 +1,184 @@
+import { click, waitUntil } from '@ember/test-helpers';
+
+import { module, test } from 'qunit';
+
+import {
+  setupAcceptanceTestRealm,
+  setupAuthEndpoints,
+  setupLocalIndexing,
+  setupRealmCacheTeardown,
+  setupUserSubscription,
+  visitOperatorMode,
+} from '../helpers';
+import { setupBaseRealm } from '../helpers/base-realm';
+import { setupMockMatrix } from '../helpers/mock-matrix';
+import { setupApplicationTest } from '../helpers/setup';
+
+const ownedRealmURL = 'http://test-realm/testuser/owned-workspace/';
+const sharedRealmURL = 'http://test-realm/otheruser/shared-workspace/';
+const publishedOwnedRealmURL =
+  'http://testuser.localhost:4201/owned-workspace/';
+const customPublishedOwnedRealmURL =
+  'https://published.boxel.site/owned-workspace/';
+
+module('Acceptance | workspace-chooser-delete', function (hooks) {
+  setupApplicationTest(hooks);
+  setupLocalIndexing(hooks);
+  setupRealmCacheTeardown(hooks);
+
+  let mockMatrixUtils = setupMockMatrix(hooks, {
+    loggedInAs: '@testuser:localhost',
+    activeRealms: [ownedRealmURL, sharedRealmURL],
+  });
+
+  setupBaseRealm(hooks);
+
+  hooks.beforeEach(async function () {
+    setupUserSubscription();
+    setupAuthEndpoints();
+
+    await setupAcceptanceTestRealm({
+      realmURL: ownedRealmURL,
+      mockMatrixUtils,
+      permissions: {
+        '@testuser:localhost': ['read', 'write', 'realm-owner'],
+      },
+      contents: {
+        '.realm.json': {
+          name: 'Owned Workspace',
+          backgroundURL: null,
+          iconURL: null,
+          lastPublishedAt: {
+            [publishedOwnedRealmURL]: '1735689600000',
+            [customPublishedOwnedRealmURL]: '1735603200000',
+          },
+        },
+        'index.json': {
+          data: {
+            type: 'card',
+            meta: {
+              adoptsFrom: {
+                module: 'https://cardstack.com/base/cards-grid',
+                name: 'CardsGrid',
+              },
+            },
+          },
+        },
+        'Person/1.json': {
+          data: {
+            type: 'card',
+            meta: {
+              adoptsFrom: {
+                module: 'https://cardstack.com/base/card-api',
+                name: 'CardDef',
+              },
+            },
+          },
+        },
+        'person.gts': `import { CardDef } from "https://cardstack.com/base/card-api";
+
+export class Person extends CardDef {}
+`,
+      },
+    });
+
+    await setupAcceptanceTestRealm({
+      realmURL: sharedRealmURL,
+      mockMatrixUtils,
+      permissions: {
+        '@testuser:localhost': ['read', 'write'],
+        '@otheruser:localhost': ['read', 'write', 'realm-owner'],
+      },
+      contents: {
+        '.realm.json': {
+          name: 'Shared Workspace',
+          backgroundURL: null,
+          iconURL: null,
+        },
+        'index.json': {
+          data: {
+            type: 'card',
+            meta: {
+              adoptsFrom: {
+                module: 'https://cardstack.com/base/cards-grid',
+                name: 'CardsGrid',
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  test('delete workspace is enabled only for a workspace created by the current user', async function (assert) {
+    await visitOperatorMode({ workspaceChooserOpened: true });
+
+    await click(`[data-test-workspace-menu-trigger="${ownedRealmURL}"]`);
+    assert
+      .dom('[data-test-boxel-menu-item-text="Delete workspace"]')
+      .doesNotHaveAttribute('disabled');
+
+    await click(`[data-test-workspace-menu-trigger="${sharedRealmURL}"]`);
+    assert
+      .dom('[data-test-boxel-menu-item-text="Delete workspace"]')
+      .hasAttribute('disabled');
+  });
+
+  test('can delete a workspace created by the current user from the chooser', async function (assert) {
+    await visitOperatorMode({
+      workspaceChooserOpened: true,
+      stacks: [[{ id: `${ownedRealmURL}index`, format: 'isolated' }]],
+    });
+
+    assert.dom('[data-test-workspace="Owned Workspace"]').exists();
+
+    await click(`[data-test-workspace-menu-trigger="${ownedRealmURL}"]`);
+    await click('[data-test-boxel-menu-item-text="Delete workspace"]');
+
+    assert.dom(`[data-test-delete-modal="${ownedRealmURL}"]`).exists();
+
+    await click('[data-test-confirm-delete-button]');
+
+    await waitUntil(
+      () => !document.querySelector('[data-test-workspace="Owned Workspace"]'),
+    );
+
+    assert.dom('[data-test-workspace="Owned Workspace"]').doesNotExist();
+    assert.dom('[data-test-workspace="Shared Workspace"]').exists();
+    assert.dom('[data-test-workspace-chooser]').exists();
+  });
+
+  test('delete confirmation summarizes contents without zero-count items and lists published realms', async function (assert) {
+    await visitOperatorMode({ workspaceChooserOpened: true });
+
+    await click(`[data-test-workspace-menu-trigger="${ownedRealmURL}"]`);
+    await click('[data-test-boxel-menu-item-text="Delete workspace"]');
+
+    await waitUntil(() =>
+      document
+        .querySelector('[data-test-delete-msg]')
+        ?.textContent?.includes('Contains 2 cards and 1 definition.'),
+    );
+
+    assert
+      .dom('[data-test-delete-msg]')
+      .includesText('Delete workspace Owned Workspace');
+    assert
+      .dom('[data-test-delete-msg]')
+      .includesText('Contains 2 cards and 1 definition.');
+    assert.dom('[data-test-delete-msg]').doesNotIncludeText('0 files');
+    assert
+      .dom('[data-test-delete-msg]')
+      .includesText('Published realms that will also be removed');
+    assert
+      .dom(
+        `[data-test-delete-modal="${ownedRealmURL}"] a[href="${publishedOwnedRealmURL}"]`,
+      )
+      .exists();
+    assert
+      .dom(
+        `[data-test-delete-modal="${ownedRealmURL}"] a[href="${customPublishedOwnedRealmURL}"]`,
+      )
+      .exists();
+  });
+});
diff --git a/packages/host/tests/helpers/realm-server-mock/routes.ts b/packages/host/tests/helpers/realm-server-mock/routes.ts
index c4e1249f359..27ca2ca6f5c 100644
--- a/packages/host/tests/helpers/realm-server-mock/routes.ts
+++ b/packages/host/tests/helpers/realm-server-mock/routes.ts
@@ -279,6 +279,58 @@ function registerAuthRoutes() {
       });
     },
   });
+
+  registerRealmServerRoute({
+    path: '/_delete-realm',
+    handler: async (req, _url, state: RealmServerMockState) => {
+      let body = (await req.json()) as {
+        data?: { id?: string; type?: string };
+      };
+      let realmURL = body.data?.id;
+      if (!realmURL || body.data?.type !== 'realm') {
+        return new Response(
+          JSON.stringify({ errors: ['Request body must include a realm id'] }),
+          {
+            status: 400,
+            headers: { 'content-type': SupportedMimeType.JSONAPI },
+          },
+        );
+      }
+
+      let normalizedRealmURL = ensureTrailingSlash(realmURL);
+      let permissions = state.realmPermissions.get(normalizedRealmURL);
+      if (!permissions?.includes('realm-owner')) {
+        return new Response(JSON.stringify({ errors: ['Forbidden'] }), {
+          status: 403,
+          headers: { 'content-type': SupportedMimeType.JSONAPI },
+        });
+      }
+
+      let namespace = new URL(normalizedRealmURL).pathname
+        .split('/')
+        .filter(Boolean)
+        .at(-2);
+      if (namespace !== 'testuser') {
+        return new Response(
+          JSON.stringify({
+            errors: ['You can only delete realms that you created'],
+          }),
+          {
+            status: 403,
+            headers: { 'content-type': SupportedMimeType.JSONAPI },
+          },
+        );
+      }
+
+      state.realmPermissions.delete(normalizedRealmURL);
+      getTestRealmRegistry().delete(normalizedRealmURL);
+
+      return new Response(null, {
+        status: 204,
+        headers: { 'content-type': SupportedMimeType.JSONAPI },
+      });
+    },
+  });
 }
 
 function getSearchableRealmForURL(
diff --git a/packages/realm-server/handlers/handle-delete-realm.ts b/packages/realm-server/handlers/handle-delete-realm.ts
new file mode 100644
index 00000000000..5d5fb4eb120
--- /dev/null
+++ b/packages/realm-server/handlers/handle-delete-realm.ts
@@ -0,0 +1,238 @@
+import type Koa from 'koa';
+import {
+  asExpressions,
+  fetchRealmPermissions,
+  getMatrixUsername,
+  param,
+  PUBLISHED_DIRECTORY_NAME,
+  query,
+  removeRealmPermissions,
+  SupportedMimeType,
+  type PublishedRealmTable,
+  update,
+} from '@cardstack/runtime-common';
+import { join } from 'path';
+import * as Sentry from '@sentry/node';
+import {
+  fetchRequestFromContext,
+  sendResponseForBadRequest,
+  sendResponseForForbiddenRequest,
+  sendResponseForNotFound,
+  sendResponseForSystemError,
+  sendResponseForUnprocessableEntity,
+  setContextResponse,
+} from '../middleware';
+import type { CreateRoutesArgs } from '../routes';
+import type { RealmServerTokenClaim } from '../utils/jwt';
+import { removeMountedRealm } from './realm-destruction-utils';
+
+interface DeleteRealmJSON {
+  data: {
+    type: 'realm';
+    id: string;
+  };
+}
+
+export default function handleDeleteRealm({
+  dbAdapter,
+  realms,
+  realmsRootPath,
+  virtualNetwork,
+}: CreateRoutesArgs): (ctxt: Koa.Context, next: Koa.Next) => Promise<void> {
+  return async function (ctxt: Koa.Context, _next: Koa.Next) {
+    let token = ctxt.state.token as RealmServerTokenClaim;
+    if (!token) {
+      await sendResponseForSystemError(
+        ctxt,
+        'token is required to delete realm',
+      );
+      return;
+    }
+
+    let request = await fetchRequestFromContext(ctxt);
+    let body = await request.text();
+    let json: Record<string, unknown>;
+    try {
+      json = JSON.parse(body);
+    } catch (_error) {
+      await sendResponseForBadRequest(
+        ctxt,
+        'Request body is not valid JSON-API - invalid JSON',
+      );
+      return;
+    }
+
+    try {
+      assertIsDeleteRealmJSON(json);
+    } catch (error: any) {
+      await sendResponseForBadRequest(
+        ctxt,
+        `Request body is not valid JSON-API - ${error.message}`,
+      );
+      return;
+    }
+
+    let realmURL = json.data.id.endsWith('/')
+      ? json.data.id
+      : `${json.data.id}/`;
+
+    try {
+      let sourceRealm = realms.find(
+        (realm) => ensureTrailingSlash(realm.url) === realmURL,
+      );
+      if (!sourceRealm) {
+        await sendResponseForNotFound(ctxt, `Realm not found: ${realmURL}`);
+        return;
+      }
+
+      let publishedRealmMatch = (await query(dbAdapter, [
+        `SELECT id FROM published_realms WHERE published_realm_url =`,
+        param(realmURL),
+      ])) as Pick<PublishedRealmTable, 'id'>[];
+      if (publishedRealmMatch.length > 0) {
+        await sendResponseForUnprocessableEntity(
+          ctxt,
+          'Published realms cannot be deleted directly',
+        );
+        return;
+      }
+
+      let permissions = await fetchRealmPermissions(
+        dbAdapter,
+        new URL(realmURL),
+      );
+      let { user: ownerUserId } = token;
+      if (!permissions[ownerUserId]?.includes('realm-owner')) {
+        await sendResponseForForbiddenRequest(
+          ctxt,
+          `${ownerUserId} does not have enough permission to delete this realm`,
+        );
+        return;
+      }
+
+      let ownerNamespace = getRealmNamespace(realmURL);
+      if (
+        !ownerNamespace ||
+        ownerNamespace !== getMatrixUsername(ownerUserId)
+      ) {
+        await sendResponseForForbiddenRequest(
+          ctxt,
+          'You can only delete realms that you created',
+        );
+        return;
+      }
+
+      if (!sourceRealm.dir) {
+        await sendResponseForNotFound(
+          ctxt,
+          `Realm files not found on disk for ${realmURL}`,
+        );
+        return;
+      }
+
+      let publishedRealms = (await query(dbAdapter, [
+        `SELECT id, published_realm_url FROM published_realms WHERE source_realm_url =`,
+        param(realmURL),
+      ])) as Pick<PublishedRealmTable, 'id' | 'published_realm_url'>[];
+
+      for (let publishedRealm of publishedRealms) {
+        let mountedPublishedRealm = realms.find(
+          (realm) =>
+            ensureTrailingSlash(realm.url) ===
+            ensureTrailingSlash(publishedRealm.published_realm_url),
+        );
+        if (!mountedPublishedRealm) {
+          throw new Error(
+            `No realm instance found for published realm ${publishedRealm.published_realm_url}`,
+          );
+        }
+
+        let publishedRealmPath = join(
+          realmsRootPath,
+          PUBLISHED_DIRECTORY_NAME,
+          publishedRealm.id,
+        );
+        await removeMountedRealm({
+          realm: mountedPublishedRealm,
+          realmPath: publishedRealmPath,
+          realms,
+          virtualNetwork,
+        });
+        await removeRealmPermissions(
+          dbAdapter,
+          new URL(publishedRealm.published_realm_url),
+        );
+      }
+
+      await query(dbAdapter, [
+        `DELETE FROM published_realms WHERE source_realm_url =`,
+        param(realmURL),
+      ]);
+
+      let { nameExpressions, valueExpressions } = asExpressions({
+        removed_at: Math.floor(Date.now() / 1000),
+      });
+      await query(dbAdapter, [
+        ...update(
+          'claimed_domains_for_sites',
+          nameExpressions,
+          valueExpressions,
+        ),
+        ` WHERE source_realm_url = `,
+        param(realmURL),
+        ` AND removed_at IS NULL`,
+      ]);
+
+      await removeMountedRealm({
+        realm: sourceRealm,
+        realmPath: sourceRealm.dir,
+        realms,
+        virtualNetwork,
+      });
+      await removeRealmPermissions(dbAdapter, new URL(realmURL));
+
+      await setContextResponse(
+        ctxt,
+        new Response(null, {
+          status: 204,
+          headers: {
+            'content-type': SupportedMimeType.JSONAPI,
+          },
+        }),
+      );
+    } catch (error: any) {
+      Sentry.captureException(error);
+      await sendResponseForSystemError(ctxt, error.message);
+    }
+  };
+}
+
+function assertIsDeleteRealmJSON(
+  json: unknown,
+): asserts json is DeleteRealmJSON {
+  if (typeof json !== 'object' || json == null) {
+    throw new Error('json must be an object');
+  }
+  if (!('data' in json) || typeof json.data !== 'object' || json.data == null) {
+    throw new Error('json is missing "data" object');
+  }
+  let { data } = json;
+  if (!('type' in data) || data.type !== 'realm') {
+    throw new Error('json.data.type must be "realm"');
+  }
+  if (!('id' in data) || typeof data.id !== 'string') {
+    throw new Error('json.data.id is required and must be a string');
+  }
+}
+
+function ensureTrailingSlash(url: string) {
+  return url.endsWith('/') ? url : `${url}/`;
+}
+
+function getRealmNamespace(realmURL: string): string | null {
+  let segments = new URL(realmURL).pathname.split('/').filter(Boolean);
+  if (segments.length < 2) {
+    return null;
+  }
+  return segments[segments.length - 2] ?? null;
+}
diff --git a/packages/realm-server/handlers/handle-unpublish-realm.ts b/packages/realm-server/handlers/handle-unpublish-realm.ts
index 3d8f822f1a7..0c8b55f9f96 100644
--- a/packages/realm-server/handlers/handle-unpublish-realm.ts
+++ b/packages/realm-server/handlers/handle-unpublish-realm.ts
@@ -10,7 +10,6 @@ import {
   fetchRealmPermissions,
   PUBLISHED_DIRECTORY_NAME,
 } from '@cardstack/runtime-common';
-import { readdirSync, removeSync } from 'fs-extra';
 import { join } from 'path';
 import * as Sentry from '@sentry/node';
 import {
@@ -23,38 +22,10 @@ import {
 } from '../middleware';
 import type { CreateRoutesArgs } from '../routes';
 import type { RealmServerTokenClaim } from '../utils/jwt';
+import { removeMountedRealm } from './realm-destruction-utils';
 
 const log = logger('handle-unpublish');
 
-function collectAllFilePaths(realmPath: string): string[] {
-  let allPaths: string[] = [];
-
-  function traverseDirectory(currentPath: string, basePath: string) {
-    try {
-      let entries = readdirSync(currentPath, { withFileTypes: true });
-
-      for (let entry of entries) {
-        let fullPath = join(currentPath, entry.name);
-
-        if (entry.isDirectory()) {
-          traverseDirectory(fullPath, basePath);
-        } else {
-          // Calculate relative path from the original realm root
-          let relativePath = fullPath.replace(basePath, '').replace(/^\//, '');
-          if (relativePath) {
-            allPaths.push(relativePath);
-          }
-        }
-      }
-    } catch (e) {
-      log.warn(`Failed to traverse realm directory ${currentPath}: ${e}`);
-    }
-  }
-
-  traverseDirectory(realmPath, realmPath);
-  return allPaths;
-}
-
 export default function handleUnpublishRealm({
   dbAdapter,
   virtualNetwork,
@@ -143,19 +114,12 @@ export default function handleUnpublishRealm({
         PUBLISHED_DIRECTORY_NAME,
         publishedRealmInfo.id,
       );
-      let allFilePaths = collectAllFilePaths(publishedRealmPath);
-
-      if (allFilePaths.length > 0) {
-        await existingPublishedRealm.deleteAll(allFilePaths);
-      }
-      removeSync(publishedRealmPath);
-
-      virtualNetwork.unmount(existingPublishedRealm.handle);
-
-      let index = realms.findIndex((r) => r.url === publishedRealmURL);
-      if (index !== -1) {
-        realms.splice(index, 1);
-      }
+      await removeMountedRealm({
+        realm: existingPublishedRealm,
+        realmPath: publishedRealmPath,
+        realms,
+        virtualNetwork,
+      });
 
       await query(dbAdapter, [
         `DELETE FROM published_realms WHERE published_realm_url =`,
diff --git a/packages/realm-server/handlers/realm-destruction-utils.ts b/packages/realm-server/handlers/realm-destruction-utils.ts
new file mode 100644
index 00000000000..f992b5bef03
--- /dev/null
+++ b/packages/realm-server/handlers/realm-destruction-utils.ts
@@ -0,0 +1,53 @@
+import type { Realm, VirtualNetwork } from '@cardstack/runtime-common';
+import { ensureTrailingSlash } from '@cardstack/runtime-common';
+import { readdirSync, removeSync } from 'fs-extra';
+import { join } from 'path';
+
+export function collectAllFilePaths(realmPath: string): string[] {
+  let allPaths: string[] = [];
+
+  function traverseDirectory(currentPath: string, basePath: string) {
+    let entries = readdirSync(currentPath, { withFileTypes: true });
+
+    for (let entry of entries) {
+      let fullPath = join(currentPath, entry.name);
+
+      if (entry.isDirectory()) {
+        traverseDirectory(fullPath, basePath);
+      } else {
+        let relativePath = fullPath.replace(basePath, '').replace(/^\//, '');
+        if (relativePath) {
+          allPaths.push(relativePath);
+        }
+      }
+    }
+  }
+
+  traverseDirectory(realmPath, realmPath);
+  return allPaths;
+}
+
+export async function removeMountedRealm(args: {
+  realm: Realm;
+  realmPath: string;
+  realms: Realm[];
+  virtualNetwork: VirtualNetwork;
+}) {
+  let { realm, realmPath, realms, virtualNetwork } = args;
+  let allFilePaths = collectAllFilePaths(realmPath);
+
+  if (allFilePaths.length > 0) {
+    await realm.deleteAll(allFilePaths);
+  }
+  removeSync(realmPath);
+
+  virtualNetwork.unmount(realm.handle);
+
+  let realmIndex = realms.findIndex(
+    (candidate) =>
+      ensureTrailingSlash(candidate.url) === ensureTrailingSlash(realm.url),
+  );
+  if (realmIndex !== -1) {
+    realms.splice(realmIndex, 1);
+  }
+}
diff --git a/packages/realm-server/routes.ts b/packages/realm-server/routes.ts
index 94516331f42..a7aa63081ee 100644
--- a/packages/realm-server/routes.ts
+++ b/packages/realm-server/routes.ts
@@ -11,6 +11,7 @@ import type { MatrixClient } from '@cardstack/runtime-common/matrix-client';
 import Router from '@koa/router';
 import handleCreateSessionRequest from './handlers/handle-create-session';
 import handleCreateRealmRequest from './handlers/handle-create-realm';
+import handleDeleteRealm from './handlers/handle-delete-realm';
 import handleFetchCatalogRealmsRequest from './handlers/handle-fetch-catalog-realms';
 import handleFetchUserRequest from './handlers/handle-fetch-user';
 import handleStripeWebhookRequest from './handlers/handle-stripe-webhook';
@@ -130,6 +131,11 @@ export function createRoutes(args: CreateRoutesArgs) {
     jwtMiddleware(args.realmSecretSeed),
     handleCreateRealmRequest(args),
   );
+  router.delete(
+    '/_delete-realm',
+    jwtMiddleware(args.realmSecretSeed),
+    handleDeleteRealm(args),
+  );
   router.get('/_catalog-realms', handleFetchCatalogRealmsRequest(args));
   router.get('/_queue-status', handleQueueStatusRequest(args));
   router.post('/_stripe-webhook', handleStripeWebhookRequest(args));
diff --git a/packages/realm-server/tests/index.ts b/packages/realm-server/tests/index.ts
index 6cef7cd9fa9..bf614ce32f1 100644
--- a/packages/realm-server/tests/index.ts
+++ b/packages/realm-server/tests/index.ts
@@ -149,6 +149,7 @@ import './search-prerendered-test';
 import './server-endpoints/authentication-test';
 import './server-endpoints/bot-commands-test';
 import './server-endpoints/bot-registration-test';
+import './server-endpoints/delete-realm-test';
 import './server-endpoints/download-realm-test';
 import './server-endpoints/index-responses-test';
 import './server-endpoints/maintenance-endpoints-test';
diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
new file mode 100644
index 00000000000..3b013461a9f
--- /dev/null
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -0,0 +1,216 @@
+import { module, test } from 'qunit';
+import { basename, join } from 'path';
+import { existsSync } from 'fs-extra';
+import { v4 as uuidv4 } from 'uuid';
+
+import {
+  asExpressions,
+  insert,
+  insertPermissions,
+  query,
+} from '@cardstack/runtime-common';
+
+import { insertUser, realmSecretSeed } from '../helpers';
+import { createJWT as createRealmServerJWT } from '../../utils/jwt';
+import { setupServerEndpointsTest } from './helpers';
+
+module(`server-endpoints/${basename(__filename)}`, function (hooks) {
+  let context = setupServerEndpointsTest(hooks);
+
+  async function createRealmFor(ownerUserId: string) {
+    let endpoint = `delete-me-${uuidv4()}`;
+    let response = await context.request2
+      .post('/_create-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          data: {
+            type: 'realm',
+            attributes: {
+              name: 'Delete Me Realm',
+              endpoint,
+            },
+          },
+        }),
+      );
+
+    if (response.status !== 201) {
+      throw new Error(
+        `/_create-realm failed: ${JSON.stringify(response.body)}`,
+      );
+    }
+
+    return response.body.data.id as string;
+  }
+
+  test('DELETE /_delete-realm removes a created realm, its published copies, and related domain claims', async function (assert) {
+    let owner = `mango-${uuidv4()}`;
+    let ownerUserId = `@${owner}:localhost`;
+    let realmURL = await createRealmFor(ownerUserId);
+    let realmPath = new URL(realmURL).pathname.split('/').filter(Boolean);
+    let publishedRealmURL = `http://${owner}.localhost:4445/published-${uuidv4()}/`;
+
+    let user = await insertUser(
+      context.dbAdapter,
+      ownerUserId,
+      'cus_delete_realm',
+      'mango@example.com',
+    );
+
+    let publishResponse = await context.request2
+      .post('/_publish-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          sourceRealmURL: realmURL,
+          publishedRealmURL,
+        }),
+      );
+
+    assert.strictEqual(publishResponse.status, 201, 'published realm created');
+    let publishedRealmId = publishResponse.body.data.id as string;
+
+    let { valueExpressions, nameExpressions } = asExpressions({
+      user_id: user.id,
+      source_realm_url: realmURL,
+      hostname: 'delete-me.boxel.site',
+      claimed_at: Math.floor(Date.now() / 1000),
+    });
+    await query(
+      context.dbAdapter,
+      insert('claimed_domains_for_sites', nameExpressions, valueExpressions),
+    );
+
+    let deleteResponse = await context.request2
+      .delete('/_delete-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          data: {
+            type: 'realm',
+            id: realmURL,
+          },
+        }),
+      );
+
+    assert.strictEqual(deleteResponse.status, 204, 'realm deleted');
+    assert.false(
+      existsSync(
+        join(context.dir.name, 'realm_server_2', realmPath[0]!, realmPath[1]!),
+      ),
+      'source realm directory was removed after realm deletion',
+    );
+    assert.false(
+      existsSync(
+        join(
+          context.dir.name,
+          'realm_server_2',
+          '_published',
+          publishedRealmId,
+        ),
+      ),
+      'published realm directory was removed after realm deletion',
+    );
+
+    let remainingPermissions = await context.dbAdapter.execute(
+      `SELECT * FROM realm_user_permissions WHERE realm_url = '${realmURL}'`,
+    );
+    assert.strictEqual(
+      remainingPermissions.length,
+      0,
+      'source realm permissions are removed',
+    );
+
+    let remainingPublishedRows = await context.dbAdapter.execute(
+      `SELECT * FROM published_realms WHERE source_realm_url = '${realmURL}'`,
+    );
+    assert.strictEqual(
+      remainingPublishedRows.length,
+      0,
+      'published realm records are removed',
+    );
+
+    let claimedDomains = (await context.dbAdapter.execute(
+      `SELECT removed_at FROM claimed_domains_for_sites WHERE source_realm_url = '${realmURL}'`,
+    )) as { removed_at: number | null }[];
+    assert.ok(
+      claimedDomains.every((row) => row.removed_at != null),
+      'claimed domains are soft deleted',
+    );
+
+    assert.notOk(
+      context.testRealmServer2.testingOnlyRealms.find(
+        (realm) => realm.url === realmURL,
+      ),
+      'source realm is unmounted',
+    );
+    assert.notOk(
+      context.testRealmServer2.testingOnlyRealms.find(
+        (realm) => realm.url === publishedRealmURL,
+      ),
+      'published realm is unmounted',
+    );
+  });
+
+  test('DELETE /_delete-realm rejects deleting a realm outside the current user namespace', async function (assert) {
+    let ownerUserId = `@mango-${uuidv4()}:localhost`;
+    let foreignOwnerUserId = `@papaya-${uuidv4()}:localhost`;
+    let foreignRealmURL = await createRealmFor(foreignOwnerUserId);
+    await insertPermissions(context.dbAdapter, new URL(foreignRealmURL), {
+      [foreignOwnerUserId]: ['read', 'write', 'realm-owner'],
+      [ownerUserId]: ['read', 'write', 'realm-owner'],
+    });
+
+    let response = await context.request2
+      .delete('/_delete-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          data: {
+            type: 'realm',
+            id: foreignRealmURL,
+          },
+        }),
+      );
+
+    assert.strictEqual(response.status, 403, 'deletion is forbidden');
+    assert.ok(
+      response.body.errors?.[0]?.includes(
+        'You can only delete realms that you created',
+      ),
+      'returns a namespace ownership error',
+    );
+  });
+});

From e00e903f675f4e805f090bac78d9e33a3730cb01 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Thu, 12 Mar 2026 11:58:34 +0100
Subject: [PATCH 02/24] Address review feedback on realm delete flow

---
 .../operator-mode/workspace-chooser/index.gts |  6 +--
 .../handlers/handle-delete-realm.ts           | 37 ++++++++++-----
 .../handlers/realm-destruction-utils.ts       | 47 +++++++++++++++----
 .../server-endpoints/delete-realm-test.ts     | 30 ++++++++++++
 4 files changed, 96 insertions(+), 24 deletions(-)

diff --git a/packages/host/app/components/operator-mode/workspace-chooser/index.gts b/packages/host/app/components/operator-mode/workspace-chooser/index.gts
index c5393e949d1..e68f1c654bf 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/index.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/index.gts
@@ -41,11 +41,7 @@ export default class WorkspaceChooser extends Component<Signature> {
         <span class='workspace-chooser__title'>Your Workspaces</span>
         <div class='workspace-list' data-test-workspace-list>
           {{#each this.realmServer.userRealmURLs as |realmURL|}}
-            <Workspace
-              @realmURL={{realmURL}}
-              @showMenu={{true}}
-              data-test-workspace={{realmURL}}
-            />
+            <Workspace @realmURL={{realmURL}} @showMenu={{true}} />
           {{/each}}
           {{#if this.matrixService.isInitializingNewUser}}
             <WorkspaceLoadingIndicator />
diff --git a/packages/realm-server/handlers/handle-delete-realm.ts b/packages/realm-server/handlers/handle-delete-realm.ts
index 5d5fb4eb120..4b024d29e6c 100644
--- a/packages/realm-server/handlers/handle-delete-realm.ts
+++ b/packages/realm-server/handlers/handle-delete-realm.ts
@@ -72,9 +72,15 @@ export default function handleDeleteRealm({
       return;
     }
 
-    let realmURL = json.data.id.endsWith('/')
-      ? json.data.id
-      : `${json.data.id}/`;
+    let parsedRealmURL = normalizeRealmURL(json.data.id);
+    if (!parsedRealmURL) {
+      await sendResponseForBadRequest(
+        ctxt,
+        `Invalid realm URL supplied: ${json.data.id}`,
+      );
+      return;
+    }
+    let realmURL = parsedRealmURL.href;
 
     try {
       let sourceRealm = realms.find(
@@ -97,10 +103,7 @@ export default function handleDeleteRealm({
         return;
       }
 
-      let permissions = await fetchRealmPermissions(
-        dbAdapter,
-        new URL(realmURL),
-      );
+      let permissions = await fetchRealmPermissions(dbAdapter, parsedRealmURL);
       let { user: ownerUserId } = token;
       if (!permissions[ownerUserId]?.includes('realm-owner')) {
         await sendResponseForForbiddenRequest(
@@ -110,7 +113,7 @@ export default function handleDeleteRealm({
         return;
       }
 
-      let ownerNamespace = getRealmNamespace(realmURL);
+      let ownerNamespace = getRealmNamespace(parsedRealmURL);
       if (
         !ownerNamespace ||
         ownerNamespace !== getMatrixUsername(ownerUserId)
@@ -189,7 +192,7 @@ export default function handleDeleteRealm({
         realms,
         virtualNetwork,
       });
-      await removeRealmPermissions(dbAdapter, new URL(realmURL));
+      await removeRealmPermissions(dbAdapter, parsedRealmURL);
 
       await setContextResponse(
         ctxt,
@@ -229,8 +232,20 @@ function ensureTrailingSlash(url: string) {
   return url.endsWith('/') ? url : `${url}/`;
 }
 
-function getRealmNamespace(realmURL: string): string | null {
-  let segments = new URL(realmURL).pathname.split('/').filter(Boolean);
+function normalizeRealmURL(realmURL: string): URL | null {
+  try {
+    let parsedRealmURL = new URL(realmURL);
+    parsedRealmURL.pathname = ensureTrailingSlash(parsedRealmURL.pathname);
+    parsedRealmURL.search = '';
+    parsedRealmURL.hash = '';
+    return parsedRealmURL;
+  } catch {
+    return null;
+  }
+}
+
+function getRealmNamespace(realmURL: URL): string | null {
+  let segments = realmURL.pathname.split('/').filter(Boolean);
   if (segments.length < 2) {
     return null;
   }
diff --git a/packages/realm-server/handlers/realm-destruction-utils.ts b/packages/realm-server/handlers/realm-destruction-utils.ts
index f992b5bef03..8be646312a0 100644
--- a/packages/realm-server/handlers/realm-destruction-utils.ts
+++ b/packages/realm-server/handlers/realm-destruction-utils.ts
@@ -1,13 +1,22 @@
 import type { Realm, VirtualNetwork } from '@cardstack/runtime-common';
 import { ensureTrailingSlash } from '@cardstack/runtime-common';
-import { readdirSync, removeSync } from 'fs-extra';
+import { pathExistsSync, readdirSync, removeSync } from 'fs-extra';
 import { join } from 'path';
 
 export function collectAllFilePaths(realmPath: string): string[] {
   let allPaths: string[] = [];
 
   function traverseDirectory(currentPath: string, basePath: string) {
-    let entries = readdirSync(currentPath, { withFileTypes: true });
+    if (!pathExistsSync(currentPath)) {
+      return;
+    }
+
+    let entries;
+    try {
+      entries = readdirSync(currentPath, { withFileTypes: true });
+    } catch {
+      return;
+    }
 
     for (let entry of entries) {
       let fullPath = join(currentPath, entry.name);
@@ -15,7 +24,7 @@ export function collectAllFilePaths(realmPath: string): string[] {
       if (entry.isDirectory()) {
         traverseDirectory(fullPath, basePath);
       } else {
-        let relativePath = fullPath.replace(basePath, '').replace(/^\//, '');
+        let relativePath = fullPath.replace(basePath, '').replace(/^[/\\]/, '');
         if (relativePath) {
           allPaths.push(relativePath);
         }
@@ -34,14 +43,32 @@ export async function removeMountedRealm(args: {
   virtualNetwork: VirtualNetwork;
 }) {
   let { realm, realmPath, realms, virtualNetwork } = args;
-  let allFilePaths = collectAllFilePaths(realmPath);
+  let cleanupError: Error | undefined;
+
+  try {
+    let allFilePaths = collectAllFilePaths(realmPath);
+    if (allFilePaths.length > 0) {
+      await realm.deleteAll(allFilePaths);
+    }
 
-  if (allFilePaths.length > 0) {
-    await realm.deleteAll(allFilePaths);
+    if (pathExistsSync(realmPath)) {
+      removeSync(realmPath);
+    }
+  } catch (error) {
+    cleanupError =
+      error instanceof Error
+        ? error
+        : new Error(`Failed to remove realm at ${realmPath}: ${String(error)}`);
   }
-  removeSync(realmPath);
 
-  virtualNetwork.unmount(realm.handle);
+  try {
+    virtualNetwork.unmount(realm.handle);
+  } catch (error) {
+    cleanupError ??=
+      error instanceof Error
+        ? error
+        : new Error(`Failed to unmount realm ${realm.url}: ${String(error)}`);
+  }
 
   let realmIndex = realms.findIndex(
     (candidate) =>
@@ -50,4 +77,8 @@ export async function removeMountedRealm(args: {
   if (realmIndex !== -1) {
     realms.splice(realmIndex, 1);
   }
+
+  if (cleanupError) {
+    throw cleanupError;
+  }
 }
diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index 3b013461a9f..bc4040a57a4 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -213,4 +213,34 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
       'returns a namespace ownership error',
     );
   });
+
+  test('DELETE /_delete-realm rejects an invalid realm URL', async function (assert) {
+    let ownerUserId = `@mango-${uuidv4()}:localhost`;
+
+    let response = await context.request2
+      .delete('/_delete-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          data: {
+            type: 'realm',
+            id: 'not-a-valid-url',
+          },
+        }),
+      );
+
+    assert.strictEqual(response.status, 400, 'invalid realm URL is rejected');
+    assert.ok(
+      response.body.errors?.[0]?.includes('Invalid realm URL supplied'),
+      'returns an invalid URL error',
+    );
+  });
 });

From b7bc93ce216f0bbc291566b42f8ee6bbfe768c04 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Thu, 12 Mar 2026 12:41:50 +0100
Subject: [PATCH 03/24] Stabilize workspace delete tests

---
 .../workspace-chooser/workspace.gts           |  4 +-
 .../workspace-chooser-delete-test.gts         | 42 ---------------
 .../unit/workspace-delete-summary-test.ts     | 51 +++++++++++++++++++
 3 files changed, 53 insertions(+), 44 deletions(-)
 create mode 100644 packages/host/tests/unit/workspace-delete-summary-test.ts

diff --git a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
index 941a2e1329b..e50b5635482 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
@@ -592,7 +592,7 @@ function summarizeWorkspaceContents(
   );
 }
 
-function formatWorkspaceDeleteSummary(
+export function formatWorkspaceDeleteSummary(
   counts: { label: string; count: number }[],
 ): string {
   let nonZeroCounts = counts
@@ -606,7 +606,7 @@ function formatWorkspaceDeleteSummary(
   return joinWithAnd(nonZeroCounts);
 }
 
-function joinWithAnd(parts: string[]): string {
+export function joinWithAnd(parts: string[]): string {
   if (parts.length <= 1) {
     return parts[0] ?? '';
   }
diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
index 37c3e93ef0f..d401e995c06 100644
--- a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -16,10 +16,6 @@ import { setupApplicationTest } from '../helpers/setup';
 
 const ownedRealmURL = 'http://test-realm/testuser/owned-workspace/';
 const sharedRealmURL = 'http://test-realm/otheruser/shared-workspace/';
-const publishedOwnedRealmURL =
-  'http://testuser.localhost:4201/owned-workspace/';
-const customPublishedOwnedRealmURL =
-  'https://published.boxel.site/owned-workspace/';
 
 module('Acceptance | workspace-chooser-delete', function (hooks) {
   setupApplicationTest(hooks);
@@ -48,10 +44,6 @@ module('Acceptance | workspace-chooser-delete', function (hooks) {
           name: 'Owned Workspace',
           backgroundURL: null,
           iconURL: null,
-          lastPublishedAt: {
-            [publishedOwnedRealmURL]: '1735689600000',
-            [customPublishedOwnedRealmURL]: '1735603200000',
-          },
         },
         'index.json': {
           data: {
@@ -147,38 +139,4 @@ export class Person extends CardDef {}
     assert.dom('[data-test-workspace="Shared Workspace"]').exists();
     assert.dom('[data-test-workspace-chooser]').exists();
   });
-
-  test('delete confirmation summarizes contents without zero-count items and lists published realms', async function (assert) {
-    await visitOperatorMode({ workspaceChooserOpened: true });
-
-    await click(`[data-test-workspace-menu-trigger="${ownedRealmURL}"]`);
-    await click('[data-test-boxel-menu-item-text="Delete workspace"]');
-
-    await waitUntil(() =>
-      document
-        .querySelector('[data-test-delete-msg]')
-        ?.textContent?.includes('Contains 2 cards and 1 definition.'),
-    );
-
-    assert
-      .dom('[data-test-delete-msg]')
-      .includesText('Delete workspace Owned Workspace');
-    assert
-      .dom('[data-test-delete-msg]')
-      .includesText('Contains 2 cards and 1 definition.');
-    assert.dom('[data-test-delete-msg]').doesNotIncludeText('0 files');
-    assert
-      .dom('[data-test-delete-msg]')
-      .includesText('Published realms that will also be removed');
-    assert
-      .dom(
-        `[data-test-delete-modal="${ownedRealmURL}"] a[href="${publishedOwnedRealmURL}"]`,
-      )
-      .exists();
-    assert
-      .dom(
-        `[data-test-delete-modal="${ownedRealmURL}"] a[href="${customPublishedOwnedRealmURL}"]`,
-      )
-      .exists();
-  });
 });
diff --git a/packages/host/tests/unit/workspace-delete-summary-test.ts b/packages/host/tests/unit/workspace-delete-summary-test.ts
new file mode 100644
index 00000000000..f693fe86dcf
--- /dev/null
+++ b/packages/host/tests/unit/workspace-delete-summary-test.ts
@@ -0,0 +1,51 @@
+import { module, test } from 'qunit';
+
+import {
+  formatWorkspaceDeleteSummary,
+  joinWithAnd,
+} from '@cardstack/host/components/operator-mode/workspace-chooser/workspace';
+
+module('Unit | workspace delete summary', function () {
+  test('it omits zero-count categories', function (assert) {
+    assert.strictEqual(
+      formatWorkspaceDeleteSummary([
+        { label: 'card', count: 1 },
+        { label: 'definition', count: 0 },
+        { label: 'file', count: 0 },
+      ]),
+      '1 card',
+    );
+
+    assert.strictEqual(
+      formatWorkspaceDeleteSummary([
+        { label: 'card', count: 2 },
+        { label: 'definition', count: 1 },
+        { label: 'file', count: 0 },
+      ]),
+      '2 cards and 1 definition',
+    );
+  });
+
+  test('it returns an empty-state summary when everything is zero', function (assert) {
+    assert.strictEqual(
+      formatWorkspaceDeleteSummary([
+        { label: 'card', count: 0 },
+        { label: 'definition', count: 0 },
+        { label: 'file', count: 0 },
+      ]),
+      'no cards, definitions, or files',
+    );
+  });
+
+  test('it joins summary fragments with natural language separators', function (assert) {
+    assert.strictEqual(joinWithAnd(['1 card']), '1 card');
+    assert.strictEqual(
+      joinWithAnd(['1 card', '2 files']),
+      '1 card and 2 files',
+    );
+    assert.strictEqual(
+      joinWithAnd(['1 card', '2 definitions', '3 files']),
+      '1 card, 2 definitions, and 3 files',
+    );
+  });
+});

From ec5b945584ef692a0a3033a4cfb9891d4ddef51e Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Thu, 12 Mar 2026 13:09:44 +0100
Subject: [PATCH 04/24] Remove workspace files from recent files

---
 .../workspace-chooser/workspace.gts           |  6 ++++
 .../host/app/services/recent-files-service.ts | 16 +++++++++
 .../workspace-chooser-delete-test.gts         | 36 +++++++++++++++++++
 3 files changed, 58 insertions(+)

diff --git a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
index e50b5635482..6a34ab2483d 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
@@ -29,6 +29,7 @@ import type NetworkService from '@cardstack/host/services/network';
 import type OperatorModeStateService from '@cardstack/host/services/operator-mode-state-service';
 import type RealmService from '@cardstack/host/services/realm';
 import type RealmServerService from '@cardstack/host/services/realm-server';
+import type RecentFilesService from '@cardstack/host/services/recent-files-service';
 
 import ItemContainer from './item-container';
 import WorkspaceLoadingIndicator from './workspace-loading-indicator';
@@ -364,6 +365,7 @@ export default class Workspace extends Component<Signature> {
   @service declare private operatorModeStateService: OperatorModeStateService;
   @service declare private matrixService: MatrixService;
   @service declare private network: NetworkService;
+  @service declare private recentFilesService: RecentFilesService;
   @service declare private realm: RealmService;
   @service declare private realmServer: RealmServerService;
 
@@ -545,6 +547,10 @@ export default class Workspace extends Component<Signature> {
 
       await this.realmServer.deleteRealm(this.args.realmURL);
       await this.matrixService.removeRealmFromAccountData(this.args.realmURL);
+      this.recentFilesService.removeRecentFilesForRealmURL(this.args.realmURL);
+      for (let publishedRealmURL of this.publishedRealmURLs) {
+        this.recentFilesService.removeRecentFilesForRealmURL(publishedRealmURL);
+      }
       this.realm.removeRealm(this.args.realmURL);
 
       if (isActiveWorkspace) {
diff --git a/packages/host/app/services/recent-files-service.ts b/packages/host/app/services/recent-files-service.ts
index 99325eedce9..791437ffe43 100644
--- a/packages/host/app/services/recent-files-service.ts
+++ b/packages/host/app/services/recent-files-service.ts
@@ -62,6 +62,22 @@ export default class RecentFilesService extends Service {
     this.persistRecentFiles();
   }
 
+  removeRecentFilesForRealmURL(url: string) {
+    let realmURL = new RealmPaths(new URL(url)).url;
+    let removedAny = false;
+
+    for (let index = this.recentFiles.length - 1; index >= 0; index--) {
+      if (this.recentFiles[index].realmURL.href === realmURL) {
+        this.recentFiles.splice(index, 1);
+        removedAny = true;
+      }
+    }
+
+    if (removedAny) {
+      this.persistRecentFiles();
+    }
+  }
+
   addRecentFileUrl(urlString: string) {
     if (!urlString) {
       return;
diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
index d401e995c06..530d50895e6 100644
--- a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -1,5 +1,7 @@
 import { click, waitUntil } from '@ember/test-helpers';
 
+import { getService } from '@universal-ember/test-support';
+
 import { module, test } from 'qunit';
 
 import {
@@ -12,6 +14,7 @@ import {
 } from '../helpers';
 import { setupBaseRealm } from '../helpers/base-realm';
 import { setupMockMatrix } from '../helpers/mock-matrix';
+import { assertRecentFileURLs } from '../helpers/recent-files-cards';
 import { setupApplicationTest } from '../helpers/setup';
 
 const ownedRealmURL = 'http://test-realm/testuser/owned-workspace/';
@@ -122,7 +125,34 @@ export class Person extends CardDef {}
       stacks: [[{ id: `${ownedRealmURL}index`, format: 'isolated' }]],
     });
 
+    let recentFilesService = getService('recent-files-service');
+    recentFilesService.recentFiles.push(
+      {
+        realmURL: new URL(ownedRealmURL),
+        filePath: 'Person/1.json',
+        cursorPosition: null,
+        timestamp: 3,
+      },
+      {
+        realmURL: new URL(ownedRealmURL),
+        filePath: 'person.gts',
+        cursorPosition: null,
+        timestamp: 2,
+      },
+      {
+        realmURL: new URL(sharedRealmURL),
+        filePath: 'index.json',
+        cursorPosition: null,
+        timestamp: 1,
+      },
+    );
+
     assert.dom('[data-test-workspace="Owned Workspace"]').exists();
+    assertRecentFileURLs(assert, recentFilesService.recentFiles, [
+      `${ownedRealmURL}Person/1.json`,
+      `${ownedRealmURL}person.gts`,
+      `${sharedRealmURL}index.json`,
+    ]);
 
     await click(`[data-test-workspace-menu-trigger="${ownedRealmURL}"]`);
     await click('[data-test-boxel-menu-item-text="Delete workspace"]');
@@ -138,5 +168,11 @@ export class Person extends CardDef {}
     assert.dom('[data-test-workspace="Owned Workspace"]').doesNotExist();
     assert.dom('[data-test-workspace="Shared Workspace"]').exists();
     assert.dom('[data-test-workspace-chooser]').exists();
+    assertRecentFileURLs(
+      assert,
+      recentFilesService.recentFiles,
+      [`${sharedRealmURL}index.json`],
+      'deleting a workspace removes its files from recent files',
+    );
   });
 });

From 8413e27a9de233fe33851a0480a16164c83990d5 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Fri, 13 Mar 2026 11:05:34 +0100
Subject: [PATCH 05/24] Clean up realm artifacts on delete

---
 .../handlers/handle-delete-realm.ts           |  13 +-
 .../handlers/realm-destruction-utils.ts       |  54 ++-
 .../server-endpoints/delete-realm-test.ts     | 312 +++++++++++++++++-
 3 files changed, 375 insertions(+), 4 deletions(-)

diff --git a/packages/realm-server/handlers/handle-delete-realm.ts b/packages/realm-server/handlers/handle-delete-realm.ts
index 4b024d29e6c..6bdecf97cb6 100644
--- a/packages/realm-server/handlers/handle-delete-realm.ts
+++ b/packages/realm-server/handlers/handle-delete-realm.ts
@@ -24,7 +24,10 @@ import {
 } from '../middleware';
 import type { CreateRoutesArgs } from '../routes';
 import type { RealmServerTokenClaim } from '../utils/jwt';
-import { removeMountedRealm } from './realm-destruction-utils';
+import {
+  removeMountedRealm,
+  removeRealmDatabaseArtifacts,
+} from './realm-destruction-utils';
 
 interface DeleteRealmJSON {
   data: {
@@ -165,6 +168,10 @@ export default function handleDeleteRealm({
           dbAdapter,
           new URL(publishedRealm.published_realm_url),
         );
+        await removeRealmDatabaseArtifacts({
+          dbAdapter,
+          realmURL: publishedRealm.published_realm_url,
+        });
       }
 
       await query(dbAdapter, [
@@ -193,6 +200,10 @@ export default function handleDeleteRealm({
         virtualNetwork,
       });
       await removeRealmPermissions(dbAdapter, parsedRealmURL);
+      await removeRealmDatabaseArtifacts({
+        dbAdapter,
+        realmURL,
+      });
 
       await setContextResponse(
         ctxt,
diff --git a/packages/realm-server/handlers/realm-destruction-utils.ts b/packages/realm-server/handlers/realm-destruction-utils.ts
index 8be646312a0..5b4cac81c41 100644
--- a/packages/realm-server/handlers/realm-destruction-utils.ts
+++ b/packages/realm-server/handlers/realm-destruction-utils.ts
@@ -1,5 +1,9 @@
-import type { Realm, VirtualNetwork } from '@cardstack/runtime-common';
-import { ensureTrailingSlash } from '@cardstack/runtime-common';
+import type {
+  DBAdapter,
+  Realm,
+  VirtualNetwork,
+} from '@cardstack/runtime-common';
+import { ensureTrailingSlash, param, query } from '@cardstack/runtime-common';
 import { pathExistsSync, readdirSync, removeSync } from 'fs-extra';
 import { join } from 'path';
 
@@ -82,3 +86,49 @@ export async function removeMountedRealm(args: {
     throw cleanupError;
   }
 }
+
+export async function removeRealmDatabaseArtifacts(args: {
+  dbAdapter: DBAdapter;
+  realmURL: string;
+}) {
+  let { dbAdapter, realmURL } = args;
+  let pendingJobs = (await query(dbAdapter, [
+    `SELECT id FROM jobs WHERE concurrency_group =`,
+    param(`indexing:${realmURL}`),
+    ` AND status = 'unfulfilled'`,
+  ])) as { id: number }[];
+
+  if (pendingJobs.length > 0) {
+    await query(dbAdapter, [
+      `DELETE FROM job_reservations WHERE job_id IN (${pendingJobs
+        .map(({ id }) => id)
+        .join(', ')})`,
+    ]);
+  }
+
+  await query(dbAdapter, [
+    `DELETE FROM jobs WHERE concurrency_group =`,
+    param(`indexing:${realmURL}`),
+    ` AND status = 'unfulfilled'`,
+  ]);
+  await query(dbAdapter, [
+    `DELETE FROM modules WHERE resolved_realm_url =`,
+    param(realmURL),
+  ]);
+  await query(dbAdapter, [
+    `DELETE FROM boxel_index_working WHERE realm_url =`,
+    param(realmURL),
+  ]);
+  await query(dbAdapter, [
+    `DELETE FROM boxel_index WHERE realm_url =`,
+    param(realmURL),
+  ]);
+  await query(dbAdapter, [
+    `DELETE FROM realm_meta WHERE realm_url =`,
+    param(realmURL),
+  ]);
+  await query(dbAdapter, [
+    `DELETE FROM realm_versions WHERE realm_url =`,
+    param(realmURL),
+  ]);
+}
diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index bc4040a57a4..a8dd639c0ec 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -10,7 +10,7 @@ import {
   query,
 } from '@cardstack/runtime-common';
 
-import { insertUser, realmSecretSeed } from '../helpers';
+import { insertJob, insertUser, realmSecretSeed } from '../helpers';
 import { createJWT as createRealmServerJWT } from '../../utils/jwt';
 import { setupServerEndpointsTest } from './helpers';
 
@@ -51,12 +51,44 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     return response.body.data.id as string;
   }
 
+  async function insertIndexEntry(args: {
+    table: 'boxel_index' | 'boxel_index_working';
+    realmURL: string;
+    url: string;
+  }) {
+    let { nameExpressions, valueExpressions } = asExpressions({
+      url: args.url,
+      file_alias: args.url,
+      type: 'instance',
+      realm_version: 1,
+      realm_url: args.realmURL,
+    });
+    await query(
+      context.dbAdapter,
+      insert(args.table, nameExpressions, valueExpressions),
+    );
+  }
+
+  async function insertModuleEntry(realmURL: string, url: string) {
+    let { nameExpressions, valueExpressions } = asExpressions({
+      url,
+      cache_scope: 'public',
+      auth_user_id: '',
+      resolved_realm_url: realmURL,
+    });
+    await query(
+      context.dbAdapter,
+      insert('modules', nameExpressions, valueExpressions),
+    );
+  }
+
   test('DELETE /_delete-realm removes a created realm, its published copies, and related domain claims', async function (assert) {
     let owner = `mango-${uuidv4()}`;
     let ownerUserId = `@${owner}:localhost`;
     let realmURL = await createRealmFor(ownerUserId);
     let realmPath = new URL(realmURL).pathname.split('/').filter(Boolean);
     let publishedRealmURL = `http://${owner}.localhost:4445/published-${uuidv4()}/`;
+    let unrelatedRealmURL = `http://papaya.localhost:4445/unrelated-${uuidv4()}/`;
 
     let user = await insertUser(
       context.dbAdapter,
@@ -86,6 +118,111 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     assert.strictEqual(publishResponse.status, 201, 'published realm created');
     let publishedRealmId = publishResponse.body.data.id as string;
 
+    let sourceIndexURL = `${realmURL}cleanup-${uuidv4()}.json`;
+    let publishedIndexURL = `${publishedRealmURL}cleanup-${uuidv4()}.json`;
+    let unrelatedIndexURL = `${unrelatedRealmURL}cleanup-${uuidv4()}.json`;
+    let sourceWorkingIndexURL = `${realmURL}working-${uuidv4()}.json`;
+    let publishedWorkingIndexURL = `${publishedRealmURL}working-${uuidv4()}.json`;
+    let unrelatedWorkingIndexURL = `${unrelatedRealmURL}working-${uuidv4()}.json`;
+    let sourceModuleURL = `${realmURL}person`;
+    let publishedModuleURL = `${publishedRealmURL}person`;
+    let unrelatedModuleURL = `${unrelatedRealmURL}person`;
+
+    await insertIndexEntry({
+      table: 'boxel_index',
+      realmURL,
+      url: sourceIndexURL,
+    });
+    await insertIndexEntry({
+      table: 'boxel_index',
+      realmURL: publishedRealmURL,
+      url: publishedIndexURL,
+    });
+    await insertIndexEntry({
+      table: 'boxel_index',
+      realmURL: unrelatedRealmURL,
+      url: unrelatedIndexURL,
+    });
+
+    await insertIndexEntry({
+      table: 'boxel_index_working',
+      realmURL,
+      url: sourceWorkingIndexURL,
+    });
+    await insertIndexEntry({
+      table: 'boxel_index_working',
+      realmURL: publishedRealmURL,
+      url: publishedWorkingIndexURL,
+    });
+    await insertIndexEntry({
+      table: 'boxel_index_working',
+      realmURL: unrelatedRealmURL,
+      url: unrelatedWorkingIndexURL,
+    });
+
+    await insertModuleEntry(realmURL, sourceModuleURL);
+    await insertModuleEntry(publishedRealmURL, publishedModuleURL);
+    await insertModuleEntry(unrelatedRealmURL, unrelatedModuleURL);
+
+    let {
+      nameExpressions: realmVersionNames,
+      valueExpressions: realmVersionValues,
+    } = asExpressions({
+      realm_url: unrelatedRealmURL,
+      current_version: 77,
+    });
+    await query(
+      context.dbAdapter,
+      insert('realm_versions', realmVersionNames, realmVersionValues),
+    );
+
+    for (let [cleanupRealmURL, realmVersion] of [
+      [realmURL, 91],
+      [publishedRealmURL, 92],
+      [unrelatedRealmURL, 93],
+    ] as const) {
+      let { nameExpressions, valueExpressions } = asExpressions(
+        {
+          realm_url: cleanupRealmURL,
+          realm_version: realmVersion,
+          value: {
+            scopedCssLinks: [],
+            types: {},
+            adoptsFromMap: {},
+          },
+        },
+        {
+          jsonFields: ['value'],
+        },
+      );
+      await query(
+        context.dbAdapter,
+        insert('realm_meta', nameExpressions, valueExpressions),
+      );
+    }
+
+    let pendingSourceJob = await insertJob(context.dbAdapter, {
+      job_type: 'from-scratch-index',
+      concurrency_group: `indexing:${realmURL}`,
+    });
+    let pendingPublishedJob = await insertJob(context.dbAdapter, {
+      job_type: 'from-scratch-index',
+      concurrency_group: `indexing:${publishedRealmURL}`,
+    });
+    let unrelatedJob = await insertJob(context.dbAdapter, {
+      job_type: 'from-scratch-index',
+      concurrency_group: `indexing:${unrelatedRealmURL}`,
+    });
+    await context.dbAdapter.execute(`INSERT INTO job_reservations
+      (job_id, locked_until, worker_id)
+      VALUES (${pendingSourceJob.id}, NOW() + INTERVAL '5 minutes', 'worker-source')`);
+    await context.dbAdapter.execute(`INSERT INTO job_reservations
+      (job_id, locked_until, worker_id)
+      VALUES (${pendingPublishedJob.id}, NOW() + INTERVAL '5 minutes', 'worker-published')`);
+    await context.dbAdapter.execute(`INSERT INTO job_reservations
+      (job_id, locked_until, worker_id)
+      VALUES (${unrelatedJob.id}, NOW() + INTERVAL '5 minutes', 'worker-unrelated')`);
+
     let { valueExpressions, nameExpressions } = asExpressions({
       user_id: user.id,
       source_realm_url: realmURL,
@@ -154,6 +291,179 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
       'published realm records are removed',
     );
 
+    let sourceIndexRows = await context.dbAdapter.execute(
+      `SELECT * FROM boxel_index WHERE realm_url = '${realmURL}'`,
+    );
+    let publishedIndexRows = await context.dbAdapter.execute(
+      `SELECT * FROM boxel_index WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    let unrelatedIndexRows = await context.dbAdapter.execute(
+      `SELECT * FROM boxel_index WHERE realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      sourceIndexRows.length,
+      0,
+      'source realm rows are removed from boxel_index',
+    );
+    assert.strictEqual(
+      publishedIndexRows.length,
+      0,
+      'published realm rows are removed from boxel_index',
+    );
+    assert.ok(
+      unrelatedIndexRows.length > 0,
+      'unrelated realm rows remain in boxel_index',
+    );
+
+    let sourceWorkingRows = await context.dbAdapter.execute(
+      `SELECT * FROM boxel_index_working WHERE realm_url = '${realmURL}'`,
+    );
+    let publishedWorkingRows = await context.dbAdapter.execute(
+      `SELECT * FROM boxel_index_working WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    let unrelatedWorkingRows = await context.dbAdapter.execute(
+      `SELECT * FROM boxel_index_working WHERE realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      sourceWorkingRows.length,
+      0,
+      'source realm rows are removed from boxel_index_working',
+    );
+    assert.strictEqual(
+      publishedWorkingRows.length,
+      0,
+      'published realm rows are removed from boxel_index_working',
+    );
+    assert.ok(
+      unrelatedWorkingRows.length > 0,
+      'unrelated realm rows remain in boxel_index_working',
+    );
+
+    let sourceModuleRows = await context.dbAdapter.execute(
+      `SELECT * FROM modules WHERE resolved_realm_url = '${realmURL}'`,
+    );
+    let publishedModuleRows = await context.dbAdapter.execute(
+      `SELECT * FROM modules WHERE resolved_realm_url = '${publishedRealmURL}'`,
+    );
+    let unrelatedModuleRows = await context.dbAdapter.execute(
+      `SELECT * FROM modules WHERE resolved_realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      sourceModuleRows.length,
+      0,
+      'source realm rows are removed from modules',
+    );
+    assert.strictEqual(
+      publishedModuleRows.length,
+      0,
+      'published realm rows are removed from modules',
+    );
+    assert.strictEqual(
+      unrelatedModuleRows.length,
+      1,
+      'unrelated realm rows remain in modules',
+    );
+
+    let remainingSourceRealmVersionRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_versions WHERE realm_url = '${realmURL}'`,
+    );
+    let remainingPublishedRealmVersionRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_versions WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    let remainingUnrelatedRealmVersionRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_versions WHERE realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      remainingSourceRealmVersionRows.length,
+      0,
+      'source realm rows are removed from realm_versions',
+    );
+    assert.strictEqual(
+      remainingPublishedRealmVersionRows.length,
+      0,
+      'published realm rows are removed from realm_versions',
+    );
+    assert.strictEqual(
+      remainingUnrelatedRealmVersionRows.length,
+      1,
+      'unrelated realm rows remain in realm_versions',
+    );
+
+    let sourceRealmMetaRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_meta WHERE realm_url = '${realmURL}'`,
+    );
+    let publishedRealmMetaRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_meta WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    let unrelatedRealmMetaRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_meta WHERE realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      sourceRealmMetaRows.length,
+      0,
+      'source realm rows are removed from realm_meta',
+    );
+    assert.strictEqual(
+      publishedRealmMetaRows.length,
+      0,
+      'published realm rows are removed from realm_meta',
+    );
+    assert.strictEqual(
+      unrelatedRealmMetaRows.length,
+      1,
+      'unrelated realm rows remain in realm_meta',
+    );
+
+    let pendingSourceJobs = await context.dbAdapter.execute(
+      `SELECT * FROM jobs WHERE concurrency_group = 'indexing:${realmURL}' AND status = 'unfulfilled'`,
+    );
+    let pendingPublishedJobs = await context.dbAdapter.execute(
+      `SELECT * FROM jobs WHERE concurrency_group = 'indexing:${publishedRealmURL}' AND status = 'unfulfilled'`,
+    );
+    let pendingUnrelatedJobs = await context.dbAdapter.execute(
+      `SELECT * FROM jobs WHERE concurrency_group = 'indexing:${unrelatedRealmURL}' AND status = 'unfulfilled'`,
+    );
+    assert.strictEqual(
+      pendingSourceJobs.length,
+      0,
+      'pending source realm jobs are removed',
+    );
+    assert.strictEqual(
+      pendingPublishedJobs.length,
+      0,
+      'pending published realm jobs are removed',
+    );
+    assert.strictEqual(
+      pendingUnrelatedJobs.length,
+      1,
+      'unrelated pending jobs remain',
+    );
+
+    let sourceReservations = await context.dbAdapter.execute(
+      `SELECT * FROM job_reservations WHERE job_id = ${pendingSourceJob.id}`,
+    );
+    let publishedReservations = await context.dbAdapter.execute(
+      `SELECT * FROM job_reservations WHERE job_id = ${pendingPublishedJob.id}`,
+    );
+    let unrelatedReservations = await context.dbAdapter.execute(
+      `SELECT * FROM job_reservations WHERE job_id = ${unrelatedJob.id}`,
+    );
+    assert.strictEqual(
+      sourceReservations.length,
+      0,
+      'source realm job reservations are removed',
+    );
+    assert.strictEqual(
+      publishedReservations.length,
+      0,
+      'published realm job reservations are removed',
+    );
+    assert.strictEqual(
+      unrelatedReservations.length,
+      1,
+      'unrelated job reservations remain',
+    );
+
     let claimedDomains = (await context.dbAdapter.execute(
       `SELECT removed_at FROM claimed_domains_for_sites WHERE source_realm_url = '${realmURL}'`,
     )) as { removed_at: number | null }[];

From ccb1dfecf7873a6b9c4c2500a9cb889e3842b9be Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Fri, 13 Mar 2026 14:16:06 +0100
Subject: [PATCH 06/24] Add more cleanup

---
 .../handlers/handle-delete-realm.ts           |  6 +-
 .../handlers/realm-destruction-utils.ts       | 50 ++++++++++++
 .../server-endpoints/delete-realm-test.ts     | 77 +++++++++++++++++++
 3 files changed, 130 insertions(+), 3 deletions(-)

diff --git a/packages/realm-server/handlers/handle-delete-realm.ts b/packages/realm-server/handlers/handle-delete-realm.ts
index 6bdecf97cb6..2dc54f37f31 100644
--- a/packages/realm-server/handlers/handle-delete-realm.ts
+++ b/packages/realm-server/handlers/handle-delete-realm.ts
@@ -25,7 +25,7 @@ import {
 import type { CreateRoutesArgs } from '../routes';
 import type { RealmServerTokenClaim } from '../utils/jwt';
 import {
-  removeMountedRealm,
+  destroyMountedRealm,
   removeRealmDatabaseArtifacts,
 } from './realm-destruction-utils';
 
@@ -158,7 +158,7 @@ export default function handleDeleteRealm({
           PUBLISHED_DIRECTORY_NAME,
           publishedRealm.id,
         );
-        await removeMountedRealm({
+        destroyMountedRealm({
           realm: mountedPublishedRealm,
           realmPath: publishedRealmPath,
           realms,
@@ -193,7 +193,7 @@ export default function handleDeleteRealm({
         ` AND removed_at IS NULL`,
       ]);
 
-      await removeMountedRealm({
+      destroyMountedRealm({
         realm: sourceRealm,
         realmPath: sourceRealm.dir,
         realms,
diff --git a/packages/realm-server/handlers/realm-destruction-utils.ts b/packages/realm-server/handlers/realm-destruction-utils.ts
index 5b4cac81c41..6a876d0dec2 100644
--- a/packages/realm-server/handlers/realm-destruction-utils.ts
+++ b/packages/realm-server/handlers/realm-destruction-utils.ts
@@ -87,6 +87,48 @@ export async function removeMountedRealm(args: {
   }
 }
 
+export function destroyMountedRealm(args: {
+  realm: Realm;
+  realmPath: string;
+  realms: Realm[];
+  virtualNetwork: VirtualNetwork;
+}) {
+  let { realm, realmPath, realms, virtualNetwork } = args;
+  let cleanupError: Error | undefined;
+
+  try {
+    if (pathExistsSync(realmPath)) {
+      removeSync(realmPath);
+    }
+  } catch (error) {
+    cleanupError =
+      error instanceof Error
+        ? error
+        : new Error(`Failed to remove realm at ${realmPath}: ${String(error)}`);
+  }
+
+  try {
+    virtualNetwork.unmount(realm.handle);
+  } catch (error) {
+    cleanupError ??=
+      error instanceof Error
+        ? error
+        : new Error(`Failed to unmount realm ${realm.url}: ${String(error)}`);
+  }
+
+  let realmIndex = realms.findIndex(
+    (candidate) =>
+      ensureTrailingSlash(candidate.url) === ensureTrailingSlash(realm.url),
+  );
+  if (realmIndex !== -1) {
+    realms.splice(realmIndex, 1);
+  }
+
+  if (cleanupError) {
+    throw cleanupError;
+  }
+}
+
 export async function removeRealmDatabaseArtifacts(args: {
   dbAdapter: DBAdapter;
   realmURL: string;
@@ -131,4 +173,12 @@ export async function removeRealmDatabaseArtifacts(args: {
     `DELETE FROM realm_versions WHERE realm_url =`,
     param(realmURL),
   ]);
+  await query(dbAdapter, [
+    `DELETE FROM realm_file_meta WHERE realm_url =`,
+    param(realmURL),
+  ]);
+  await query(dbAdapter, [
+    `DELETE FROM session_rooms WHERE realm_url =`,
+    param(realmURL),
+  ]);
 }
diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index a8dd639c0ec..8dbb172b6c3 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -82,6 +82,18 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     );
   }
 
+  async function insertRealmFileMeta(realmURL: string, filePath: string) {
+    let { nameExpressions, valueExpressions } = asExpressions({
+      realm_url: realmURL,
+      file_path: filePath,
+      created_at: Math.floor(Date.now() / 1000),
+    });
+    await query(
+      context.dbAdapter,
+      insert('realm_file_meta', nameExpressions, valueExpressions),
+    );
+  }
+
   test('DELETE /_delete-realm removes a created realm, its published copies, and related domain claims', async function (assert) {
     let owner = `mango-${uuidv4()}`;
     let ownerUserId = `@${owner}:localhost`;
@@ -127,6 +139,9 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     let sourceModuleURL = `${realmURL}person`;
     let publishedModuleURL = `${publishedRealmURL}person`;
     let unrelatedModuleURL = `${unrelatedRealmURL}person`;
+    let sourceFileMetaPath = `cleanup-${uuidv4()}.json`;
+    let publishedFileMetaPath = `cleanup-${uuidv4()}.json`;
+    let unrelatedFileMetaPath = `cleanup-${uuidv4()}.json`;
 
     await insertIndexEntry({
       table: 'boxel_index',
@@ -163,6 +178,9 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     await insertModuleEntry(realmURL, sourceModuleURL);
     await insertModuleEntry(publishedRealmURL, publishedModuleURL);
     await insertModuleEntry(unrelatedRealmURL, unrelatedModuleURL);
+    await insertRealmFileMeta(realmURL, sourceFileMetaPath);
+    await insertRealmFileMeta(publishedRealmURL, publishedFileMetaPath);
+    await insertRealmFileMeta(unrelatedRealmURL, unrelatedFileMetaPath);
 
     let {
       nameExpressions: realmVersionNames,
@@ -222,6 +240,15 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     await context.dbAdapter.execute(`INSERT INTO job_reservations
       (job_id, locked_until, worker_id)
       VALUES (${unrelatedJob.id}, NOW() + INTERVAL '5 minutes', 'worker-unrelated')`);
+    await context.dbAdapter.execute(`INSERT INTO session_rooms
+      (realm_url, matrix_user_id, room_id)
+      VALUES ('${realmURL}', '${ownerUserId}', 'source-room')`);
+    await context.dbAdapter.execute(`INSERT INTO session_rooms
+      (realm_url, matrix_user_id, room_id)
+      VALUES ('${publishedRealmURL}', '@published:localhost', 'published-room')`);
+    await context.dbAdapter.execute(`INSERT INTO session_rooms
+      (realm_url, matrix_user_id, room_id)
+      VALUES ('${unrelatedRealmURL}', '@unrelated:localhost', 'unrelated-room')`);
 
     let { valueExpressions, nameExpressions } = asExpressions({
       user_id: user.id,
@@ -414,6 +441,56 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
       'unrelated realm rows remain in realm_meta',
     );
 
+    let sourceRealmFileMetaRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_file_meta WHERE realm_url = '${realmURL}'`,
+    );
+    let publishedRealmFileMetaRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_file_meta WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    let unrelatedRealmFileMetaRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_file_meta WHERE realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      sourceRealmFileMetaRows.length,
+      0,
+      'source realm rows are removed from realm_file_meta',
+    );
+    assert.strictEqual(
+      publishedRealmFileMetaRows.length,
+      0,
+      'published realm rows are removed from realm_file_meta',
+    );
+    assert.strictEqual(
+      unrelatedRealmFileMetaRows.length,
+      1,
+      'unrelated realm rows remain in realm_file_meta',
+    );
+
+    let sourceSessionRooms = await context.dbAdapter.execute(
+      `SELECT * FROM session_rooms WHERE realm_url = '${realmURL}'`,
+    );
+    let publishedSessionRooms = await context.dbAdapter.execute(
+      `SELECT * FROM session_rooms WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    let unrelatedSessionRooms = await context.dbAdapter.execute(
+      `SELECT * FROM session_rooms WHERE realm_url = '${unrelatedRealmURL}'`,
+    );
+    assert.strictEqual(
+      sourceSessionRooms.length,
+      0,
+      'source realm rows are removed from session_rooms',
+    );
+    assert.strictEqual(
+      publishedSessionRooms.length,
+      0,
+      'published realm rows are removed from session_rooms',
+    );
+    assert.strictEqual(
+      unrelatedSessionRooms.length,
+      1,
+      'unrelated realm rows remain in session_rooms',
+    );
+
     let pendingSourceJobs = await context.dbAdapter.execute(
       `SELECT * FROM jobs WHERE concurrency_group = 'indexing:${realmURL}' AND status = 'unfulfilled'`,
     );

From fba75a9cd04c008c6f84156c335f1d2c989f7934 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Fri, 13 Mar 2026 14:20:07 +0100
Subject: [PATCH 07/24] If card is deleted (not found), show a more exact error
 message

---
 .../ai-assistant/message/attachments.gts      | 70 +++++++++++++-
 .../components/ai-assistant/message/index.gts | 92 +++++++++++++++----
 packages/host/app/components/card-pill.gts    | 27 +++++-
 .../app/components/matrix/room-message.gts    |  2 +-
 .../ai-assistant-panel/general-test.gts       | 15 ++-
 5 files changed, 182 insertions(+), 24 deletions(-)

diff --git a/packages/host/app/components/ai-assistant/message/attachments.gts b/packages/host/app/components/ai-assistant/message/attachments.gts
index 8fe96e80629..473b8f2cea2 100644
--- a/packages/host/app/components/ai-assistant/message/attachments.gts
+++ b/packages/host/app/components/ai-assistant/message/attachments.gts
@@ -1,6 +1,9 @@
 import type { TemplateOnlyComponent } from '@ember/component/template-only';
 
-import type { getCardCollection } from '@cardstack/runtime-common';
+import type {
+  CardErrorJSONAPI,
+  getCardCollection,
+} from '@cardstack/runtime-common';
 
 import CardPill from '@cardstack/host/components/card-pill';
 import FilePill from '@cardstack/host/components/file-pill';
@@ -26,6 +29,58 @@ function findAttachedCardAsFile(
   return attachedCardsAsFiles?.find((file) => file.sourceUrl === card.id);
 }
 
+function cardErrorId(cardError: CardErrorJSONAPI) {
+  return cardError.id ?? '';
+}
+
+function cardErrorRealm(cardError: CardErrorJSONAPI) {
+  if (cardError.realm) {
+    return cardError.realm;
+  }
+
+  let id = cardError.id;
+  if (!id) {
+    return '';
+  }
+
+  try {
+    let url = new URL(id);
+    let lastSlashIndex = url.pathname.lastIndexOf('/');
+    let pathname =
+      lastSlashIndex >= 0 ? url.pathname.slice(0, lastSlashIndex + 1) : '/';
+    return `${url.origin}${pathname}`;
+  } catch {
+    return id;
+  }
+}
+
+function cardErrorDisplayTitle(cardError: CardErrorJSONAPI) {
+  if (cardError.meta.cardTitle) {
+    return cardError.meta.cardTitle;
+  }
+
+  let id = cardError.id;
+  if (!id) {
+    return 'Unavailable card';
+  }
+
+  let path = id;
+  try {
+    path = new URL(id).pathname;
+  } catch {
+    // ignore invalid urls
+  }
+
+  if (path.startsWith('/')) {
+    path = path.slice(1);
+  }
+
+  let segments = path.split('/').filter(Boolean);
+  let label = segments.slice(-2).join('/');
+
+  return label.replace(/\.[^.]+$/, '') || 'Unavailable card';
+}
+
 const Attachments: TemplateOnlyComponent<Signature> = <template>
   <ul class='items' data-test-message-items>
     {{#each @items as |item|}}
@@ -46,6 +101,19 @@ const Attachments: TemplateOnlyComponent<Signature> = <template>
             {{/let}}
           </li>
         {{/each}}
+        {{#each item.cardErrors as |cardError|}}
+          <li>
+            <CardPill
+              @cardId={{cardErrorId cardError}}
+              @displayTitle={{cardErrorDisplayTitle cardError}}
+              @borderType='solid'
+              @showErrorIcon={{true}}
+              @urlForRealmLookup={{cardErrorRealm cardError}}
+              title={{cardError.id}}
+              data-test-attached-card-error={{cardErrorId cardError}}
+            />
+          </li>
+        {{/each}}
       {{else}}
         <li>
           <FilePill
diff --git a/packages/host/app/components/ai-assistant/message/index.gts b/packages/host/app/components/ai-assistant/message/index.gts
index ece7e2216a1..f3076eba0d5 100644
--- a/packages/host/app/components/ai-assistant/message/index.gts
+++ b/packages/host/app/components/ai-assistant/message/index.gts
@@ -14,6 +14,7 @@ import { cn } from '@cardstack/boxel-ui/helpers';
 
 import {
   MINIMUM_AI_CREDITS_TO_CONTINUE,
+  type CardErrorJSONAPI,
   type getCardCollection,
 } from '@cardstack/runtime-common';
 
@@ -180,8 +181,55 @@ function isPresent(val: SafeString | string | null | undefined) {
   return val ? val !== '' : false;
 }
 
-function collectionResourceError(id: string | null | undefined) {
-  return 'Cannot render ' + id;
+export function attachedCardErrorMessages(errors: CardErrorJSONAPI[]) {
+  let unreachableCount = 0;
+  let runtimeErrorCount = 0;
+  let genericErrorCount = 0;
+
+  for (let error of errors) {
+    if (isUnreachableCardError(error)) {
+      unreachableCount++;
+    } else if (error.status >= 500) {
+      runtimeErrorCount++;
+    } else {
+      genericErrorCount++;
+    }
+  }
+
+  return [
+    ...(unreachableCount > 0
+      ? [
+          unreachableCount === 1
+            ? `The card is unreachable. It may have been deleted, or you don't have permission to see it.`
+            : `These cards are unreachable. They may have been deleted, or you don't have permission to see them.`,
+        ]
+      : []),
+    ...(runtimeErrorCount > 0
+      ? [
+          runtimeErrorCount === 1
+            ? `This card could not be displayed because it hit a runtime error.`
+            : `Some cards could not be displayed because they hit runtime errors.`,
+        ]
+      : []),
+    ...(genericErrorCount > 0
+      ? [
+          genericErrorCount === 1
+            ? `This card could not be displayed because it has an error.`
+            : `Some cards could not be displayed because they have errors.`,
+        ]
+      : []),
+  ];
+}
+
+function isUnreachableCardError(error: CardErrorJSONAPI) {
+  let title = error.title.toLowerCase();
+
+  return (
+    [401, 403, 404].includes(error.status) ||
+    title === 'unauthorized' ||
+    title === 'forbidden' ||
+    title === 'not found'
+  );
 }
 
 export default class AiAssistantMessage extends Component<Signature> {
@@ -302,17 +350,25 @@ export default class AiAssistantMessage extends Component<Signature> {
           {{else}}
             <Alert @type='error' as |Alert|>
               <Alert.Messages @messages={{this.errorMessages}} />
-              <div class='alert-action-buttons-row'>
-                {{#if @waitAction}}
-                  <Alert.Action
-                    @actionName='Wait longer'
-                    @action={{@waitAction}}
-                  />
-                {{/if}}
-                {{#if @retryAction}}
-                  <Alert.Action @actionName='Retry' @action={{@retryAction}} />
-                {{/if}}
-              </div>
+              {{#if this.hasAlertActions}}
+                <div
+                  class='alert-action-buttons-row'
+                  data-test-alert-action-buttons-row
+                >
+                  {{#if @waitAction}}
+                    <Alert.Action
+                      @actionName='Wait longer'
+                      @action={{@waitAction}}
+                    />
+                  {{/if}}
+                  {{#if @retryAction}}
+                    <Alert.Action
+                      @actionName='Retry'
+                      @action={{@retryAction}}
+                    />
+                  {{/if}}
+                </div>
+              {{/if}}
             </Alert>
           {{/if}}
         {{/if}}
@@ -412,12 +468,16 @@ export default class AiAssistantMessage extends Component<Signature> {
   private get errorMessages() {
     return [
       ...(this.args.errorMessage ? [this.args.errorMessage] : []),
-      ...(this.args.collectionResource?.cardErrors.map((error) =>
-        collectionResourceError(error.id),
-      ) ?? []),
+      ...attachedCardErrorMessages(
+        this.args.collectionResource?.cardErrors ?? [],
+      ),
     ];
   }
 
+  private get hasAlertActions() {
+    return Boolean(this.args.waitAction || this.args.retryAction);
+  }
+
   private get isOutOfCreditsErrorMessage(): boolean {
     return this.errorMessages.some((error) =>
       /You need a minimum of \d+ credits to continue using the AI bot\. Please upgrade to a larger plan, or top up your account\./.test(
diff --git a/packages/host/app/components/card-pill.gts b/packages/host/app/components/card-pill.gts
index c62da95d58a..a3f7fe98296 100644
--- a/packages/host/app/components/card-pill.gts
+++ b/packages/host/app/components/card-pill.gts
@@ -14,7 +14,7 @@ import {
   IconButton,
 } from '@cardstack/boxel-ui/components';
 import { cn } from '@cardstack/boxel-ui/helpers';
-import { IconX } from '@cardstack/boxel-ui/icons';
+import { FailureBordered, IconX } from '@cardstack/boxel-ui/icons';
 
 import { type getCard, GetCardContextName } from '@cardstack/runtime-common';
 
@@ -32,6 +32,8 @@ interface CardPillSignature {
     cardId: string;
     urlForRealmLookup: string;
     borderType?: 'dashed' | 'solid';
+    displayTitle?: string;
+    showErrorIcon?: boolean;
     onClick?: () => void;
     onRemove?: () => void;
     isEnabled?: boolean;
@@ -50,7 +52,11 @@ export default class CardPill extends Component<CardPillSignature> {
   };
 
   private get cardTitle() {
-    return this.card?.cardTitle || this.cardError?.meta.cardTitle;
+    return (
+      this.args.displayTitle ||
+      this.card?.cardTitle ||
+      this.cardError?.meta.cardTitle
+    );
   }
 
   private get card() {
@@ -107,7 +113,16 @@ export default class CardPill extends Component<CardPillSignature> {
         ...attributes
       >
         <:iconLeft>
-          <RealmIcon @realmInfo={{this.realm.info @urlForRealmLookup}} />
+          {{#if @showErrorIcon}}
+            <FailureBordered
+              class='fallback-card-icon'
+              width='18'
+              height='18'
+              aria-hidden='true'
+            />
+          {{else}}
+            <RealmIcon @realmInfo={{this.realm.info @urlForRealmLookup}} />
+          {{/if}}
         </:iconLeft>
         <:default>
           <div class='card-content' title={{this.cardTitle}}>
@@ -152,6 +167,12 @@ export default class CardPill extends Component<CardPillSignature> {
       .border-solid {
         border-style: solid;
       }
+      .fallback-card-icon {
+        display: block;
+        flex-shrink: 0;
+        --icon-background-color: var(--boxel-error-500);
+        --icon-color: var(--boxel-light);
+      }
       .card-content {
         max-width: 100px;
         max-height: 100%;
diff --git a/packages/host/app/components/matrix/room-message.gts b/packages/host/app/components/matrix/room-message.gts
index 4761e4edd5f..2bd636bafbb 100644
--- a/packages/host/app/components/matrix/room-message.gts
+++ b/packages/host/app/components/matrix/room-message.gts
@@ -256,6 +256,6 @@ export default class RoomMessage extends Component<Signature> {
     if (this.attachedCardCollection?.cardErrors.length === 0) {
       return undefined;
     }
-    return 'Error rendering attached cards.';
+    return undefined;
   }
 }
diff --git a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
index c06037c1fe8..56a55bd713d 100644
--- a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
+++ b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
@@ -699,14 +699,15 @@ module('Integration | ai-assistant-panel | general', function (hooks) {
 
   test('it can handle an error in a card attached to a matrix message', async function (assert) {
     let roomId = await renderAiAssistantPanel();
+    let unreachableCardId = 'http://this-is-not-a-real-card.com';
     simulateRemoteMessage(roomId, '@aibot:localhost', {
       body: 'card with error',
       msgtype: APP_BOXEL_MESSAGE_MSGTYPE,
       data: JSON.stringify({
         attachedCards: [
           {
-            sourceUrl: 'http://this-is-not-a-real-card.com',
-            url: 'http://this-is-not-a-real-card.com',
+            sourceUrl: unreachableCardId,
+            url: unreachableCardId,
             contentType: 'text/plain',
           },
         ],
@@ -717,7 +718,15 @@ module('Integration | ai-assistant-panel | general', function (hooks) {
     await waitFor('[data-test-card-error]');
     assert
       .dom('[data-test-card-error]')
-      .containsText('Error rendering attached cards');
+      .containsText(
+        `The card is unreachable. It is either missing or you don't have permission to see it.`,
+      );
+    assert
+      .dom(`[data-test-attached-card-error="${unreachableCardId}"]`)
+      .exists('errored attached cards still render as pills');
+    assert
+      .dom('[data-test-alert-action-buttons-row]')
+      .doesNotExist('attached-card errors do not render an empty action row');
     await percySnapshot(assert);
   });
 

From 8d5aa769003619bb824c0cc6a9d763639b1b53ad Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 10:41:23 +0100
Subject: [PATCH 08/24] Fix test

---
 packages/host/app/components/ai-assistant/message/index.gts   | 4 +++-
 .../components/ai-assistant-panel/general-test.gts            | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/host/app/components/ai-assistant/message/index.gts b/packages/host/app/components/ai-assistant/message/index.gts
index f3076eba0d5..9010cade51b 100644
--- a/packages/host/app/components/ai-assistant/message/index.gts
+++ b/packages/host/app/components/ai-assistant/message/index.gts
@@ -223,12 +223,14 @@ export function attachedCardErrorMessages(errors: CardErrorJSONAPI[]) {
 
 function isUnreachableCardError(error: CardErrorJSONAPI) {
   let title = error.title.toLowerCase();
+  let message = error.message.toLowerCase();
 
   return (
     [401, 403, 404].includes(error.status) ||
     title === 'unauthorized' ||
     title === 'forbidden' ||
-    title === 'not found'
+    title === 'not found' ||
+    message.includes('unable to fetch')
   );
 }
 
diff --git a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
index 56a55bd713d..afbbcb7a3f2 100644
--- a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
+++ b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
@@ -719,7 +719,7 @@ module('Integration | ai-assistant-panel | general', function (hooks) {
     assert
       .dom('[data-test-card-error]')
       .containsText(
-        `The card is unreachable. It is either missing or you don't have permission to see it.`,
+        `The card is unreachable. It may have been deleted, or you don't have permission to see it.`,
       );
     assert
       .dom(`[data-test-attached-card-error="${unreachableCardId}"]`)

From 66d94505946b937475f3b1a769608603c226e6ac Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 11:22:09 +0100
Subject: [PATCH 09/24] Cleanup

---
 .../app/components/ai-assistant/message/index.gts     | 11 +----------
 .../components/ai-assistant-panel/general-test.gts    |  2 +-
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/packages/host/app/components/ai-assistant/message/index.gts b/packages/host/app/components/ai-assistant/message/index.gts
index 9010cade51b..c4023c3949a 100644
--- a/packages/host/app/components/ai-assistant/message/index.gts
+++ b/packages/host/app/components/ai-assistant/message/index.gts
@@ -222,16 +222,7 @@ export function attachedCardErrorMessages(errors: CardErrorJSONAPI[]) {
 }
 
 function isUnreachableCardError(error: CardErrorJSONAPI) {
-  let title = error.title.toLowerCase();
-  let message = error.message.toLowerCase();
-
-  return (
-    [401, 403, 404].includes(error.status) ||
-    title === 'unauthorized' ||
-    title === 'forbidden' ||
-    title === 'not found' ||
-    message.includes('unable to fetch')
-  );
+  return [403, 404].includes(error.status);
 }
 
 export default class AiAssistantMessage extends Component<Signature> {
diff --git a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
index afbbcb7a3f2..57c38603dde 100644
--- a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
+++ b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
@@ -719,7 +719,7 @@ module('Integration | ai-assistant-panel | general', function (hooks) {
     assert
       .dom('[data-test-card-error]')
       .containsText(
-        `The card is unreachable. It may have been deleted, or you don't have permission to see it.`,
+        `This card could not be displayed because it hit a runtime error.`,
       );
     assert
       .dom(`[data-test-attached-card-error="${unreachableCardId}"]`)

From 0e36ff8464d5fc95be3bc6721fabaa4f09b39561 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 12:12:39 +0100
Subject: [PATCH 10/24] Cleanup

---
 .../integration/components/ai-assistant-panel/general-test.gts | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
index 57c38603dde..762d154b1e0 100644
--- a/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
+++ b/packages/host/tests/integration/components/ai-assistant-panel/general-test.gts
@@ -724,9 +724,6 @@ module('Integration | ai-assistant-panel | general', function (hooks) {
     assert
       .dom(`[data-test-attached-card-error="${unreachableCardId}"]`)
       .exists('errored attached cards still render as pills');
-    assert
-      .dom('[data-test-alert-action-buttons-row]')
-      .doesNotExist('attached-card errors do not render an empty action row');
     await percySnapshot(assert);
   });
 

From 1335d489deaca74b643f844a9a2e88f1015123fd Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 13:20:16 +0100
Subject: [PATCH 11/24] Handle inaccessible attached-card pills safely

---
 .../attachment-picker/attached-items.gts      | 73 ++++++++-----------
 .../ai-assistant/message/attachments.gts      | 28 ++++---
 2 files changed, 43 insertions(+), 58 deletions(-)

diff --git a/packages/host/app/components/ai-assistant/attachment-picker/attached-items.gts b/packages/host/app/components/ai-assistant/attachment-picker/attached-items.gts
index c54745fea0c..0dc3fe32a59 100644
--- a/packages/host/app/components/ai-assistant/attachment-picker/attached-items.gts
+++ b/packages/host/app/components/ai-assistant/attachment-picker/attached-items.gts
@@ -81,10 +81,6 @@ export default class AttachedItems extends Component<Signature> {
     this.areAllItemsDisplayed = !this.areAllItemsDisplayed;
   }
 
-  private getCardErrorId(cardError: CardErrorJSONAPI) {
-    return cardError.id ?? '';
-  }
-
   private getCardErrorRealm(cardError: CardErrorJSONAPI) {
     return cardError.realm ?? this.operatorModeStateService.realmURL;
   }
@@ -126,45 +122,36 @@ export default class AttachedItems extends Component<Signature> {
       {{#if @isLoaded}}
         {{#each this.itemsToDisplay as |item|}}
           {{#if (isCardErrorJSONAPI item)}}
-            {{#if (this.isAutoAttachedCard (this.getCardErrorId item))}}
-              <Tooltip @placement='top'>
-                <:trigger>
-                  <CardPill
-                    @cardId={{this.getCardErrorId item}}
-                    @borderType='dashed'
-                    @onClick={{fn
-                      this.handleChooseCard
-                      (this.getCardErrorId item)
-                    }}
-                    @onRemove={{fn
-                      this.handleRemoveCard
-                      (this.getCardErrorId item)
-                    }}
-                    @urlForRealmLookup={{this.getCardErrorRealm item}}
-                    data-test-autoattached-card={{this.getCardErrorId item}}
-                  />
-                </:trigger>
-
-                <:content>
-                  {{#if @autoAttachedCardTooltipMessage}}
-                    {{@autoAttachedCardTooltipMessage}}
-                  {{else if
-                    (this.isAutoAttachedCard (this.getCardErrorId item))
-                  }}
-                    Topmost card is shared automatically
-                  {{/if}}
-                </:content>
-              </Tooltip>
-            {{else}}
-              <CardPill
-                @cardId={{this.getCardErrorId item}}
-                @borderType='solid'
-                @onRemove={{fn
-                  this.handleRemoveCard
-                  (this.getCardErrorId item)
-                }}
-                @urlForRealmLookup={{this.getCardErrorRealm item}}
-              />
+            {{#if item.id}}
+              {{#if (this.isAutoAttachedCard item.id)}}
+                <Tooltip @placement='top'>
+                  <:trigger>
+                    <CardPill
+                      @cardId={{item.id}}
+                      @borderType='dashed'
+                      @onClick={{fn this.handleChooseCard item.id}}
+                      @onRemove={{fn this.handleRemoveCard item.id}}
+                      @urlForRealmLookup={{this.getCardErrorRealm item}}
+                      data-test-autoattached-card={{item.id}}
+                    />
+                  </:trigger>
+
+                  <:content>
+                    {{#if @autoAttachedCardTooltipMessage}}
+                      {{@autoAttachedCardTooltipMessage}}
+                    {{else if (this.isAutoAttachedCard item.id)}}
+                      Topmost card is shared automatically
+                    {{/if}}
+                  </:content>
+                </Tooltip>
+              {{else}}
+                <CardPill
+                  @cardId={{item.id}}
+                  @borderType='solid'
+                  @onRemove={{fn this.handleRemoveCard item.id}}
+                  @urlForRealmLookup={{this.getCardErrorRealm item}}
+                />
+              {{/if}}
             {{/if}}
           {{else if (this.isCard item)}}
             {{#if (this.isAutoAttachedCard item.id)}}
diff --git a/packages/host/app/components/ai-assistant/message/attachments.gts b/packages/host/app/components/ai-assistant/message/attachments.gts
index 473b8f2cea2..3cca1a6a185 100644
--- a/packages/host/app/components/ai-assistant/message/attachments.gts
+++ b/packages/host/app/components/ai-assistant/message/attachments.gts
@@ -29,10 +29,6 @@ function findAttachedCardAsFile(
   return attachedCardsAsFiles?.find((file) => file.sourceUrl === card.id);
 }
 
-function cardErrorId(cardError: CardErrorJSONAPI) {
-  return cardError.id ?? '';
-}
-
 function cardErrorRealm(cardError: CardErrorJSONAPI) {
   if (cardError.realm) {
     return cardError.realm;
@@ -102,17 +98,19 @@ const Attachments: TemplateOnlyComponent<Signature> = <template>
           </li>
         {{/each}}
         {{#each item.cardErrors as |cardError|}}
-          <li>
-            <CardPill
-              @cardId={{cardErrorId cardError}}
-              @displayTitle={{cardErrorDisplayTitle cardError}}
-              @borderType='solid'
-              @showErrorIcon={{true}}
-              @urlForRealmLookup={{cardErrorRealm cardError}}
-              title={{cardError.id}}
-              data-test-attached-card-error={{cardErrorId cardError}}
-            />
-          </li>
+          {{#if cardError.id}}
+            <li>
+              <CardPill
+                @cardId={{cardError.id}}
+                @displayTitle={{cardErrorDisplayTitle cardError}}
+                @borderType='solid'
+                @showErrorIcon={{true}}
+                @urlForRealmLookup={{cardErrorRealm cardError}}
+                title={{cardError.id}}
+                data-test-attached-card-error={{cardError.id}}
+              />
+            </li>
+          {{/if}}
         {{/each}}
       {{else}}
         <li>

From f24375c86a6958490814b1ea697c3fa6554346a8 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 13:27:45 +0100
Subject: [PATCH 12/24] Use path.relative for realm file cleanup

---
 packages/realm-server/handlers/realm-destruction-utils.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/realm-server/handlers/realm-destruction-utils.ts b/packages/realm-server/handlers/realm-destruction-utils.ts
index 6a876d0dec2..c6026871da0 100644
--- a/packages/realm-server/handlers/realm-destruction-utils.ts
+++ b/packages/realm-server/handlers/realm-destruction-utils.ts
@@ -5,7 +5,7 @@ import type {
 } from '@cardstack/runtime-common';
 import { ensureTrailingSlash, param, query } from '@cardstack/runtime-common';
 import { pathExistsSync, readdirSync, removeSync } from 'fs-extra';
-import { join } from 'path';
+import { join, relative } from 'path';
 
 export function collectAllFilePaths(realmPath: string): string[] {
   let allPaths: string[] = [];
@@ -28,7 +28,7 @@ export function collectAllFilePaths(realmPath: string): string[] {
       if (entry.isDirectory()) {
         traverseDirectory(fullPath, basePath);
       } else {
-        let relativePath = fullPath.replace(basePath, '').replace(/^[/\\]/, '');
+        let relativePath = relative(basePath, fullPath).replace(/\\/g, '/');
         if (relativePath) {
           allPaths.push(relativePath);
         }

From 8f2efcfc93f304633983cce10dfe1709d70ca9f8 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 13:42:11 +0100
Subject: [PATCH 13/24] Cover realm_versions cleanup in delete-realm test

---
 .../server-endpoints/delete-realm-test.ts     | 28 +++++++++++--------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index 8dbb172b6c3..3c3564af43a 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -182,17 +182,23 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     await insertRealmFileMeta(publishedRealmURL, publishedFileMetaPath);
     await insertRealmFileMeta(unrelatedRealmURL, unrelatedFileMetaPath);
 
-    let {
-      nameExpressions: realmVersionNames,
-      valueExpressions: realmVersionValues,
-    } = asExpressions({
-      realm_url: unrelatedRealmURL,
-      current_version: 77,
-    });
-    await query(
-      context.dbAdapter,
-      insert('realm_versions', realmVersionNames, realmVersionValues),
-    );
+    for (let [cleanupRealmURL, currentVersion] of [
+      [realmURL, 75],
+      [publishedRealmURL, 76],
+      [unrelatedRealmURL, 77],
+    ] as const) {
+      let {
+        nameExpressions: realmVersionNames,
+        valueExpressions: realmVersionValues,
+      } = asExpressions({
+        realm_url: cleanupRealmURL,
+        current_version: currentVersion,
+      });
+      await query(
+        context.dbAdapter,
+        insert('realm_versions', realmVersionNames, realmVersionValues),
+      );
+    }
 
     for (let [cleanupRealmURL, realmVersion] of [
       [realmURL, 91],

From 3b3b6120eebb6d3d7d3b7f71038e45a18309e71e Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 13:43:17 +0100
Subject: [PATCH 14/24] Reuse shared URL normalization in delete-realm handler

---
 packages/realm-server/handlers/handle-delete-realm.ts | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/packages/realm-server/handlers/handle-delete-realm.ts b/packages/realm-server/handlers/handle-delete-realm.ts
index 2dc54f37f31..1f9b3ff62ea 100644
--- a/packages/realm-server/handlers/handle-delete-realm.ts
+++ b/packages/realm-server/handlers/handle-delete-realm.ts
@@ -1,6 +1,7 @@
 import type Koa from 'koa';
 import {
   asExpressions,
+  ensureTrailingSlash,
   fetchRealmPermissions,
   getMatrixUsername,
   param,
@@ -239,10 +240,6 @@ function assertIsDeleteRealmJSON(
   }
 }
 
-function ensureTrailingSlash(url: string) {
-  return url.endsWith('/') ? url : `${url}/`;
-}
-
 function normalizeRealmURL(realmURL: string): URL | null {
   try {
     let parsedRealmURL = new URL(realmURL);

From 5037807f23a4068e1a85a55ec88615735125fc6e Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 13:57:25 +0100
Subject: [PATCH 15/24] Remove dead attached-card error branch

---
 packages/host/app/components/matrix/room-message.gts | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/packages/host/app/components/matrix/room-message.gts b/packages/host/app/components/matrix/room-message.gts
index 2bd636bafbb..4fe122723ff 100644
--- a/packages/host/app/components/matrix/room-message.gts
+++ b/packages/host/app/components/matrix/room-message.gts
@@ -253,9 +253,6 @@ export default class RoomMessage extends Component<Signature> {
     if (this.streamingTimeout) {
       return `This message has been processing for a long time (more than ${STREAMING_TIMEOUT_MINUTES} minutes), possibly due to a delay in response time, or due to a system error.`; // Will show a "Wait longer" and "Retry" button
     }
-    if (this.attachedCardCollection?.cardErrors.length === 0) {
-      return undefined;
-    }
     return undefined;
   }
 }

From 5521f082f5a02bbc09e2d582df1f46829c923897 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 14:01:25 +0100
Subject: [PATCH 16/24] Tolerate unmounted published realms during delete

---
 .../handlers/handle-delete-realm.ts           |  29 +++--
 .../server-endpoints/delete-realm-test.ts     | 103 ++++++++++++++++++
 2 files changed, 120 insertions(+), 12 deletions(-)

diff --git a/packages/realm-server/handlers/handle-delete-realm.ts b/packages/realm-server/handlers/handle-delete-realm.ts
index 1f9b3ff62ea..2adce326f64 100644
--- a/packages/realm-server/handlers/handle-delete-realm.ts
+++ b/packages/realm-server/handlers/handle-delete-realm.ts
@@ -12,6 +12,7 @@ import {
   type PublishedRealmTable,
   update,
 } from '@cardstack/runtime-common';
+import { pathExistsSync, removeSync } from 'fs-extra';
 import { join } from 'path';
 import * as Sentry from '@sentry/node';
 import {
@@ -148,23 +149,27 @@ export default function handleDeleteRealm({
             ensureTrailingSlash(realm.url) ===
             ensureTrailingSlash(publishedRealm.published_realm_url),
         );
-        if (!mountedPublishedRealm) {
-          throw new Error(
-            `No realm instance found for published realm ${publishedRealm.published_realm_url}`,
-          );
-        }
-
         let publishedRealmPath = join(
           realmsRootPath,
           PUBLISHED_DIRECTORY_NAME,
           publishedRealm.id,
         );
-        destroyMountedRealm({
-          realm: mountedPublishedRealm,
-          realmPath: publishedRealmPath,
-          realms,
-          virtualNetwork,
-        });
+        if (mountedPublishedRealm) {
+          destroyMountedRealm({
+            realm: mountedPublishedRealm,
+            realmPath: publishedRealmPath,
+            realms,
+            virtualNetwork,
+          });
+        } else {
+          try {
+            if (pathExistsSync(publishedRealmPath)) {
+              removeSync(publishedRealmPath);
+            }
+          } catch (error) {
+            Sentry.captureException(error);
+          }
+        }
         await removeRealmPermissions(
           dbAdapter,
           new URL(publishedRealm.published_realm_url),
diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index 3c3564af43a..6b386a595b6 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -7,6 +7,7 @@ import {
   asExpressions,
   insert,
   insertPermissions,
+  PUBLISHED_DIRECTORY_NAME,
   query,
 } from '@cardstack/runtime-common';
 
@@ -569,6 +570,108 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     );
   });
 
+  test('DELETE /_delete-realm still deletes a realm when a published copy is no longer mounted', async function (assert) {
+    let owner = `mango-${uuidv4()}`;
+    let ownerUserId = `@${owner}:localhost`;
+    let realmURL = await createRealmFor(ownerUserId);
+    let publishedRealmURL = `http://${owner}.localhost:4445/published-${uuidv4()}/`;
+
+    await insertUser(
+      context.dbAdapter,
+      ownerUserId,
+      'cus_delete_realm_unmounted',
+      'mango@example.com',
+    );
+
+    let publishResponse = await context.request2
+      .post('/_publish-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          sourceRealmURL: realmURL,
+          publishedRealmURL,
+        }),
+      );
+
+    assert.strictEqual(publishResponse.status, 201, 'published realm created');
+    let publishedRealmId = publishResponse.body.data.id as string;
+    let publishedRealmPath = join(
+      context.dir.name,
+      'realm_server_2',
+      PUBLISHED_DIRECTORY_NAME,
+      publishedRealmId,
+    );
+    assert.true(existsSync(publishedRealmPath), 'published realm directory exists');
+
+    let mountedPublishedRealm = context.testRealmServer2.testingOnlyRealms.find(
+      (realm) => realm.url === publishedRealmURL,
+    );
+    assert.ok(mountedPublishedRealm, 'published realm is mounted');
+    context.virtualNetwork.unmount(mountedPublishedRealm.handle);
+
+    let mountedRealms = (
+      context.testRealmServer2 as unknown as { realms: { url: string }[] }
+    ).realms;
+    let publishedRealmIndex = mountedRealms.findIndex(
+      (realm) => realm.url === publishedRealmURL,
+    );
+    assert.notStrictEqual(
+      publishedRealmIndex,
+      -1,
+      'published realm is present in server realm list',
+    );
+    mountedRealms.splice(publishedRealmIndex, 1);
+
+    let deleteResponse = await context.request2
+      .delete('/_delete-realm')
+      .set('Accept', 'application/vnd.api+json')
+      .set('Content-Type', 'application/json')
+      .set(
+        'Authorization',
+        `Bearer ${createRealmServerJWT(
+          { user: ownerUserId, sessionRoom: 'session-room-test' },
+          realmSecretSeed,
+        )}`,
+      )
+      .send(
+        JSON.stringify({
+          data: {
+            type: 'realm',
+            id: realmURL,
+          },
+        }),
+      );
+
+    assert.strictEqual(deleteResponse.status, 204, 'realm deleted');
+    assert.false(
+      existsSync(publishedRealmPath),
+      'published realm directory is removed even when unmounted',
+    );
+
+    let remainingPublishedRows = await context.dbAdapter.execute(
+      `SELECT * FROM published_realms WHERE source_realm_url = '${realmURL}'`,
+    );
+    assert.strictEqual(
+      remainingPublishedRows.length,
+      0,
+      'published realm records are removed',
+    );
+    assert.notOk(
+      context.testRealmServer2.testingOnlyRealms.find(
+        (realm) => realm.url === realmURL,
+      ),
+      'source realm is unmounted',
+    );
+  });
+
   test('DELETE /_delete-realm rejects deleting a realm outside the current user namespace', async function (assert) {
     let ownerUserId = `@mango-${uuidv4()}:localhost`;
     let foreignOwnerUserId = `@papaya-${uuidv4()}:localhost`;

From 87e52d741a94f15963fbc01825a65d55bb29cf3d Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 15:07:52 +0100
Subject: [PATCH 17/24] Fix test

---
 .../server-endpoints/delete-realm-test.ts     | 52 ++++++++++++-------
 1 file changed, 33 insertions(+), 19 deletions(-)

diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index 6b386a595b6..5ccd08e46b9 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -183,23 +183,32 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     await insertRealmFileMeta(publishedRealmURL, publishedFileMetaPath);
     await insertRealmFileMeta(unrelatedRealmURL, unrelatedFileMetaPath);
 
-    for (let [cleanupRealmURL, currentVersion] of [
-      [realmURL, 75],
-      [publishedRealmURL, 76],
-      [unrelatedRealmURL, 77],
-    ] as const) {
-      let {
-        nameExpressions: realmVersionNames,
-        valueExpressions: realmVersionValues,
-      } = asExpressions({
-        realm_url: cleanupRealmURL,
-        current_version: currentVersion,
-      });
-      await query(
-        context.dbAdapter,
-        insert('realm_versions', realmVersionNames, realmVersionValues),
-      );
-    }
+    let existingSourceRealmVersionRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_versions WHERE realm_url = '${realmURL}'`,
+    );
+    let existingPublishedRealmVersionRows = await context.dbAdapter.execute(
+      `SELECT * FROM realm_versions WHERE realm_url = '${publishedRealmURL}'`,
+    );
+    assert.ok(
+      existingSourceRealmVersionRows.length > 0,
+      'source realm rows exist in realm_versions before deletion',
+    );
+    assert.ok(
+      existingPublishedRealmVersionRows.length > 0,
+      'published realm rows exist in realm_versions before deletion',
+    );
+
+    let {
+      nameExpressions: realmVersionNames,
+      valueExpressions: realmVersionValues,
+    } = asExpressions({
+      realm_url: unrelatedRealmURL,
+      current_version: 77,
+    });
+    await query(
+      context.dbAdapter,
+      insert('realm_versions', realmVersionNames, realmVersionValues),
+    );
 
     for (let [cleanupRealmURL, realmVersion] of [
       [realmURL, 91],
@@ -609,12 +618,17 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
       PUBLISHED_DIRECTORY_NAME,
       publishedRealmId,
     );
-    assert.true(existsSync(publishedRealmPath), 'published realm directory exists');
+    assert.true(
+      existsSync(publishedRealmPath),
+      'published realm directory exists',
+    );
 
     let mountedPublishedRealm = context.testRealmServer2.testingOnlyRealms.find(
       (realm) => realm.url === publishedRealmURL,
     );
-    assert.ok(mountedPublishedRealm, 'published realm is mounted');
+    if (!mountedPublishedRealm) {
+      throw new Error('expected published realm to be mounted');
+    }
     context.virtualNetwork.unmount(mountedPublishedRealm.handle);
 
     let mountedRealms = (

From e1287e81179670cd04aa8d7c069ee46ff76454d1 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 16:26:55 +0100
Subject: [PATCH 18/24] Keep other realm sessions when deleting a workspace

---
 packages/host/app/services/realm.ts           | 10 +++++--
 .../workspace-chooser-delete-test.gts         | 28 +++++++++++++++++++
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/packages/host/app/services/realm.ts b/packages/host/app/services/realm.ts
index 598e4e886cc..c59cc1bbede 100644
--- a/packages/host/app/services/realm.ts
+++ b/packages/host/app/services/realm.ts
@@ -265,6 +265,12 @@ class RealmResource {
   });
 
   logout(): void {
+    this.clearRealmSession();
+    window.localStorage.removeItem(SessionLocalStorageKey);
+    syncTokenToServiceWorker(this.realmURL, undefined);
+  }
+
+  clearRealmSession(): void {
     this.token = undefined;
     this.loginTask.cancelAll();
     this.tokenRefresher.cancelAll();
@@ -272,8 +278,6 @@ class RealmResource {
     this.fetchInfoTask.cancelAll();
     this.fetchingInfo = undefined;
     this.fetchRealmPermissionsTask.cancelAll();
-    window.localStorage.removeItem(SessionLocalStorageKey);
-    syncTokenToServiceWorker(this.realmURL, undefined);
   }
 
   private fetchingInfo: Promise<void> | undefined;
@@ -832,7 +836,7 @@ export default class RealmService extends Service {
     if (!resource) {
       return;
     }
-    resource.logout();
+    resource.clearRealmSession();
     this._realms.delete(url);
     this.currentKnownRealms.delete(url);
   }
diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
index 530d50895e6..eca77e41eae 100644
--- a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -16,6 +16,7 @@ import { setupBaseRealm } from '../helpers/base-realm';
 import { setupMockMatrix } from '../helpers/mock-matrix';
 import { assertRecentFileURLs } from '../helpers/recent-files-cards';
 import { setupApplicationTest } from '../helpers/setup';
+import { SessionLocalStorageKey } from '@cardstack/host/utils/local-storage-keys';
 
 const ownedRealmURL = 'http://test-realm/testuser/owned-workspace/';
 const sharedRealmURL = 'http://test-realm/otheruser/shared-workspace/';
@@ -125,7 +126,23 @@ export class Person extends CardDef {}
       stacks: [[{ id: `${ownedRealmURL}index`, format: 'isolated' }]],
     });
 
+    let realmService = getService('realm');
     let recentFilesService = getService('recent-files-service');
+    await realmService.login(ownedRealmURL);
+    await realmService.login(sharedRealmURL);
+
+    let sessionsBeforeDelete = JSON.parse(
+      window.localStorage.getItem(SessionLocalStorageKey) ?? '{}',
+    ) as Record<string, string>;
+    assert.ok(
+      sessionsBeforeDelete[ownedRealmURL],
+      'owned realm session token exists before deletion',
+    );
+    assert.ok(
+      sessionsBeforeDelete[sharedRealmURL],
+      'shared realm session token exists before deletion',
+    );
+
     recentFilesService.recentFiles.push(
       {
         realmURL: new URL(ownedRealmURL),
@@ -168,6 +185,17 @@ export class Person extends CardDef {}
     assert.dom('[data-test-workspace="Owned Workspace"]').doesNotExist();
     assert.dom('[data-test-workspace="Shared Workspace"]').exists();
     assert.dom('[data-test-workspace-chooser]').exists();
+    let sessionsAfterDelete = JSON.parse(
+      window.localStorage.getItem(SessionLocalStorageKey) ?? '{}',
+    ) as Record<string, string>;
+    assert.notOk(
+      sessionsAfterDelete[ownedRealmURL],
+      'deleted realm session token is removed',
+    );
+    assert.ok(
+      sessionsAfterDelete[sharedRealmURL],
+      'other realm session token remains',
+    );
     assertRecentFileURLs(
       assert,
       recentFilesService.recentFiles,

From 6ce38cea9516b7b1006115b1b3d33593095d06bc Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Mon, 16 Mar 2026 17:26:03 +0100
Subject: [PATCH 19/24] Preserve other realm sessions when deleting a workspace

---
 packages/host/app/services/realm.ts           | 24 +++++++++++++++----
 .../workspace-chooser-delete-test.gts         | 14 +++++++----
 2 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/packages/host/app/services/realm.ts b/packages/host/app/services/realm.ts
index c59cc1bbede..582b1945fed 100644
--- a/packages/host/app/services/realm.ts
+++ b/packages/host/app/services/realm.ts
@@ -271,7 +271,9 @@ class RealmResource {
   }
 
   clearRealmSession(): void {
-    this.token = undefined;
+    this.auth = { type: 'anonymous' };
+    SessionStorage.remove(this.realmURL);
+    syncTokenToServiceWorker(this.realmURL, undefined);
     this.loginTask.cancelAll();
     this.tokenRefresher.cancelAll();
     this.loggingIn = undefined;
@@ -833,10 +835,12 @@ export default class RealmService extends Service {
 
   removeRealm(url: string) {
     let resource = this._realms.get(url);
-    if (!resource) {
-      return;
+    if (resource) {
+      resource.clearRealmSession();
+    } else {
+      SessionStorage.remove(url);
+      syncTokenToServiceWorker(url, undefined);
     }
-    resource.clearRealmSession();
     this._realms.delete(url);
     this.currentKnownRealms.delete(url);
   }
@@ -1280,6 +1284,18 @@ let SessionStorage = {
     }
     syncTokenToServiceWorker(realmURL, token);
   },
+  remove(realmURL: string) {
+    let sessionStr =
+      window.localStorage.getItem(SessionLocalStorageKey) ?? '{}';
+    let session = JSON.parse(sessionStr);
+    if (realmURL in session) {
+      delete session[realmURL];
+      window.localStorage.setItem(
+        SessionLocalStorageKey,
+        JSON.stringify(session),
+      );
+    }
+  },
 };
 
 declare module '@ember/service' {
diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
index eca77e41eae..13e8c06876b 100644
--- a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -2,8 +2,11 @@ import { click, waitUntil } from '@ember/test-helpers';
 
 import { getService } from '@universal-ember/test-support';
 
+import window from 'ember-window-mock';
 import { module, test } from 'qunit';
 
+import { SessionLocalStorageKey } from '@cardstack/host/utils/local-storage-keys';
+
 import {
   setupAcceptanceTestRealm,
   setupAuthEndpoints,
@@ -16,7 +19,6 @@ import { setupBaseRealm } from '../helpers/base-realm';
 import { setupMockMatrix } from '../helpers/mock-matrix';
 import { assertRecentFileURLs } from '../helpers/recent-files-cards';
 import { setupApplicationTest } from '../helpers/setup';
-import { SessionLocalStorageKey } from '@cardstack/host/utils/local-storage-keys';
 
 const ownedRealmURL = 'http://test-realm/testuser/owned-workspace/';
 const sharedRealmURL = 'http://test-realm/otheruser/shared-workspace/';
@@ -126,10 +128,14 @@ export class Person extends CardDef {}
       stacks: [[{ id: `${ownedRealmURL}index`, format: 'isolated' }]],
     });
 
-    let realmService = getService('realm');
     let recentFilesService = getService('recent-files-service');
-    await realmService.login(ownedRealmURL);
-    await realmService.login(sharedRealmURL);
+    window.localStorage.setItem(
+      SessionLocalStorageKey,
+      JSON.stringify({
+        [ownedRealmURL]: 'owned-token',
+        [sharedRealmURL]: 'shared-token',
+      }),
+    );
 
     let sessionsBeforeDelete = JSON.parse(
       window.localStorage.getItem(SessionLocalStorageKey) ?? '{}',

From c16b26fcbdd0ac9cf23febbe865f3d39ec7e5d4a Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Tue, 17 Mar 2026 10:28:54 +0100
Subject: [PATCH 20/24] Adjust the design of the workspace delete modal

---
 .../components/operator-mode/delete-modal.gts |   3 +-
 .../workspace-chooser/workspace.gts           | 147 ++++++++++++------
 2 files changed, 100 insertions(+), 50 deletions(-)

diff --git a/packages/host/app/components/operator-mode/delete-modal.gts b/packages/host/app/components/operator-mode/delete-modal.gts
index 5081d184c95..93a9e4f2293 100644
--- a/packages/host/app/components/operator-mode/delete-modal.gts
+++ b/packages/host/app/components/operator-mode/delete-modal.gts
@@ -18,6 +18,7 @@ interface Signature {
     isDeleteRunning?: boolean;
     error?: string;
     size?: 'x-small' | 'small' | 'medium' | 'large' | 'full-screen';
+    containerClass?: string;
   };
   Blocks: {
     default: [];
@@ -35,7 +36,7 @@ let component: TemplateOnlyComponent<Signature> = <template>
     @onClose={{@onCancel}}
     style={{cssVar boxel-modal-offset-top='40vh'}}
   >
-    <section class='delete'>
+    <section class='delete {{@containerClass}}'>
       <div class='content' data-test-delete-msg>
         {{#if (has-block 'content')}}
           {{yield to='content'}}
diff --git a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
index 6a34ab2483d..3933934c5ae 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
@@ -118,25 +118,36 @@ export default class Workspace extends Component<Signature> {
           @onConfirm={{this.confirmDeleteWorkspace}}
           @isDeleteRunning={{this.deleteWorkspaceTask.isRunning}}
           @error={{this.deleteError}}
-          @size='small'
+          @size='medium'
+          @containerClass='workspace-delete-dialog'
         >
           <:content>
             <div class='workspace-delete-copy'>
               <header class='workspace-delete-header'>
-                <p class='workspace-delete-eyebrow'>Delete workspace</p>
-                <p class='workspace-delete-title'>{{this.name}}</p>
+                <p class='workspace-delete-title'>Delete Workspace</p>
               </header>
 
-              {{#if this.loadDeleteSummaryTask.isRunning}}
-                <p class='workspace-delete-summary-card'>
-                  Checking what will be removed from this workspace...
-                </p>
-              {{else if this.deleteSummaryText}}
-                <p class='workspace-delete-summary-card'>
-                  Contains
-                  {{this.deleteSummaryText}}.
-                </p>
-              {{/if}}
+              <section class='workspace-delete-summary-card'>
+                <div class='workspace-delete-summary-row'>
+                  <RealmIcon
+                    class='workspace-delete-summary-icon'
+                    @realmInfo={{this.realmInfo}}
+                  />
+                  <div class='workspace-delete-summary-body'>
+                    <p class='workspace-delete-summary-name'>{{this.name}}</p>
+                    {{#if this.loadDeleteSummaryTask.isRunning}}
+                      <p class='workspace-delete-summary-text'>
+                        Checking what will be removed from this workspace...
+                      </p>
+                    {{else if this.deleteSummaryText}}
+                      <p class='workspace-delete-summary-text'>
+                        Contains
+                        {{this.deleteSummaryText}}
+                      </p>
+                    {{/if}}
+                  </div>
+                </div>
+              </section>
 
               <div class='workspace-delete-danger-panel'>
                 <p class='workspace-delete-warning'>
@@ -282,70 +293,101 @@ export default class Workspace extends Component<Signature> {
       .workspace-delete-copy {
         display: flex;
         flex-direction: column;
-        gap: var(--boxel-sp);
-        max-width: 31rem;
-        margin: 0 auto;
+        gap: var(--boxel-sp-lg);
+        margin: 0;
         text-align: left;
       }
       .workspace-delete-copy p {
         margin: 0;
       }
       .workspace-delete-header {
-        padding-bottom: var(--boxel-sp-xs);
-        border-bottom: 1px solid rgb(0 0 0 / 10%);
-      }
-      .workspace-delete-eyebrow {
-        color: var(--boxel-danger);
-        font: 700 var(--boxel-font-xs);
-        letter-spacing: 0.08em;
-        text-transform: uppercase;
+        padding: 0;
       }
       .workspace-delete-title {
         color: var(--boxel-dark);
-        font: 700 var(--boxel-font-lg);
+        font-weight: 700;
+        font-size: 1.75rem;
+        line-height: 1;
+        font-family: var(--boxel-font-family);
+        letter-spacing: -0.025em;
       }
       .workspace-delete-summary-card {
-        padding: var(--boxel-sp-xs) var(--boxel-sp-sm);
+        padding: var(--boxel-sp) var(--boxel-sp-lg);
         color: var(--boxel-dark);
-        background: rgb(0 0 0 / 4%);
-        border: 1px solid rgb(0 0 0 / 8%);
-        border-radius: 0.75rem;
-        font: 600 var(--boxel-font-sm);
+        background: var(--boxel-50);
+        border: var(--boxel-border-card);
+        border-radius: var(--boxel-border-radius-xxl);
+      }
+      .workspace-delete-summary-row {
+        display: flex;
+        align-items: center;
+        gap: var(--boxel-sp-sm);
+      }
+      .workspace-delete-summary-icon {
+        flex-shrink: 0;
+        --boxel-realm-icon-size: var(--boxel-icon-lg);
+        --boxel-realm-icon-border-radius: 999px;
+        box-shadow: 0 0 0 2px rgb(255 255 255 / 90%);
+      }
+      .workspace-delete-summary-body {
+        display: flex;
+        flex-direction: column;
+        gap: var(--boxel-sp-6xs);
+      }
+      .workspace-delete-summary-name {
+        color: var(--boxel-dark);
+        font-weight: 700;
+        font-size: 1.125rem;
+        line-height: 1.15;
+        font-family: var(--boxel-font-family);
+        letter-spacing: -0.02em;
+      }
+      .workspace-delete-summary-text {
+        color: var(--boxel-450);
+        font-weight: 400;
+        font-size: var(--boxel-font-size-sm);
+        line-height: var(--boxel-line-height-sm);
+        font-family: var(--boxel-font-family);
       }
       .workspace-delete-danger-panel {
         display: flex;
         flex-direction: column;
-        gap: var(--boxel-sp-xs);
-        padding: var(--boxel-sp-sm);
-        background: rgb(255 80 80 / 6%);
-        border: 1px solid rgb(255 80 80 / 16%);
-        border-radius: 0.9rem;
+        gap: var(--boxel-sp-sm);
+        padding: var(--boxel-sp) var(--boxel-sp-lg);
+        background: rgb(255 90 90 / 9%);
+        border: 1px solid rgb(255 90 90 / 18%);
+        border-radius: var(--boxel-border-radius-xxl);
       }
       .workspace-delete-warning {
-        color: var(--boxel-700);
-        font: 500 var(--boxel-font-sm);
-        line-height: 1.4;
-      }
-      .workspace-delete-warning--strong {
         color: var(--boxel-dark);
         font-weight: 600;
+        font-size: var(--boxel-font-size-sm);
+        line-height: var(--boxel-line-height-sm);
+        font-family: var(--boxel-font-family);
+      }
+      .workspace-delete-warning--strong {
+        font-weight: 700;
+        font-size: var(--boxel-font-size);
+        line-height: var(--boxel-line-height);
       }
       .workspace-delete-published {
         display: flex;
         flex-direction: column;
-        gap: var(--boxel-sp-5xs);
-        padding: var(--boxel-sp-xs);
-        background: rgb(255 255 255 / 88%);
-        border-radius: 0.7rem;
+        gap: var(--boxel-sp-xs);
+        padding: var(--boxel-sp-sm) var(--boxel-sp);
+        background: var(--boxel-light);
+        border-radius: var(--boxel-border-radius-xl);
       }
       .workspace-delete-published-title {
         color: var(--boxel-dark);
-        font: 700 var(--boxel-font-xs);
-        letter-spacing: 0.02em;
+        font-weight: 700;
+        font-size: var(--boxel-font-size-sm);
+        line-height: 1.25;
+        font-family: var(--boxel-font-family);
       }
       .workspace-delete-published-list {
         margin: 0;
-        padding-left: 1rem;
+        padding-left: var(--boxel-sp);
         text-align: left;
       }
       .workspace-delete-published-list li + li {
@@ -353,12 +395,19 @@ export default class Workspace extends Component<Signature> {
       }
       .workspace-delete-published-list a {
         color: var(--boxel-blue);
-        font: 500 var(--boxel-font-xs);
-        line-height: 1.4;
+        font-weight: 600;
+        font-size: var(--boxel-font-size-sm);
+        line-height: var(--boxel-line-height-sm);
+        font-family: var(--boxel-font-family);
         word-break: break-all;
         text-decoration-thickness: 1px;
         text-underline-offset: 0.12em;
       }
+      :global(.workspace-delete-dialog) {
+        background-color: var(--boxel-light-100);
+        padding: var(--boxel-sp-xl) var(--boxel-sp-xl) var(--boxel-sp-lg);
+        border-radius: var(--boxel-border-radius-xxl);
+      }
     </style>
   </template>
 

From d98326a51e3860334de1638a00f23e63aa5a5afe Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Tue, 17 Mar 2026 10:29:09 +0100
Subject: [PATCH 21/24] Fix test to not leak localstorage

---
 .../workspace-chooser-delete-test.gts         | 30 +++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
index 13e8c06876b..c6064fc13dd 100644
--- a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -8,11 +8,13 @@ import { module, test } from 'qunit';
 import { SessionLocalStorageKey } from '@cardstack/host/utils/local-storage-keys';
 
 import {
+  createJWT,
   setupAcceptanceTestRealm,
   setupAuthEndpoints,
   setupLocalIndexing,
   setupRealmCacheTeardown,
   setupUserSubscription,
+  testRealmSecretSeed,
   visitOperatorMode,
 } from '../helpers';
 import { setupBaseRealm } from '../helpers/base-realm';
@@ -108,6 +110,10 @@ export class Person extends CardDef {}
     });
   });
 
+  hooks.afterEach(function () {
+    window.localStorage.removeItem(SessionLocalStorageKey);
+  });
+
   test('delete workspace is enabled only for a workspace created by the current user', async function (assert) {
     await visitOperatorMode({ workspaceChooserOpened: true });
 
@@ -132,8 +138,28 @@ export class Person extends CardDef {}
     window.localStorage.setItem(
       SessionLocalStorageKey,
       JSON.stringify({
-        [ownedRealmURL]: 'owned-token',
-        [sharedRealmURL]: 'shared-token',
+        [ownedRealmURL]: createJWT(
+          {
+            user: '@testuser:localhost',
+            realm: ownedRealmURL,
+            sessionRoom: 'owned-session-room',
+            realmServerURL: new URL(ownedRealmURL).origin,
+            permissions: ['read', 'write', 'realm-owner'],
+          },
+          '1 hour',
+          testRealmSecretSeed,
+        ),
+        [sharedRealmURL]: createJWT(
+          {
+            user: '@testuser:localhost',
+            realm: sharedRealmURL,
+            sessionRoom: 'shared-session-room',
+            realmServerURL: new URL(sharedRealmURL).origin,
+            permissions: ['read', 'write'],
+          },
+          '1 hour',
+          testRealmSecretSeed,
+        ),
       }),
     );
 

From 6f5edda835c3505af3f767c43527813a34a10cfd Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Tue, 17 Mar 2026 11:20:42 +0100
Subject: [PATCH 22/24] Allow workspace deletion for realm owners

---
 .../workspace-chooser/workspace.gts           | 16 +------
 packages/host/app/services/realm.ts           |  8 ++++
 .../workspace-chooser-delete-test.gts         | 42 +++++++++++++++++--
 3 files changed, 48 insertions(+), 18 deletions(-)

diff --git a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
index 3933934c5ae..4f9b21a5c22 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
@@ -473,22 +473,8 @@ export default class Workspace extends Component<Signature> {
     };
   }
 
-  private get createdByCurrentUser() {
-    let currentUserName = this.matrixService.userName;
-    if (!currentUserName) {
-      return false;
-    }
-    let segments = new URL(this.args.realmURL).pathname
-      .split('/')
-      .filter(Boolean);
-    if (segments.length < 2) {
-      return false;
-    }
-    return segments[segments.length - 2] === currentUserName;
-  }
-
   private get canDeleteWorkspace() {
-    return this.createdByCurrentUser && this.realm.canWrite(this.args.realmURL);
+    return this.realm.isRealmOwner(this.args.realmURL);
   }
 
   private get deleteWorkspaceDisabled() {
diff --git a/packages/host/app/services/realm.ts b/packages/host/app/services/realm.ts
index 582b1945fed..46572dbf3bf 100644
--- a/packages/host/app/services/realm.ts
+++ b/packages/host/app/services/realm.ts
@@ -189,6 +189,10 @@ class RealmResource {
     return !!this.claims?.permissions?.includes('write');
   }
 
+  get isRealmOwner() {
+    return !!this.claims?.permissions?.includes('realm-owner');
+  }
+
   private loggingIn: Promise<void> | undefined;
 
   async login(): Promise<void> {
@@ -857,6 +861,10 @@ export default class RealmService extends Service {
     return this.knownRealm(url)?.canWrite ?? false;
   };
 
+  isRealmOwner = (url: string): boolean => {
+    return this.knownRealm(url)?.isRealmOwner ?? false;
+  };
+
   url = (url: string): string | undefined => {
     return this.knownRealm(url)?.url;
   };
diff --git a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
index c6064fc13dd..1c0cb5d1cb7 100644
--- a/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-delete-test.gts
@@ -24,6 +24,8 @@ import { setupApplicationTest } from '../helpers/setup';
 
 const ownedRealmURL = 'http://test-realm/testuser/owned-workspace/';
 const sharedRealmURL = 'http://test-realm/otheruser/shared-workspace/';
+const delegatedOwnerRealmURL =
+  'http://test-realm/otheruser/delegated-owner-workspace/';
 
 module('Acceptance | workspace-chooser-delete', function (hooks) {
   setupApplicationTest(hooks);
@@ -32,7 +34,7 @@ module('Acceptance | workspace-chooser-delete', function (hooks) {
 
   let mockMatrixUtils = setupMockMatrix(hooks, {
     loggedInAs: '@testuser:localhost',
-    activeRealms: [ownedRealmURL, sharedRealmURL],
+    activeRealms: [ownedRealmURL, sharedRealmURL, delegatedOwnerRealmURL],
   });
 
   setupBaseRealm(hooks);
@@ -108,13 +110,40 @@ export class Person extends CardDef {}
         },
       },
     });
+
+    await setupAcceptanceTestRealm({
+      realmURL: delegatedOwnerRealmURL,
+      mockMatrixUtils,
+      permissions: {
+        '@testuser:localhost': ['read', 'write', 'realm-owner'],
+        '@otheruser:localhost': ['read', 'write', 'realm-owner'],
+      },
+      contents: {
+        '.realm.json': {
+          name: 'Delegated Owner Workspace',
+          backgroundURL: null,
+          iconURL: null,
+        },
+        'index.json': {
+          data: {
+            type: 'card',
+            meta: {
+              adoptsFrom: {
+                module: 'https://cardstack.com/base/cards-grid',
+                name: 'CardsGrid',
+              },
+            },
+          },
+        },
+      },
+    });
   });
 
   hooks.afterEach(function () {
     window.localStorage.removeItem(SessionLocalStorageKey);
   });
 
-  test('delete workspace is enabled only for a workspace created by the current user', async function (assert) {
+  test('delete workspace is enabled only for a workspace the current user owns', async function (assert) {
     await visitOperatorMode({ workspaceChooserOpened: true });
 
     await click(`[data-test-workspace-menu-trigger="${ownedRealmURL}"]`);
@@ -126,9 +155,16 @@ export class Person extends CardDef {}
     assert
       .dom('[data-test-boxel-menu-item-text="Delete workspace"]')
       .hasAttribute('disabled');
+
+    await click(
+      `[data-test-workspace-menu-trigger="${delegatedOwnerRealmURL}"]`,
+    );
+    assert
+      .dom('[data-test-boxel-menu-item-text="Delete workspace"]')
+      .doesNotHaveAttribute('disabled');
   });
 
-  test('can delete a workspace created by the current user from the chooser', async function (assert) {
+  test('can delete a workspace the current user owns from the chooser', async function (assert) {
     await visitOperatorMode({
       workspaceChooserOpened: true,
       stacks: [[{ id: `${ownedRealmURL}index`, format: 'isolated' }]],

From e26502b230e48b443f9aceac5a2c4af1615ad138 Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Tue, 17 Mar 2026 11:42:46 +0100
Subject: [PATCH 23/24] Design tweaks

---
 .../operator-mode/workspace-chooser/workspace.gts    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
index 4f9b21a5c22..155eb2b4ee8 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/workspace.gts
@@ -301,15 +301,15 @@ export default class Workspace extends Component<Signature> {
         margin: 0;
       }
       .workspace-delete-header {
-        padding: 0;
+        padding-bottom: var(--boxel-sp);
       }
       .workspace-delete-title {
         color: var(--boxel-dark);
-        font-weight: 700;
-        font-size: 1.75rem;
-        line-height: 1;
+        font-weight: 600;
+        font-size: var(--boxel-font-size-xl);
+        line-height: 1.1;
         font-family: var(--boxel-font-family);
-        letter-spacing: -0.025em;
+        letter-spacing: -0.02em;
       }
       .workspace-delete-summary-card {
         padding: var(--boxel-sp) var(--boxel-sp-lg);
@@ -405,7 +405,7 @@ export default class Workspace extends Component<Signature> {
       }
       :global(.workspace-delete-dialog) {
         background-color: var(--boxel-light-100);
-        padding: var(--boxel-sp-xl) var(--boxel-sp-xl) var(--boxel-sp-lg);
+        padding: var(--boxel-sp-2xl) var(--boxel-sp-2xl) var(--boxel-sp-xl);
         border-radius: var(--boxel-border-radius-xxl);
       }
     </style>

From 60555fb62e300cdb26622ca49683c45335e28aae Mon Sep 17 00:00:00 2001
From: Matic Jurglic <matic@jurglic.si>
Date: Wed, 18 Mar 2026 08:59:34 +0100
Subject: [PATCH 24/24] Cancel running indexing jobs before realm deletion

---
 .../handlers/realm-destruction-utils.ts       |  9 ++-
 .../server-endpoints/delete-realm-test.ts     | 59 ++++++++++++++++---
 2 files changed, 58 insertions(+), 10 deletions(-)

diff --git a/packages/realm-server/handlers/realm-destruction-utils.ts b/packages/realm-server/handlers/realm-destruction-utils.ts
index c6026871da0..2ebdb70e7de 100644
--- a/packages/realm-server/handlers/realm-destruction-utils.ts
+++ b/packages/realm-server/handlers/realm-destruction-utils.ts
@@ -3,7 +3,12 @@ import type {
   Realm,
   VirtualNetwork,
 } from '@cardstack/runtime-common';
-import { ensureTrailingSlash, param, query } from '@cardstack/runtime-common';
+import {
+  cancelRunningJobsInConcurrencyGroup,
+  ensureTrailingSlash,
+  param,
+  query,
+} from '@cardstack/runtime-common';
 import { pathExistsSync, readdirSync, removeSync } from 'fs-extra';
 import { join, relative } from 'path';
 
@@ -134,6 +139,8 @@ export async function removeRealmDatabaseArtifacts(args: {
   realmURL: string;
 }) {
   let { dbAdapter, realmURL } = args;
+  await cancelRunningJobsInConcurrencyGroup(dbAdapter, `indexing:${realmURL}`);
+
   let pendingJobs = (await query(dbAdapter, [
     `SELECT id FROM jobs WHERE concurrency_group =`,
     param(`indexing:${realmURL}`),
diff --git a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
index 5ccd08e46b9..fb8d1cb76b5 100644
--- a/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
+++ b/packages/realm-server/tests/server-endpoints/delete-realm-test.ts
@@ -235,11 +235,11 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
       );
     }
 
-    let pendingSourceJob = await insertJob(context.dbAdapter, {
+    let runningSourceJob = await insertJob(context.dbAdapter, {
       job_type: 'from-scratch-index',
       concurrency_group: `indexing:${realmURL}`,
     });
-    let pendingPublishedJob = await insertJob(context.dbAdapter, {
+    let runningPublishedJob = await insertJob(context.dbAdapter, {
       job_type: 'from-scratch-index',
       concurrency_group: `indexing:${publishedRealmURL}`,
     });
@@ -249,10 +249,10 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
     });
     await context.dbAdapter.execute(`INSERT INTO job_reservations
       (job_id, locked_until, worker_id)
-      VALUES (${pendingSourceJob.id}, NOW() + INTERVAL '5 minutes', 'worker-source')`);
+      VALUES (${runningSourceJob.id}, NOW() + INTERVAL '5 minutes', 'worker-source')`);
     await context.dbAdapter.execute(`INSERT INTO job_reservations
       (job_id, locked_until, worker_id)
-      VALUES (${pendingPublishedJob.id}, NOW() + INTERVAL '5 minutes', 'worker-published')`);
+      VALUES (${runningPublishedJob.id}, NOW() + INTERVAL '5 minutes', 'worker-published')`);
     await context.dbAdapter.execute(`INSERT INTO job_reservations
       (job_id, locked_until, worker_id)
       VALUES (${unrelatedJob.id}, NOW() + INTERVAL '5 minutes', 'worker-unrelated')`);
@@ -532,24 +532,65 @@ module(`server-endpoints/${basename(__filename)}`, function (hooks) {
       'unrelated pending jobs remain',
     );
 
+    let [sourceJobAfterDelete] = await context.dbAdapter.execute(
+      `SELECT status, result, finished_at FROM jobs WHERE id = ${runningSourceJob.id}`,
+    );
+    let [publishedJobAfterDelete] = await context.dbAdapter.execute(
+      `SELECT status, result, finished_at FROM jobs WHERE id = ${runningPublishedJob.id}`,
+    );
+    assert.strictEqual(
+      sourceJobAfterDelete.status,
+      'rejected',
+      'running source realm job is canceled before cleanup',
+    );
+    assert.deepEqual(
+      sourceJobAfterDelete.result,
+      {
+        status: 418,
+        message: 'User initiated job cancellation',
+      },
+      'source realm running job gets the cancellation result',
+    );
+    assert.ok(
+      sourceJobAfterDelete.finished_at,
+      'source realm running job is marked finished',
+    );
+    assert.strictEqual(
+      publishedJobAfterDelete.status,
+      'rejected',
+      'running published realm job is canceled before cleanup',
+    );
+    assert.deepEqual(
+      publishedJobAfterDelete.result,
+      {
+        status: 418,
+        message: 'User initiated job cancellation',
+      },
+      'published realm running job gets the cancellation result',
+    );
+    assert.ok(
+      publishedJobAfterDelete.finished_at,
+      'published realm running job is marked finished',
+    );
+
     let sourceReservations = await context.dbAdapter.execute(
-      `SELECT * FROM job_reservations WHERE job_id = ${pendingSourceJob.id}`,
+      `SELECT * FROM job_reservations WHERE job_id = ${runningSourceJob.id} AND completed_at IS NULL`,
     );
     let publishedReservations = await context.dbAdapter.execute(
-      `SELECT * FROM job_reservations WHERE job_id = ${pendingPublishedJob.id}`,
+      `SELECT * FROM job_reservations WHERE job_id = ${runningPublishedJob.id} AND completed_at IS NULL`,
     );
     let unrelatedReservations = await context.dbAdapter.execute(
-      `SELECT * FROM job_reservations WHERE job_id = ${unrelatedJob.id}`,
+      `SELECT * FROM job_reservations WHERE job_id = ${unrelatedJob.id} AND completed_at IS NULL`,
     );
     assert.strictEqual(
       sourceReservations.length,
       0,
-      'source realm job reservations are removed',
+      'source realm running job reservations are completed',
     );
     assert.strictEqual(
       publishedReservations.length,
       0,
-      'published realm job reservations are removed',
+      'published realm running job reservations are completed',
     );
     assert.strictEqual(
       unrelatedReservations.length,