vibecarbon 0.1.0

package/src/destroy.js

@@ -0,0 +1,2033 @@
+/**
+ * Vibecarbon Destroy Command
+ * Safely tears down cloud resources created by deploy command
+ *
+ * Usage:
+ *   vibecarbon destroy                    # Interactive destruction
+ *   vibecarbon destroy --env prod         # Destroy specific environment
+ *   vibecarbon destroy --env prod --yes   # Skip confirmation
+ */
+
+import { existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import * as p from '@clack/prompts';
+import { runCommand } from './lib/command.js';
+
+// Handle Ctrl+C — without this, SIGINT is swallowed during subprocess/fetch
+// calls and the process continues to the next cleanup step instead of exiting.
+process.on('SIGINT', () => {
+  p.cancel('Operation cancelled.');
+  process.exit(130);
+});
+process.on('SIGTERM', () => {
+  process.exit(143);
+});
+
+import { renderHelp } from './lib/cli/help.js';
+import { parseFlags } from './lib/cli/parse-flags.js';
+import { requireTTYOrFlags } from './lib/cli/tty-guard.js';
+import {
+  deleteDNSRecord as cloudflareDeleteDNSRecord,
+  deleteHealthCheck as cloudflareDeleteHealthCheck,
+} from './lib/cloudflare.js';
+import { c, printBanner } from './lib/colors.js';
+import { loadCredentials, loadProjectConfig, saveProjectConfig } from './lib/config.js';
+import { fetchWithRetry } from './lib/fetch-retry.js';
+import {
+  deleteDNSRecord as hetznerDnsDeleteRecord,
+  getZone as hetznerDnsGetZone,
+} from './lib/hetzner-dns.js';
+import { getApiToken, getS3Credentials } from './lib/hetzner-guided-setup.js';
+import { perfAsync } from './lib/perf.js';
+import { assertInProjectDir } from './lib/project-guard.js';
+import { HetznerS3Provider, sanitizeBucketName } from './lib/providers/hetzner-s3.js';
+import { createTracker } from './lib/tracker.js';
+import { VERSION } from './lib/version.js';
+
+/**
+ * Returns true for environment names that require a type-to-confirm prompt
+ * even when --yes is passed. Currently: prod and production (case-insensitive).
+ * Exported for testing.
+ */
+export function requiresProdTypeToConfirm(envName) {
+  if (!envName) return false;
+  return /^(prod|production)$/i.test(envName);
+}
+
+// ============================================================================
+// CLI ARGUMENT PARSING
+// ============================================================================
+
+// ============================================================================
+// COMMAND SPEC — single source of truth for argv parsing AND help output.
+// ============================================================================
+
+/** @type {import('./lib/cli/parse-flags.js').CommandSpec & { summary?: string, description?: string, examples?: Array<{ command: string, description?: string }> }} */
+const SPEC = {
+  name: 'destroy',
+  summary: 'Tear down a cloud environment',
+  description: [
+    'WARNING: this is irreversible. The following are deleted:',
+    '  • Hetzner servers and all data on them',
+    '  • Hetzner volumes (orphaned PVCs from Kubernetes)',
+    '  • Hetzner firewalls',
+    '  • Hetzner SSH keys (deployment keys only)',
+    '  • Cloudflare DNS records and health checks',
+    '  • GitHub environment secrets',
+  ].join('\n'),
+  positional: [
+    {
+      name: 'env',
+      optional: true,
+      description: 'Environment to destroy (skips the env prompt)',
+    },
+  ],
+  flags: [
+    { name: 'h', boolean: true, description: 'Show this help' },
+    { name: 'v', boolean: true, description: 'Show version' },
+    { name: 'y', boolean: true, description: 'Skip confirmation prompts' },
+    { name: 'env', value: '<name>', description: 'Environment seed (alternative to positional)' },
+    {
+      name: 'orphans',
+      boolean: true,
+      description: 'Destroy stray Pulumi stacks not tracked in config',
+    },
+    {
+      name: 'purge',
+      boolean: true,
+      description: 'Also delete the backup S3 bucket (default: preserved)',
+    },
+  ],
+  examples: [
+    { command: 'vibecarbon destroy', description: 'prompts for env' },
+    { command: 'vibecarbon destroy prod', description: 'env seeded' },
+    {
+      command: 'vibecarbon destroy prod -y',
+      description: 'destroy without confirmation (dangerous!)',
+    },
+    {
+      command: 'vibecarbon destroy prod -y -purge',
+      description: 'also delete the backup bucket',
+    },
+  ],
+};
+
+// ============================================================================
+// ORPHAN PULUMI STACK DETECTION
+// ============================================================================
+
+/**
+ * Find Pulumi stacks in the configured backend that aren't tracked in
+ * .vibecarbon.json. Pulumi state is authoritative — if a stack exists
+ * there but the env isn't in our project config (or its HA sibling), it's
+ * an orphan left behind by an interrupted deploy.
+ */
+async function findOrphanPulumiStacks(projectConfig) {
+  const { listStacks } = await import('./lib/iac/index.js');
+  const stackNames = await listStacks({ s3Config: projectConfig?.s3Config });
+  const trackedEnvs = new Set(
+    Object.keys(projectConfig?.environments ?? {}).flatMap((env) => [
+      env,
+      `${env}-primary`,
+      `${env}-standby`,
+    ]),
+  );
+  return stackNames
+    .filter((name) => !trackedEnvs.has(name))
+    .map((name) => ({ name, path: `pulumi:${name}`, stateFile: `pulumi:${name}` }));
+}
+
+/**
+ * Remove local SSH keys, known_hosts, kubeconfigs, and deploy-state for the
+ * given environment. Idempotent — files that don't exist are skipped.
+ *
+ * Why: the deploy-state file marks `s3-setup` (and other steps) as completed,
+ * keyed by an inputs hash. After `destroy` deletes the project's S3 bucket,
+ * a subsequent `vibecarbon deploy` (e.g. e2e restore step's re-deploy)
+ * computes the same hash, shouldSkip returns true, and Pulumi tries to use
+ * the just-deleted bucket — failing with NoSuchBucket on `pulumi stack
+ * select`. The deploy-state file is on the cleanup list at the bottom of
+ * destroy.js, but the compose and compose-ha branches each `return;` early,
+ * bypassing the cleanup. Factor it out and call from each early return —
+ * observed in compose restore re-deploys hitting this exact NoSuchBucket
+ * error.
+ */
+/**
+ * Release all Hetzner CSI volumes via the cluster's own finalizers
+ * before Pulumi tears the cluster down, so the underlying volumes
+ * don't leak into the post-destroy orphan sweep.
+ *
+ * Approaches tried:
+ *   - `kubectl delete pvc --all --wait=true`. Failed — PVCs have a
+ *     kubernetes.io/pvc-protection finalizer that blocks delete while
+ *     a Pod is bound, so the wait burned the full 180s while
+ *     supabase-db-0 still held its PVC. 4 orphans.
+ *   - Delete Pods first (--wait=false), then PVCs. Failed for the
+ *     same end result — supabase-db is a StatefulSet, so its
+ *     controller recreated the deleted Pod within seconds and
+ *     re-bound the PVC. Same 4 orphans on the 2026-04-28 rerun.
+ *   - Current: delete the entire vibecarbon namespace. The namespace
+ *     controller handles dependency ordering automatically —
+ *     workload controllers (StatefulSet,
+ *     Deployment) get deleted FIRST so they stop recreating Pods,
+ *     then Pods drain, then PVCs lose their pvc-protection
+ *     finalizers, then PVs trigger the Hetzner CSI controller
+ *     (still alive in kube-system; we only touch the vibecarbon
+ *     namespace) to delete the underlying volumes via the PV's
+ *     reclaim policy.
+ *
+ * Best-effort: any failure (cluster unreachable, kubectl missing,
+ * already-gone resources) is logged and swallowed so the destroy
+ * continues to Pulumi destroy + sweep.
+ *
+ * @param {string} kubeconfigPath
+ */
+export async function cleanupClusterPVCs(kubeconfigPath) {
+  if (!existsSync(kubeconfigPath)) return;
+  try {
+    runCommand(
+      [
+        'kubectl',
+        '--kubeconfig',
+        kubeconfigPath,
+        'delete',
+        'namespace',
+        'vibecarbon',
+        '--wait=true',
+        '--timeout=240s',
+        '--ignore-not-found=true',
+      ],
+      { silent: true, ignoreError: true, returnOutput: false },
+    );
+  } catch {
+    // best-effort: post-destroy sweep is the safety net
+  }
+}
+
+function cleanupLocalEnvFiles(cwd, envName) {
+  const cleanupPaths = [
+    join(cwd, '.vibecarbon', `deploy_key_${envName}`),
+    join(cwd, '.vibecarbon', `deploy_key_${envName}.pub`),
+    join(cwd, '.vibecarbon', `ssh-${envName}`),
+    join(cwd, '.vibecarbon', `ssh-${envName}.pub`),
+    join(cwd, '.vibecarbon', `known_hosts_${envName}`),
+    join(cwd, '.vibecarbon', `known_hosts_${envName}-primary`),
+    join(cwd, '.vibecarbon', `known_hosts_${envName}-standby`),
+    join(cwd, '.vibecarbon', `kubeconfig-${envName}`),
+    join(cwd, '.vibecarbon', `kubeconfig-${envName}-primary`),
+    join(cwd, '.vibecarbon', `kubeconfig-${envName}-standby`),
+    // k8s-HA uses per-cluster StateTrackers, so the deploy-state file
+    // splits across `<env>`, `<env>-primary`, `<env>-standby`. All three
+    // must be cleaned to prevent the next deploy's shouldSkip from matching
+    // a stale hash and reusing a deleted bucket.
+    join(cwd, '.vibecarbon', `deploy-state-${envName}.json`),
+    join(cwd, '.vibecarbon', `deploy-state-${envName}-primary.json`),
+    join(cwd, '.vibecarbon', `deploy-state-${envName}-standby.json`),
+  ];
+  for (const path of cleanupPaths) {
+    try {
+      if (existsSync(path)) rmSync(path);
+    } catch {
+      // best-effort
+    }
+  }
+}
+
+async function destroyOrphanPulumiStack(orphan, { apiToken, s3Config }) {
+  // Destroy the orphan stack via the k8s destroy helper, which runs
+  // `pulumi destroy` + `removeStack`. Compose orphans also use the same
+  // underlying stack name → this works for both.
+  //
+  // apiToken + s3Config flow in from the caller (loaded from
+  // ~/.vibecarbon/credentials.json + projectConfig). Reading
+  // HCLOUD_TOKEN only from process.env left interactive runs failing
+  // with "Missing Hetzner Cloud API token" because operators don't
+  // export the token in their shell — it lives in credentials.json,
+  // and every other code path in destroy.js loads it the same way.
+  const { destroyK8s } = await import('./lib/deploy/k8s/index.js');
+  await destroyK8s({
+    projectName: 'vibecarbon',
+    environment: orphan.name,
+    apiToken,
+    s3Config,
+    region: 'nbg1',
+  });
+}
+
+// ============================================================================
+// HETZNER CLEANUP
+// ============================================================================
+
+async function hetznerDeleteServer(apiToken, serverId) {
+  const response = await fetchWithRetry(`https://api.hetzner.cloud/v1/servers/${serverId}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  if (!response.ok && response.status !== 404) {
+    const error = await response.json();
+    throw new Error(`Failed to delete server: ${JSON.stringify(error)}`);
+  }
+
+  // Hetzner's DELETE is async — it returns 202 and the actual VM teardown
+  // continues for several seconds. If a destroy → re-deploy cycle (compose
+  // restore step) creates a fresh server with the same name before the old
+  // one is gone, Pulumi 409s with 'server name is already used
+  // (uniqueness_error)'. Poll GET /servers/{id} until it returns 404, with
+  // a 90s deadline (empirical delete time on cx23 is well under that).
+  // Observed during compose restore. The same delete-then-poll fix is
+  // applied in destroyComposeHA.
+  if (response.status !== 404) {
+    const deadline = Date.now() + 90_000;
+    while (Date.now() < deadline) {
+      try {
+        const probe = await fetch(`https://api.hetzner.cloud/v1/servers/${serverId}`, {
+          headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (probe.status === 404) break;
+      } catch {
+        // Transient — retry next loop iteration
+      }
+      await new Promise((r) => setTimeout(r, 2_000));
+    }
+  }
+
+  return response.status !== 404;
+}
+
+async function hetznerDeleteFirewall(apiToken, name) {
+  // Use Hetzner's `?name=<exact>` filter, not a global list-then-find.
+  // Hetzner's default `per_page=25` plus an unfiltered list silently hides
+  // the project's firewalls when 25+ leaked firewalls accumulate, so the
+  // destroy no-ops and the next deploy collides on "name is already used"
+  // (also fixed identically in destroyComposeHA).
+  const headers = { Authorization: `Bearer ${apiToken}` };
+  const lookupUrl = `https://api.hetzner.cloud/v1/firewalls?name=${encodeURIComponent(name)}`;
+  const deadlineMs = 30_000;
+  const start = Date.now();
+  let everExisted = false;
+  while (Date.now() - start < deadlineMs) {
+    const listResp = await fetchWithRetry(lookupUrl, { headers });
+    const { firewalls } = await listResp.json();
+    const fw = firewalls?.[0];
+    if (!fw) return everExisted;
+    everExisted = true;
+    if (fw.applied_to?.length > 0) {
+      const serverResources = fw.applied_to
+        .filter((a) => a.type === 'server' && a.server?.id)
+        .map((a) => ({ type: 'server', server: { id: a.server.id } }));
+      if (serverResources.length > 0) {
+        try {
+          await fetchWithRetry(
+            `https://api.hetzner.cloud/v1/firewalls/${fw.id}/actions/remove_from_resources`,
+            {
+              method: 'POST',
+              headers: { ...headers, 'Content-Type': 'application/json' },
+              body: JSON.stringify({ remove_from: serverResources }),
+            },
+          );
+        } catch {
+          // Servers may already be gone — proceed to DELETE anyway
+        }
+      }
+    }
+    const delResp = await fetchWithRetry(`https://api.hetzner.cloud/v1/firewalls/${fw.id}`, {
+      method: 'DELETE',
+      headers,
+    });
+    if (delResp.ok || delResp.status === 404) return true;
+    // 409 = still attached; back off and re-look-up to refresh applied_to.
+    await new Promise((r) => setTimeout(r, 3_000));
+  }
+  return false;
+}
+
+async function hetznerDeleteSSHKey(apiToken, name) {
+  // Use Hetzner's `?name=<exact>` filter instead of listing everything and
+  // filtering client-side. Without this, when the project (or test matrix)
+  // accumulates 50+ SSH keys, the key we want falls off page 1 of the
+  // unpaginated list and destroy silently no-ops with "not found" — exactly
+  // the same bug that hit firewalls (also fixed there). Observed in
+  // 2026-04-27 morning matrix: compose destroy reported "SSH key not found",
+  // then the next deploy hit `409 SSH key not unique` because the key was
+  // actually still in Hetzner.
+  const listResponse = await fetchWithRetry(
+    `https://api.hetzner.cloud/v1/ssh_keys?name=${encodeURIComponent(name)}`,
+    { headers: { Authorization: `Bearer ${apiToken}` } },
+  );
+
+  const { ssh_keys } = await listResponse.json();
+  const sshKey = ssh_keys?.[0];
+
+  if (!sshKey) return false;
+
+  const response = await fetchWithRetry(`https://api.hetzner.cloud/v1/ssh_keys/${sshKey.id}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  return response.ok || response.status === 404;
+}
+
+async function hetznerListServers(apiToken) {
+  const response = await fetchWithRetry('https://api.hetzner.cloud/v1/servers?per_page=50', {
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  if (!response.ok) {
+    return [];
+  }
+
+  const data = await response.json();
+  return data.servers || [];
+}
+
+async function hetznerListNetworks(apiToken) {
+  const response = await fetchWithRetry('https://api.hetzner.cloud/v1/networks', {
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  if (!response.ok) {
+    return [];
+  }
+
+  const data = await response.json();
+  return data.networks || [];
+}
+
+async function hetznerListVolumes(apiToken) {
+  const response = await fetchWithRetry('https://api.hetzner.cloud/v1/volumes', {
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  if (!response.ok) {
+    return [];
+  }
+
+  const data = await response.json();
+  return data.volumes || [];
+}
+
+async function hetznerDeleteVolume(apiToken, volumeId) {
+  const response = await fetchWithRetry(`https://api.hetzner.cloud/v1/volumes/${volumeId}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  return response.ok || response.status === 404;
+}
+
+async function hetznerListLoadBalancers(apiToken) {
+  const response = await fetchWithRetry('https://api.hetzner.cloud/v1/load_balancers', {
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  if (!response.ok) {
+    return [];
+  }
+
+  const data = await response.json();
+  return data.load_balancers || [];
+}
+
+async function hetznerDeleteLoadBalancer(apiToken, lbId) {
+  const response = await fetchWithRetry(`https://api.hetzner.cloud/v1/load_balancers/${lbId}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${apiToken}` },
+  });
+
+  return response.ok || response.status === 404;
+}
+
+/**
+ * Find and delete load balancers created by Hetzner CCM (Kubernetes cloud controller manager).
+ * These are provisioned automatically when a LoadBalancer Service is created in k8s,
+ * not by the Pulumi program, so they aren't tracked in stack state and need
+ * direct API cleanup.
+ */
+async function hetznerCleanupLoadBalancers(apiToken, projectName, envName) {
+  const clusterName = `${projectName}-${envName}`;
+
+  // Look up the cluster's private network ID so we can match LBs by network attachment.
+  // This is more reliable than label/name matching because Hetzner CCM uses a random UID
+  // as the LB name by default (not the cluster name).
+  let clusterNetworkId = null;
+  try {
+    const networks = await hetznerListNetworks(apiToken);
+    const clusterNetwork = networks.find((n) => n.name === `${clusterName}-network`);
+    clusterNetworkId = clusterNetwork?.id ?? null;
+  } catch {
+    // Non-fatal; fall back to label/name matching only
+  }
+
+  const loadBalancers = await hetznerListLoadBalancers(apiToken);
+  const deleted = [];
+
+  for (const lb of loadBalancers) {
+    const lbName = lb.name || '';
+    const lbLabels = lb.labels || {};
+
+    // CCM-created LBs have a label like: kubernetes.io/cluster/<cluster-name> = "owned"
+    // or the name contains the cluster identifier. Always match on the full cluster name
+    // (projectName + envName) to avoid deleting LBs belonging to other environments.
+    const clusterKey = Object.keys(lbLabels).find((k) => k.startsWith('kubernetes.io/cluster/'));
+    const matchesCluster = clusterKey?.includes(clusterName);
+    const matchesName = lbName.includes(clusterName);
+    // Also match by private network attachment — the CCM attaches LBs to the cluster network.
+    const matchesNetwork =
+      clusterNetworkId !== null && lb.private_net?.some((n) => n.network_id === clusterNetworkId);
+    // Traefik service annotation uses {{PROJECT_NAME}}-lb (no envName suffix).
+    // Match both the short form and the long form to cover all conventions.
+    const matchesStandardName =
+      lbName === `${projectName}-lb` || lbName === `${projectName}-${envName}-lb`;
+
+    if (matchesCluster || matchesName || matchesStandardName || matchesNetwork) {
+      try {
+        const ok = await hetznerDeleteLoadBalancer(apiToken, lb.id);
+        if (ok) deleted.push(lbName);
+      } catch {
+        // Continue with other LBs if one fails
+      }
+    }
+  }
+
+  return deleted;
+}
+
+/**
+ * Sweep cluster-autoscaler-spawned Hetzner servers BEFORE `pulumi destroy`.
+ *
+ * CA-spawned servers exist outside Pulumi state. If they remain attached to
+ * the cluster network when `pulumi destroy` runs, the network/firewall
+ * destroy fails with "still in use". This function removes them via the
+ * Hetzner Cloud API directly (no SSH, no Pulumi state).
+ *
+ * Match strategy (in priority order):
+ * 1. Hetzner server label `cluster-autoscaler/node: worker-pool` —
+ *    attached at server-create time by CA's hcloud provider, which reads
+ *    it from `HCLOUD_CLUSTER_CONFIG.nodeConfigs.worker-pool.serverLabels`
+ *    (Phase 4).
+ * 2. Fallback: server in the cluster network whose labels lack BOTH
+ *    `cluster-autoscaler/node` AND `role` (the old role-based heuristic).
+ *    Handles the upgrade case where pre-Phase-4 CA workers were spawned
+ *    without the explicit label.
+ *
+ * Static (Pulumi-managed) workers carry `cluster-autoscaler/node: static`
+ * (Phase 3) so they're explicitly excluded by both matchers.
+ *
+ * Per feedback_orphan_auto_destroy_hazard.md: this is in-scope cleanup of
+ * an EXPLICIT destroy target (the user invoked `vibecarbon destroy <env>`),
+ * NOT orphan destruction across foreign Pulumi stacks. No
+ * `-orphans` requirement.
+ *
+ * @param {string} apiToken - Hetzner Cloud API token (write scope required).
+ * @param {string} clusterName - The cluster's Pulumi-naming prefix
+ *                               (`<projectName>-<environment>`). Used to
+ *                               find the cluster's private network by name
+ *                               `<clusterName>-network`.
+ * @returns {Promise<{deleted: string[], volumeIds: number[]}>}
+ */
+async function hetznerCleanupAutoscalerWorkers(apiToken, clusterName) {
+  // Find the cluster's private network by name (matches Pulumi resource name).
+  const networks = await hetznerListNetworks(apiToken);
+  const clusterNetwork = networks.find((n) => n.name === `${clusterName}-network`);
+  if (!clusterNetwork) {
+    return { deleted: [], volumeIds: [] };
+  }
+
+  const servers = await hetznerListServers(apiToken);
+
+  // Match strategy: label-primary, in-network-without-role-label fallback.
+  // Pulumi-managed roles for compatibility with pre-Phase-3 deploys.
+  const PULUMI_ROLES = new Set(['master', 'supabase', 'worker']);
+  const caServers = servers.filter((server) => {
+    const inClusterNetwork = server.private_net?.some((n) => n.network_id === clusterNetwork.id);
+    if (!inClusterNetwork) return false;
+
+    const labels = server.labels || {};
+    // PRIMARY: explicit CA-spawned label (Phase 4).
+    if (labels['cluster-autoscaler/node'] === 'worker-pool') return true;
+    // EXCLUDE: explicit static-worker label (Phase 3).
+    if (labels['cluster-autoscaler/node'] === 'static') return false;
+    // FALLBACK (upgrade path / missing labels): in-network without a
+    // recognized role label is treated as CA-spawned.
+    const role = labels.role;
+    return !role || !PULUMI_ROLES.has(role);
+  });
+
+  if (caServers.length === 0) {
+    return { deleted: [], volumeIds: [] };
+  }
+
+  // Collect attached volume IDs before deletion so the downstream volume
+  // sweep can reap dangling CSI PVCs even after the server records are gone.
+  const volumeIds = caServers.flatMap((server) => server.volumes || []);
+
+  const deleted = [];
+  for (const server of caServers) {
+    try {
+      const ok = await hetznerDeleteServer(apiToken, server.id);
+      if (ok) deleted.push(server.name);
+    } catch {
+      // Continue with remaining servers — best-effort cleanup. The
+      // post-Pulumi orphan sweep is the safety net for stragglers.
+    }
+  }
+
+  return { deleted, volumeIds };
+}
+
+/**
+ * Find and delete orphaned volumes created by Kubernetes CSI driver.
+ * These volumes are created via PersistentVolumeClaims and persist after server deletion.
+ *
+ * @param {string[]} knownVolumeIds - Volume IDs we know belong to this cluster.
+ *   These are deleted regardless of name matching.
+ */
+async function hetznerCleanupOrphanedVolumes(
+  apiToken,
+  projectName,
+  envName,
+  serverNames,
+  knownVolumeIds = [],
+  clusterLocations = [],
+) {
+  const volumes = await hetznerListVolumes(apiToken);
+  const deletedVolumes = [];
+  const knownIdSet = new Set(knownVolumeIds);
+
+  for (const volume of volumes) {
+    // Check if volume is unattached (server is null or deleted)
+    if (volume.server !== null) continue;
+
+    const volumeName = volume.name || '';
+    const volumeLabels = volume.labels || {};
+
+    // Match by cluster name, CSI cluster label, or server name in the volume name.
+    // Always use the full cluster name (projectName + envName) to avoid matching volumes
+    // belonging to other environments of the same project.
+    const clusterName = `${projectName}-${envName}`;
+    const matchesProject =
+      volumeName.includes(clusterName) ||
+      volumeLabels['kubernetes.io/cluster'] === clusterName ||
+      serverNames.some((s) => volumeName.includes(s));
+
+    // Also match any volume IDs the caller explicitly told us belong to this cluster.
+    const isKnownClusterVolume = knownIdSet.has(volume.id);
+
+    // Unattached pvc-* volumes in the cluster's datacenter(s) are CSI-created for this cluster.
+    // Hetzner CSI names volumes pvc-<uuid>, so name/label matching won't find them.
+    const isPvcInClusterLocation =
+      clusterLocations.length > 0 &&
+      clusterLocations.includes(volume.location?.name) &&
+      volumeName.startsWith('pvc-');
+
+    // CSI namespace label (populated when --extra-create-metadata is enabled on the CSI node)
+    const matchesCsiNamespace =
+      volumeLabels['kubernetes.io/created-for/pvc/namespace'] === 'vibecarbon';
+
+    if (matchesProject || isKnownClusterVolume || isPvcInClusterLocation || matchesCsiNamespace) {
+      try {
+        const deleted = await hetznerDeleteVolume(apiToken, volume.id);
+        if (deleted) {
+          deletedVolumes.push(volume.name);
+        }
+      } catch {
+        // Continue with other volumes if one fails
+      }
+    }
+  }
+
+  return deletedVolumes;
+}
+
+// ============================================================================
+// GITHUB CLEANUP
+// ============================================================================
+
+function deleteGitHubEnvironment(envName) {
+  try {
+    const repoInfo = runCommand(
+      ['gh', 'repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'],
+      {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      },
+    ).trim();
+
+    runCommand(['gh', 'api', `repos/${repoInfo}/environments/${envName}`, '-X', 'DELETE'], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ============================================================================
+// BACKUP BUCKET CLEANUP
+// ============================================================================
+
+/**
+ * Handle the backup S3 bucket at the end of destroy. Default behavior is to
+ * preserve the bucket for recovery (production users); --purge-backups deletes
+ * it (used by e2e tests, which require a clean tear-down).
+ */
+async function handleBackupBucket(envConfig, projectConfig, args, spinner) {
+  if (!envConfig.backupS3?.bucket) return;
+  const bucketName = envConfig.backupS3.bucket;
+
+  if (!args.purgeBackups) {
+    p.log.info(`Backup bucket ${c.bold(bucketName)} preserved for recovery`);
+    return;
+  }
+
+  const region = envConfig.backupS3.region || envConfig.s3?.region || 'fsn1';
+  spinner.start(`Purging backup bucket: ${bucketName}`);
+  try {
+    const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+    if (!s3Creds) {
+      spinner.stop('Backup bucket purge skipped (no credentials available)');
+      return;
+    }
+    const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, region);
+    try {
+      const result = await s3Provider.emptyAndDeleteBucket(bucketName);
+      spinner.stop(
+        result.deleted
+          ? result.objectsRemoved > 0
+            ? `Backup bucket purged (${result.objectsRemoved} objects removed)`
+            : 'Backup bucket purged'
+          : 'Backup bucket not found',
+      );
+    } catch (bucketError) {
+      if (bucketError.name === 'NoSuchBucket' || bucketError.$metadata?.httpStatusCode === 404) {
+        spinner.stop('Backup bucket not found (already deleted or never created)');
+      } else {
+        throw bucketError;
+      }
+    }
+  } catch (error) {
+    spinner.stop(`Backup bucket purge failed: ${error.message}`);
+  }
+}
+
+/**
+ * Final outro for the destroy flow. If sub-steps left state behind (e.g. an
+ * S3 bucket that couldn't be emptied), surface them with hints and set a
+ * non-zero exit code so CI/scripts notice. Without this the destroy reports
+ * `Environment "X" destroyed.` even when work was left undone — the operator
+ * can miss the in-band warning and a stranded bucket continues billing.
+ */
+function destroyOutro(envName, timeStr, results) {
+  const issues = results?.issues ?? [];
+  if (issues.length === 0) {
+    p.log.success(`Environment "${envName}" destroyed.`);
+    p.outro(`Done ${c.dim(`(${timeStr})`)}`);
+    return;
+  }
+  p.log.warn(
+    `Environment "${envName}" destroyed with ${issues.length} issue${issues.length === 1 ? '' : 's'}:`,
+  );
+  for (const issue of issues) {
+    p.log.message(`  ${c.error('•')} ${issue.detail}`);
+    if (issue.hint) p.log.message(`    ${c.dim(issue.hint)}`);
+  }
+  p.outro(`Done with issues ${c.dim(`(${timeStr})`)}`);
+  process.exitCode = 1;
+}
+
+// ============================================================================
+// MAIN DESTRUCTION FLOW
+// ============================================================================
+
+async function main() {
+  const { values, positional, errors } = parseFlags(process.argv.slice(2), SPEC);
+
+  if (errors.length > 0) {
+    for (const e of errors) {
+      process.stderr.write(`${c.error('✗')} ${e}\n`);
+    }
+    process.stderr.write(`Run ${c.info('vibecarbon destroy -h')} for usage.\n`);
+    process.exit(1);
+  }
+
+  if (values.h) {
+    process.stdout.write(renderHelp(SPEC));
+    process.exit(0);
+  }
+  if (values.v) {
+    console.log(`destroy-vibecarbon v${VERSION}`);
+    process.exit(0);
+  }
+
+  // Build the legacy `args` struct that the orchestration code below
+  // reads (env / yes / destroyOrphans / purgeBackups). Field renames
+  // happen at the boundary so the orchestration stays untouched —
+  // each downstream branch is hundreds of lines and well-tested.
+  const envSeed =
+    /** @type {string|undefined} */ (positional.env) ||
+    /** @type {string|null} */ (values.env) ||
+    null;
+  const args = {
+    env: envSeed,
+    yes: !!values.y,
+    destroyOrphans: !!values.orphans,
+    purgeBackups: !!values.purge,
+  };
+
+  // Check if current working directory exists
+  let cwd;
+  try {
+    cwd = process.cwd();
+  } catch {
+    console.error(`\n${c.error('Error:')} Current working directory does not exist.`);
+    console.error(
+      `This can happen if the project directory was deleted while this command was running.`,
+    );
+    console.error(`\nPlease navigate to a valid directory and try again.`);
+    process.exit(1);
+  }
+
+  // Project guard runs before banner so an accidental `vibecarbon
+  // destroy` from a parent directory emits the canonical message.
+  assertInProjectDir(cwd);
+
+  console.clear();
+  printBanner();
+  p.intro(`${c.bold('vibecarbon destroy')} ${c.dim(`v${VERSION}`)}`);
+
+  const projectConfig = loadProjectConfig(cwd);
+
+  // TTY guard: if the operator seeded an env, no env prompt fires;
+  // otherwise we'd open a picker that hangs off-TTY.
+  const envCount = Object.keys(projectConfig?.environments || {}).length;
+  requireTTYOrFlags({
+    requirements: [
+      {
+        flag: 'env',
+        description: 'name an environment to destroy',
+        satisfied: !!envSeed || envCount <= 1,
+      },
+    ],
+  });
+
+  if (!projectConfig.environments || Object.keys(projectConfig.environments).length === 0) {
+    // Check for orphan Pulumi stacks (deployment interrupted before config save)
+    const orphans = await findOrphanPulumiStacks(projectConfig);
+
+    if (orphans.length > 0) {
+      p.log.warn('No environments found in .vibecarbon.json');
+      p.log.info(
+        `Found ${orphans.length} orphan Pulumi stack(s) — likely from interrupted deployments:`,
+      );
+      for (const orphan of orphans) {
+        p.log.info(`  • ${c.bold(orphan.name)}`);
+      }
+
+      // Auto-destroying orphans is dangerous: when projectConfig.s3Config is
+      // null (e.g., a typo in the saved config), listStacks falls back to
+      // the local file:// backend at ~/.vibecarbon/pulumi-state/, which is
+      // GLOBAL across projects/scenarios. A scenario's --yes destroy then
+      // nukes other scenarios' stacks (observed 2026-04-26 batch run #5:
+      // compose's final-destroy destroyed compose-ha's e2-primary/e2-standby
+      // mid-deploy because compose's empty config let the orphan path fire).
+      //
+      // The auto-destroy used to honor --yes, but cross-scenario blast is
+      // worse than leaving local state around. Require an explicit flag now.
+      // For interactive use, prompt as before.
+      p.log.info('');
+      if (!args.destroyOrphans) {
+        p.log.warn('Skipping orphan cleanup. Re-run with -orphans to remove these stacks.');
+        p.outro('Done (orphans not destroyed)');
+        process.exit(0);
+      }
+      const shouldDestroy = args.yes
+        ? true
+        : await p.confirm({
+            message: `Destroy these ${orphans.length} orphan stack(s)?`,
+            initialValue: false, // Default to NO for safety
+          });
+
+      if (p.isCancel(shouldDestroy) || !shouldDestroy) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+
+      // Load the HCLOUD token + S3 backend config the same way the
+      // main destroy path does. Pulumi's hcloud provider needs a valid
+      // token to delete resources; an empty token surfaces as
+      // "Missing Hetzner Cloud API token" mid-destroy. The s3Config
+      // must match the one findOrphanPulumiStacks used to discover
+      // these stacks, otherwise resolveBackendUrl picks a different
+      // backend and the destroy can't find them.
+      const orphanCreds = loadCredentials();
+      const orphanApiToken =
+        process.env.HETZNER_API_TOKEN ||
+        orphanCreds?.hetzner?.apiToken ||
+        orphanCreds?.hetznerApiToken ||
+        '';
+      const orphanS3Config =
+        projectConfig?.s3Config && orphanCreds?.s3
+          ? {
+              ...projectConfig.s3Config,
+              accessKey: orphanCreds.s3.accessKey,
+              secretKey: orphanCreds.s3.secretKey,
+            }
+          : null;
+
+      if (!orphanApiToken) {
+        p.log.error(
+          'No Hetzner API token found in HETZNER_API_TOKEN env var or ~/.vibecarbon/credentials.json — cannot destroy orphan stacks.',
+        );
+        process.exit(1);
+      }
+
+      for (const orphan of orphans) {
+        try {
+          await destroyOrphanPulumiStack(orphan, {
+            apiToken: orphanApiToken,
+            s3Config: orphanS3Config,
+          });
+          p.log.success(`Destroyed: ${orphan.name}`);
+        } catch (error) {
+          p.log.error(`Failed to destroy ${orphan.name}: ${error.message}`);
+        }
+      }
+
+      p.outro('Orphan cleanup complete');
+      process.exit(0);
+    }
+
+    p.log.error('No environments found in .vibecarbon.json');
+    p.log.info('Nothing to destroy.');
+    process.exit(1);
+  }
+
+  p.log.info(`Project: ${c.bold(projectConfig.projectName)}`);
+
+  // Select environment to destroy
+  const envNames = Object.keys(projectConfig.environments);
+  let envName = args.env;
+
+  if (!envName) {
+    if (envNames.length === 1) {
+      envName = envNames[0];
+    } else {
+      envName = await p.select({
+        message: 'Which environment do you want to destroy?',
+        options: envNames.map((name) => ({
+          value: name,
+          label: name,
+          hint: projectConfig.environments[name].servers?.map((s) => s.ip).join(', '),
+        })),
+      });
+    }
+  }
+
+  if (p.isCancel(envName)) {
+    p.cancel('Operation cancelled.');
+    process.exit(0);
+  }
+
+  const envConfig = projectConfig.environments[envName];
+  if (!envConfig) {
+    p.log.error(`Environment '${envName}' not found`);
+    p.log.info(`Available environments: ${envNames.join(', ')}`);
+    process.exit(1);
+  }
+
+  // Show what will be deleted
+  const serverList =
+    envConfig.servers?.map((s) => `    ${c.error('•')} ${s.name} (${s.ip})`).join('\n') ||
+    '    None';
+
+  p.note(
+    `
+${c.danger('This will permanently delete:')}
+
+${c.bold('Servers:')}
+${serverList}
+
+${c.bold('Firewalls:')}
+${envConfig.servers?.map((s) => `    ${c.error('•')} ${s.name}-fw`).join('\n') || '    None'}
+
+${c.bold('SSH Keys:')}
+    ${c.error('•')} vibecarbon-${projectConfig.projectName}-${envName}
+
+${
+  envConfig.dns?.provider === 'cloudflare'
+    ? `${c.bold('Cloudflare Resources:')}
+    ${c.error('•')} DNS record: ${envConfig.domain}
+    ${c.error('•')} Health checks
+    ${envConfig.ha ? `${c.error('•')} Wildcard DNS record` : ''}
+`
+    : ''
+}
+${
+  envConfig.s3?.bucket
+    ? `${c.bold('S3 Storage:')}
+    ${c.error('•')} Bucket: ${envConfig.s3.bucket} (all objects will be deleted)
+`
+    : ''
+}${
+  envConfig.backupS3?.bucket
+    ? `${c.bold('S3 Backups:')}
+    ${args.purgeBackups ? `${c.error('•')} Bucket: ${envConfig.backupS3.bucket} (WILL BE DELETED — --purge-backups)` : `${c.success('•')} Bucket: ${envConfig.backupS3.bucket} (PRESERVED for recovery)`}
+`
+    : ''
+}
+${c.bold('GitHub:')}
+    ${c.error('•')} Environment: ${envName}
+
+${c.danger('WARNING: All data on these servers will be permanently lost!')}
+  `,
+    `Destroying: ${envName}`,
+  );
+
+  const needsProdConfirm = requiresProdTypeToConfirm(envName);
+
+  // First prompt: only when not --yes.
+  if (!args.yes) {
+    const confirmed = await p.confirm({
+      message: `Are you sure you want to destroy the ${c.bold(envName)} environment?`,
+      initialValue: false,
+    });
+    if (!confirmed || p.isCancel(confirmed)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
+  }
+
+  // Type-to-confirm: runs whenever NOT --yes, OR the env is prod/production
+  // (even with --yes). Protects against `--env prod --yes` typos in CI/scripts.
+  if (!args.yes || needsProdConfirm) {
+    const confirmSlug = `${projectConfig.projectName}-${envName}`;
+    if (args.yes && needsProdConfirm) {
+      p.log.warn(
+        `Destroying a production environment still requires type-to-confirm, even with --yes.`,
+      );
+    }
+    const doubleConfirm = await p.text({
+      message: `Type "${confirmSlug}" to confirm:`,
+      validate: (v) => (v !== confirmSlug ? `Please type "${confirmSlug}" to confirm` : undefined),
+    });
+    if (p.isCancel(doubleConfirm)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
+  }
+
+  // Offer to create a backup before destroying
+  const serverIp = envConfig.servers?.[0]?.ip;
+  const sshKeyPath = join(cwd, '.vibecarbon', `deploy_key_${envName}`);
+  if (serverIp && existsSync(sshKeyPath) && !args.yes) {
+    const offerBackup = await p.confirm({
+      message: 'Create a backup before destroying? (recommended)',
+      initialValue: true,
+    });
+
+    if (!p.isCancel(offerBackup) && offerBackup) {
+      const backupSpinner = p.spinner();
+      backupSpinner.start('Creating backup...');
+      try {
+        if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
+          const { backupCompose, uploadComposeBackupToS3 } = await import(
+            './lib/deploy/compose/index.js'
+          );
+          const backupFile = backupCompose(serverIp, sshKeyPath, projectConfig.projectName);
+
+          const backupS3 = envConfig.backupS3;
+          if (backupS3) {
+            const { getS3Credentials } = await import('./lib/hetzner-guided-setup.js');
+            const creds = await getS3Credentials(projectConfig.projectName, { save: false });
+            if (creds) {
+              await uploadComposeBackupToS3(
+                serverIp,
+                sshKeyPath,
+                projectConfig.projectName,
+                backupFile,
+                {
+                  ...backupS3,
+                  accessKey: creds.accessKey,
+                  secretKey: creds.secretKey,
+                },
+              );
+              backupSpinner.stop(`Backup saved to S3: ${backupS3.bucket}/backups/${backupFile}`);
+            } else {
+              backupSpinner.stop(`Backup created on server: ${backupFile}`);
+              p.log.warn(
+                'Could not upload to S3 (no credentials). Download before destroy completes:',
+              );
+              p.log.info(
+                `  scp root@${serverIp}:/opt/${projectConfig.projectName}/backups/${backupFile} .`,
+              );
+            }
+          } else {
+            // No S3 — download locally
+            const { scpDownload } = await import('./lib/ssh.js');
+            const localPath = join(cwd, backupFile);
+            scpDownload(
+              serverIp,
+              sshKeyPath,
+              `/opt/${projectConfig.projectName}/backups/${backupFile}`,
+              localPath,
+            );
+            backupSpinner.stop(`Backup saved locally: ${backupFile}`);
+          }
+        }
+      } catch (backupError) {
+        backupSpinner.stop(`Backup failed: ${backupError.message}`);
+        p.log.warn('Continuing with destroy...');
+      }
+    }
+  }
+
+  // Get API tokens (env var → credentials file → interactive prompt)
+  const hetznerToken = await getApiToken(projectConfig.projectName);
+  if (!hetznerToken) {
+    p.log.error('Hetzner API token is required');
+    process.exit(1);
+  }
+
+  let cloudflareToken = null;
+  if (envConfig.dns?.provider === 'cloudflare' && envConfig.dns?.cloudflareZoneId) {
+    // Check env var → credentials file → prompt
+    cloudflareToken = process.env.CLOUDFLARE_API_TOKEN;
+
+    if (!cloudflareToken) {
+      const creds = loadCredentials();
+      if (creds.cloudflare?.apiToken) {
+        cloudflareToken = creds.cloudflare.apiToken;
+        p.log.info('✓ Using Cloudflare API token from ~/.vibecarbon/credentials.json');
+      }
+    }
+
+    if (!cloudflareToken) {
+      cloudflareToken = await p.password({
+        message: 'Enter Cloudflare API token (for DNS cleanup)',
+        validate: (v) => (v.length < 10 ? 'API token is required' : undefined),
+      });
+
+      if (p.isCancel(cloudflareToken)) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+    } else if (process.env.CLOUDFLARE_API_TOKEN) {
+      p.log.info('✓ Using Cloudflare API token from CLOUDFLARE_API_TOKEN environment variable');
+    }
+  }
+
+  // ========== DESTRUCTION ==========
+
+  const tracker = createTracker('destroy', { environment: envName });
+  const s = tracker.spinner();
+  const results = {
+    servers: [],
+    volumes: [],
+    firewalls: [],
+    sshKeys: [],
+    dns: [],
+    healthChecks: [],
+    loadBalancers: [],
+    s3Bucket: null,
+    github: false,
+    // Sub-step failures that didn't abort destroy but left state behind
+    // (e.g., S3 bucket couldn't be emptied). The outro surfaces these so the
+    // operator doesn't miss them, and the process exits non-zero so CI sees it.
+    issues: [],
+  };
+
+  // ========== COMPOSE-HA DESTRUCTION (if deployed via Docker Compose HA) ==========
+  if (envConfig.deployMode === 'compose-ha') {
+    const { destroyComposeHA } = await import('./lib/deploy/compose/ha.js');
+
+    const s2 = tracker.spinner();
+    s2.start('Destroying Compose HA environment...');
+    try {
+      await destroyComposeHA({
+        projectName: projectConfig.projectName,
+        environment: envName,
+        envConfig,
+        hetznerToken,
+        cloudflareToken,
+        onProgress: (msg) => s2.message(msg),
+      });
+      s2.stop('Compose HA environment destroyed');
+    } catch (error) {
+      s2.stop(`Compose HA destruction failed: ${error.message}`);
+    }
+
+    // Delete S3 bucket if configured
+    if (envConfig.s3?.bucket) {
+      const s3BucketName = envConfig.s3.bucket;
+      const s3Region = envConfig.s3?.region || 'fsn1';
+      s2.start(`Deleting S3 bucket: ${s3BucketName}`);
+      try {
+        const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+        if (s3Creds) {
+          const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
+          try {
+            const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
+            s2.stop(result.deleted ? 'S3 bucket deleted' : 'S3 bucket not found');
+          } catch (bucketError) {
+            if (
+              bucketError.name === 'NoSuchBucket' ||
+              bucketError.$metadata?.httpStatusCode === 404
+            ) {
+              s2.stop('S3 bucket not found (already deleted)');
+            } else {
+              s2.stop(`S3 bucket deletion failed: ${bucketError.message}`);
+              results.issues.push({
+                step: 'S3 bucket',
+                detail: `${s3BucketName} (${s3Region}) not deleted: ${bucketError.message}`,
+                hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
+              });
+            }
+          }
+        } else {
+          s2.stop('S3 bucket skipped (no credentials available)');
+          results.issues.push({
+            step: 'S3 bucket',
+            detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
+            hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
+          });
+        }
+      } catch (error) {
+        s2.stop(`S3 bucket deletion failed: ${error.message}`);
+        results.issues.push({
+          step: 'S3 bucket',
+          detail: `${s3BucketName} not deleted: ${error.message}`,
+          hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket.',
+        });
+      }
+    }
+
+    // Backup bucket: preserved by default, deleted with --purge-backups.
+    await handleBackupBucket(envConfig, projectConfig, args, s2);
+
+    // Update project config to remove environment
+    const updatedConfig = { ...projectConfig };
+    if (updatedConfig.environments) {
+      delete updatedConfig.environments[envName];
+    }
+    saveProjectConfig(updatedConfig);
+
+    cleanupLocalEnvFiles(cwd, envName);
+
+    const { formatted: timeStr } = tracker.finish();
+    destroyOutro(envName, timeStr, results);
+    return;
+  }
+
+  // ========== COMPOSE DESTRUCTION (if deployed via Docker Compose) ==========
+  if (envConfig.deployMode === 'compose') {
+    const serverIp = envConfig.servers?.[0]?.ip;
+    const sshKeyPath = join(cwd, '.vibecarbon', `deploy_key_${envName}`);
+
+    if (serverIp && existsSync(sshKeyPath)) {
+      // Stop and remove Docker Compose services
+      s.start('Stopping Docker Compose services...');
+      try {
+        const { destroyCompose } = await import('./lib/deploy/compose/index.js');
+        destroyCompose(serverIp, sshKeyPath, projectConfig.projectName);
+        s.stop('Docker Compose services removed');
+        results.servers.push(`vps-${serverIp}`);
+      } catch (error) {
+        s.stop(`Failed to stop services: ${error.message}`);
+      }
+    }
+
+    // Delete Hetzner VPS if auto-provisioned (has server ID in config)
+    const serverId = envConfig.servers?.[0]?.id;
+    // The `name` field in envConfig.servers is a role label ("master") set by
+    // the orchestrator, not the Hetzner-assigned hostname. Pulumi's compose
+    // program names the server `${projectName}-${environment}`. The
+    // orchestrator persists that under `hetznerName`; configs older than
+    // that change only have role-style names, so derive the Pulumi name as
+    // a deterministic fallback — looking up "master" in Hetzner never
+    // matches and leaks the VPS.
+    const serverHetznerName =
+      envConfig.servers?.[0]?.hetznerName || `${projectConfig.projectName}-${envName}`;
+    if (serverId && hetznerToken) {
+      s.start(`Deleting VPS (${serverIp})...`);
+      try {
+        const deleted = await hetznerDeleteServer(hetznerToken, serverId);
+        s.stop(deleted ? 'VPS deleted' : 'VPS not found');
+      } catch (error) {
+        s.stop(`Failed to delete VPS: ${error.message}`);
+      }
+    } else if (!serverId && hetznerToken && serverHetznerName) {
+      // Fallback: find server by name if ID wasn't saved (older deploys
+      // or runs where Pulumi didn't propagate serverId).
+      s.start(`Looking up VPS by name: ${serverHetznerName}...`);
+      try {
+        const servers = await hetznerListServers(hetznerToken);
+        const server = servers.find((sv) => sv.name === serverHetznerName);
+        if (server) {
+          const deleted = await hetznerDeleteServer(hetznerToken, server.id);
+          s.stop(deleted ? 'VPS deleted' : 'VPS not found');
+        } else {
+          s.stop('VPS not found');
+        }
+      } catch (error) {
+        s.stop(`Failed to delete VPS: ${error.message}`);
+      }
+    }
+
+    // Delete Hetzner firewall.
+    // Pulumi (src/lib/iac/programs/hetzner-compose.js) names the firewall
+    //   `${projectName}-${environment}-firewall`
+    // Earlier this used `vibecarbon-${projectName}-${envName}` which never
+    // matched anything Pulumi created — the firewall always leaked, and
+    // the next compose restore re-deploy hit "name is already used
+    // (uniqueness_error)" on Pulumi up. Match the actual Pulumi naming
+    // convention (the equivalent fix exists in destroyComposeHA).
+    const fwName = `${projectConfig.projectName}-${envName}-firewall`;
+    if (hetznerToken) {
+      s.start(`Deleting firewall: ${fwName}`);
+      try {
+        const deleted = await hetznerDeleteFirewall(hetznerToken, fwName);
+        if (deleted) results.firewalls.push(fwName);
+        s.stop(deleted ? 'Firewall deleted' : 'Firewall not found');
+      } catch (error) {
+        s.stop(`Failed to delete firewall: ${error.message}`);
+      }
+    }
+
+    // Delete Hetzner SSH key.
+    // Pulumi names the key
+    //   `${projectName}-${environment}-${location}-key`
+    // — the location suffix is what kept the old `vibecarbon-` prefix from
+    // ever matching. Same root cause as the firewall above.
+    const composeRegion = envConfig.region || envConfig.servers?.[0]?.region;
+    const hetznerSshKeyName = composeRegion
+      ? `${projectConfig.projectName}-${envName}-${composeRegion}-key`
+      : null;
+    if (hetznerToken && hetznerSshKeyName) {
+      s.start(`Deleting SSH key: ${hetznerSshKeyName}`);
+      try {
+        const deleted = await hetznerDeleteSSHKey(hetznerToken, hetznerSshKeyName);
+        if (deleted) results.sshKeys.push(hetznerSshKeyName);
+        s.stop(deleted ? 'SSH key deleted' : 'SSH key not found');
+      } catch (error) {
+        s.stop(`Failed to delete SSH key: ${error.message}`);
+      }
+    }
+
+    // DNS cleanup is ownership-filtered: only records pointing at this env's
+    // server IPs are deleted. Shared zones (e.g. parallel e2e scenarios
+    // on the same root domain) used to lose neighbours' records here — see
+    // the deleteDNSRecord doc for context.
+    const ownedIps = (envConfig.servers || []).map((srv) => srv.ip).filter(Boolean);
+
+    // Delete Cloudflare DNS if configured
+    if (cloudflareToken && envConfig.dns?.cloudflareZoneId && envConfig.domain) {
+      const zoneId = envConfig.dns.cloudflareZoneId;
+
+      s.start(`Deleting DNS record: ${envConfig.domain}`);
+      try {
+        const result = await cloudflareDeleteDNSRecord(
+          cloudflareToken,
+          zoneId,
+          envConfig.domain,
+          ownedIps,
+        );
+        if (result.deleted > 0) results.dns.push(envConfig.domain);
+        if (result.skipped > 0) {
+          s.stop(
+            `DNS record preserved (${result.skipped} unowned target(s): ${result.skippedTargets.join(', ')})`,
+          );
+        } else {
+          s.stop(result.deleted > 0 ? 'DNS record deleted' : 'DNS record not found');
+        }
+      } catch (error) {
+        s.stop(`DNS deletion failed: ${error.message}`);
+      }
+    }
+
+    // Delete Hetzner DNS if configured
+    if (envConfig.dns?.provider === 'hetzner' && envConfig.dns?.hetznerZoneId && envConfig.domain) {
+      const zoneId = envConfig.dns.hetznerZoneId;
+      s.start(`Deleting Hetzner DNS record: ${envConfig.domain}`);
+      try {
+        const zone = await hetznerDnsGetZone(hetznerToken, zoneId);
+        const [root, wildcard] = await Promise.all([
+          hetznerDnsDeleteRecord(hetznerToken, zoneId, zone.name, envConfig.domain, ownedIps),
+          hetznerDnsDeleteRecord(
+            hetznerToken,
+            zoneId,
+            zone.name,
+            `*.${envConfig.domain}`,
+            ownedIps,
+          ),
+        ]);
+        if (root.deleted || wildcard.deleted) results.dns.push(envConfig.domain);
+        const preserved = [root, wildcard].filter((r) => r.skipped);
+        if (preserved.length > 0) {
+          const targets = preserved.flatMap((p) => p.skippedTargets);
+          s.stop(`Hetzner DNS records preserved (unowned targets: ${targets.join(', ')})`);
+        } else {
+          s.stop('Hetzner DNS records deleted');
+        }
+      } catch (error) {
+        s.stop(`Hetzner DNS cleanup failed: ${error.message}`);
+      }
+    }
+
+    // Delete S3 bucket if configured
+    if (envConfig.s3?.bucket) {
+      const s3BucketName = envConfig.s3.bucket;
+      const s3Region = envConfig.s3?.region || 'fsn1';
+      s.start(`Deleting S3 bucket: ${s3BucketName}`);
+      try {
+        const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+        if (s3Creds) {
+          const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
+          try {
+            const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
+            if (result.deleted) results.s3Bucket = s3BucketName;
+            s.stop(result.deleted ? 'S3 bucket deleted' : 'S3 bucket not found');
+          } catch (bucketError) {
+            if (
+              bucketError.name === 'NoSuchBucket' ||
+              bucketError.$metadata?.httpStatusCode === 404
+            ) {
+              s.stop('S3 bucket not found (already deleted or never created)');
+            } else {
+              throw bucketError;
+            }
+          }
+        } else {
+          s.stop('S3 bucket skipped (no credentials available)');
+          results.issues.push({
+            step: 'S3 bucket',
+            detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
+            hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
+          });
+        }
+      } catch (error) {
+        s.stop(`S3 bucket deletion failed: ${error.message}`);
+        results.issues.push({
+          step: 'S3 bucket',
+          detail: `${s3BucketName} (${s3Region}) not deleted: ${error.message}`,
+          hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
+        });
+      }
+    }
+
+    // Backup bucket: preserved by default, deleted with --purge-backups.
+    await handleBackupBucket(envConfig, projectConfig, args, s);
+
+    // Clean up local SSH key files
+    const sshKeyFiles = [sshKeyPath, `${sshKeyPath}.pub`];
+    for (const f of sshKeyFiles) {
+      if (existsSync(f)) {
+        try {
+          rmSync(f);
+        } catch {
+          // Non-fatal
+        }
+      }
+    }
+
+    // Update project config to remove environment
+    const updatedConfig = { ...projectConfig };
+    if (updatedConfig.environments) {
+      delete updatedConfig.environments[envName];
+    }
+    saveProjectConfig(updatedConfig);
+
+    cleanupLocalEnvFiles(cwd, envName);
+
+    const { formatted: timeStr } = tracker.finish();
+    destroyOutro(envName, timeStr, results);
+    return;
+  }
+
+  // Identify Pulumi stacks to destroy. HA k8s uses two stacks:
+  // {env}-primary + {env}-standby; single k8s uses just {env}.
+  const isHAK8s = envConfig.ha?.enabled && envConfig.deployMode === 'kubernetes';
+  const pulumiStackEnvs = isHAK8s ? [`${envName}-primary`, `${envName}-standby`] : [envName];
+  const hasPulumiStack = envConfig.deployMode === 'kubernetes';
+
+  // Volume IDs collected from ALL cluster servers (master, supabase, workers).
+  // Hetzner CSI names volumes pvc-<uuid> — not the cluster name — so we must collect IDs
+  // before the servers are deleted rather than trying to match by name/label afterwards.
+  const allClusterVolumeIds = [];
+  // Datacenter location names for all servers in the cluster (e.g. "fsn1", "nbg1").
+  // Used to find pvc-* volumes created by CSI that were detached before destroy runs.
+  const clusterLocations = new Set();
+
+  // Owned IPs gate every DNS delete — only records pointing at this env's
+  // servers are removed. See deleteDNSRecord doc in lib/cloudflare.js.
+  const ownedIps = (envConfig.servers || []).map((srv) => srv.ip).filter(Boolean);
+
+  // 1. Delete Cloudflare resources first (while servers still exist for reference)
+  if (cloudflareToken && envConfig.dns?.cloudflareZoneId) {
+    const zoneId = envConfig.dns.cloudflareZoneId;
+
+    // Delete DNS records (main domain and api subdomain)
+    if (envConfig.domain) {
+      // Main domain
+      s.start(`Deleting DNS record: ${envConfig.domain}`);
+      try {
+        const result = await cloudflareDeleteDNSRecord(
+          cloudflareToken,
+          zoneId,
+          envConfig.domain,
+          ownedIps,
+        );
+        if (result.deleted > 0) results.dns.push(envConfig.domain);
+        if (result.skipped > 0) {
+          s.stop(
+            `DNS record preserved (${result.skipped} unowned target(s): ${result.skippedTargets.join(', ')})`,
+          );
+        } else {
+          s.stop(result.deleted > 0 ? 'DNS record deleted' : 'DNS record not found');
+        }
+      } catch (error) {
+        s.stop(`DNS deletion failed: ${error.message}`);
+      }
+
+      // API subdomain (for Supabase Kong gateway)
+      const apiDomain = `api.${envConfig.domain}`;
+      s.start(`Deleting DNS record: ${apiDomain}`);
+      try {
+        const result = await cloudflareDeleteDNSRecord(
+          cloudflareToken,
+          zoneId,
+          apiDomain,
+          ownedIps,
+        );
+        if (result.deleted > 0) results.dns.push(apiDomain);
+        if (result.skipped > 0) {
+          s.stop(`API DNS record preserved (unowned: ${result.skippedTargets.join(', ')})`);
+        } else {
+          s.stop(result.deleted > 0 ? 'API DNS record deleted' : 'API DNS record not found');
+        }
+      } catch (error) {
+        s.stop(`API DNS deletion failed: ${error.message}`);
+      }
+    }
+
+    // Delete health checks
+    for (const server of envConfig.servers || []) {
+      const healthCheckName = `${server.name}-health`;
+      s.start(`Deleting health check: ${healthCheckName}`);
+      try {
+        const deleted = await cloudflareDeleteHealthCheck(cloudflareToken, zoneId, healthCheckName);
+        if (deleted) results.healthChecks.push(healthCheckName);
+        s.stop(deleted ? 'Health check deleted' : 'Health check not found');
+      } catch (error) {
+        s.stop(`Health check deletion failed: ${error.message}`);
+      }
+    }
+
+    // Also try domain-health format
+    if (envConfig.domain) {
+      const healthCheckName = `${envConfig.domain}-health`;
+      s.start(`Deleting health check: ${healthCheckName}`);
+      try {
+        const deleted = await cloudflareDeleteHealthCheck(cloudflareToken, zoneId, healthCheckName);
+        if (deleted) results.healthChecks.push(healthCheckName);
+        s.stop(deleted ? 'Health check deleted' : 'Health check not found');
+      } catch (error) {
+        s.stop(`Health check deletion failed: ${error.message}`);
+      }
+    }
+  }
+
+  // 1b. Delete Hetzner DNS resources (while servers still exist for reference)
+  if (envConfig.dns?.provider === 'hetzner' && envConfig.dns?.hetznerZoneId && envConfig.domain) {
+    const zoneId = envConfig.dns.hetznerZoneId;
+    s.start(`Deleting Hetzner DNS records: ${envConfig.domain}`);
+    try {
+      const zone = await hetznerDnsGetZone(hetznerToken, zoneId);
+      const [root, wildcard] = await Promise.all([
+        hetznerDnsDeleteRecord(hetznerToken, zoneId, zone.name, envConfig.domain, ownedIps),
+        hetznerDnsDeleteRecord(hetznerToken, zoneId, zone.name, `*.${envConfig.domain}`, ownedIps),
+      ]);
+      if (root.deleted || wildcard.deleted) results.dns.push(envConfig.domain);
+      const preserved = [root, wildcard].filter((r) => r.skipped);
+      if (preserved.length > 0) {
+        const targets = preserved.flatMap((p) => p.skippedTargets);
+        s.stop(`Hetzner DNS records preserved (unowned targets: ${targets.join(', ')})`);
+      } else {
+        s.stop('Hetzner DNS records deleted');
+      }
+    } catch (error) {
+      s.stop(`Hetzner DNS cleanup failed: ${error.message}`);
+    }
+  }
+
+  // 2. Delete Hetzner resources
+  if (hasPulumiStack) {
+    // Pulumi owns the servers, firewalls, SSH keys, and networks — `pulumi
+    // destroy` tears them all down in one pass.
+
+    // For HA, each sub-cluster has its own network (e.g. havibes-prod-primary-network)
+    const clusterNames = isHAK8s
+      ? [
+          `${projectConfig.projectName}-${envName}-primary`,
+          `${projectConfig.projectName}-${envName}-standby`,
+        ]
+      : [`${projectConfig.projectName}-${envName}`];
+
+    // Pre-scan: collect volume IDs from ALL servers in the cluster network(s) before deletion.
+    // Hetzner CSI driver names volumes with PVC UUIDs (e.g. pvc-xxxxxxxx), not the cluster
+    // name, so name/label matching in hetznerCleanupOrphanedVolumes is unreliable. By
+    // collecting the IDs now we can delete them reliably after Pulumi tears the servers down.
+    s.start('Scanning cluster servers for attached volumes');
+    try {
+      const networks = await hetznerListNetworks(hetznerToken);
+      const clusterNetworks = networks.filter((n) =>
+        clusterNames.some((cn) => n.name === `${cn}-network`),
+      );
+      if (clusterNetworks.length > 0) {
+        const clusterNetworkIds = new Set(clusterNetworks.map((n) => n.id));
+        const allServers = await hetznerListServers(hetznerToken);
+        for (const server of allServers) {
+          const inCluster = server.private_net?.some((n) => clusterNetworkIds.has(n.network_id));
+          if (inCluster) {
+            if (Array.isArray(server.volumes)) {
+              allClusterVolumeIds.push(...server.volumes);
+            }
+            if (server.datacenter?.location?.name) {
+              clusterLocations.add(server.datacenter.location.name);
+            }
+          }
+        }
+      }
+      s.stop(
+        allClusterVolumeIds.length > 0
+          ? `Found ${allClusterVolumeIds.length} volume(s) to clean up`
+          : 'No volumes attached to cluster servers',
+      );
+    } catch (error) {
+      s.stop(`Volume pre-scan failed (will fall back to label matching): ${error.message}`);
+    }
+
+    // Clean up CCM-created load balancers before Pulumi destroys the network.
+    // The cluster network still exists at this point, so matchesNetwork is reliable.
+    // Once the network is gone, matchesNetwork always returns false.
+    // HA: fan out across primary + standby — clusters are isolated.
+    if (clusterNames.length > 0) {
+      console.log(`Cleaning up Hetzner load balancers across ${clusterNames.length} cluster(s)...`);
+      await Promise.allSettled(
+        clusterNames.map(async (clusterName) => {
+          try {
+            const subEnv = clusterName.replace(`${projectConfig.projectName}-`, '');
+            const deletedLBs = await hetznerCleanupLoadBalancers(
+              hetznerToken,
+              projectConfig.projectName,
+              subEnv,
+            );
+            results.loadBalancers.push(...deletedLBs);
+            console.log(
+              deletedLBs.length > 0
+                ? `  [${clusterName}] Deleted ${deletedLBs.length} load balancer(s)`
+                : `  [${clusterName}] No CCM load balancers found`,
+            );
+          } catch (error) {
+            console.log(`  [${clusterName}] Load balancer cleanup failed: ${error.message}`);
+          }
+        }),
+      );
+    }
+
+    // Pre-Pulumi: release Hetzner CSI volumes via the cluster's own
+    // finalizers while the CSI controller is still up. Pulumi destroy
+    // yanks the cluster before the controller can react, so without
+    // this step the underlying volumes survive each PVC. Iterate over
+    // every cluster (single = 1, HA = primary + standby) using the
+    // matching kubeconfig file. Helper is best-effort; the post-destroy
+    // sweep below catches anything left over.
+    // HA: release CSI volumes on primary + standby in parallel — each
+    // cluster's controller is independent.
+    console.log(
+      `Releasing CSI volumes via cluster finalizers across ${pulumiStackEnvs.length} cluster(s)...`,
+    );
+    await Promise.allSettled(
+      pulumiStackEnvs.map(async (stackEnv) => {
+        const kubeconfigPath = join(cwd, '.vibecarbon', `kubeconfig-${stackEnv}`);
+        const dirLabel = isHAK8s ? ` (${stackEnv})` : '';
+        try {
+          await cleanupClusterPVCs(kubeconfigPath);
+          console.log(`  CSI volume release attempted${dirLabel}`);
+        } catch (error) {
+          console.log(`  CSI volume release failed${dirLabel}: ${error.message}`);
+        }
+      }),
+    );
+
+    // Destroy via Pulumi. Each stack lives in the backend we configured
+    // (Hetzner S3 by default) — `pulumi destroy` removes Hetzner resources,
+    // then `removeStack` cleans the state record.
+    // Build s3Config for Pulumi backend access. The orchestrator persists
+    // envConfig.s3 = { bucket, region, endpoint } (NOT envConfig.s3Config —
+    // that field never exists), and accessKey/secretKey live in
+    // ~/.vibecarbon/credentials.json. Without merging both sources here,
+    // resolveBackendUrl falls back to the local file:// backend, Pulumi
+    // destroys an empty stack in ~1s, and Pulumi-managed FloatingIps +
+    // Networks silently leak (observed 2026-04-26 matrix runs #4 + #5,
+    // independent of the destroyK8s argument-passing bug that was fixed
+    // around the same time).
+    const credsForDestroy = loadCredentials();
+    const destroyS3Config =
+      envConfig.s3 && credsForDestroy.s3
+        ? {
+            bucket: envConfig.s3.bucket,
+            region: envConfig.s3.region,
+            endpoint: envConfig.s3.endpoint,
+            accessKey: credsForDestroy.s3.accessKey,
+            secretKey: credsForDestroy.s3.secretKey,
+          }
+        : null;
+    // Pre-Pulumi sweep: reap cluster-autoscaler-spawned workers BEFORE
+    // Pulumi tries to destroy the cluster network/firewall. CA-spawned
+    // servers exist outside Pulumi state — leaving them attached fails
+    // Pulumi's network destroy with "still in use".
+    // For HA, sweep both primary and standby cluster networks.
+    // HA: sweep CA-spawned workers on primary + standby in parallel — each
+    // cluster's CA tags its workers with a distinct cluster name.
+    console.log(
+      `Sweeping cluster-autoscaler workers across ${pulumiStackEnvs.length} cluster(s)...`,
+    );
+    await Promise.allSettled(
+      pulumiStackEnvs.map(async (stackEnv) => {
+        const dirLabel = isHAK8s ? ` (${stackEnv})` : '';
+        const caClusterName = `${projectConfig.projectName}-${stackEnv}`;
+        try {
+          const caResult = await hetznerCleanupAutoscalerWorkers(hetznerToken, caClusterName);
+          if (caResult.deleted.length > 0) {
+            console.log(
+              `  Deleted ${caResult.deleted.length} CA-spawned worker(s)${dirLabel}: ${caResult.deleted.join(', ')}`,
+            );
+            results.servers.push(...caResult.deleted);
+            if (caResult.volumeIds.length > 0) {
+              allClusterVolumeIds.push(...caResult.volumeIds);
+            }
+          } else {
+            console.log(`  No CA-spawned workers found${dirLabel}`);
+          }
+        } catch (err) {
+          console.log(`  CA worker sweep failed${dirLabel}: ${err.message}`);
+          // Pulumi destroy will fail noisily if any CA-spawned servers remain
+          // attached, surfacing the issue to the operator.
+        }
+      }),
+    );
+
+    const { destroyK8s: destroyK8sStack } = await import('./lib/deploy/k8s/index.js');
+    // HA: tear down primary + standby Pulumi stacks in parallel. Each stack
+    // owns disjoint Hetzner resources (different network, different servers)
+    // so there's no shared state to race on. Saves ~200s on k8s-ha critical
+    // path (Pulumi destroy is ~100s/stack and was strictly sequential).
+    console.log(
+      `Destroying infrastructure via Pulumi across ${pulumiStackEnvs.length} stack(s) — this may take a few minutes...`,
+    );
+    await Promise.allSettled(
+      pulumiStackEnvs.map(async (stackEnv) => {
+        const dirLabel = isHAK8s ? ` (${stackEnv})` : '';
+        try {
+          await perfAsync(`destroy.pulumi.${stackEnv}`, async () =>
+            destroyK8sStack({
+              projectName: projectConfig.projectName,
+              environment: stackEnv,
+              apiToken: hetznerToken,
+              region: envConfig.region || 'nbg1',
+              s3Config: destroyS3Config,
+            }),
+          );
+          results.servers.push('(all via Pulumi)');
+          results.firewalls.push('(all via Pulumi)');
+          results.sshKeys.push('(all via Pulumi)');
+          console.log(`  Pulumi infrastructure destroyed${dirLabel}`);
+        } catch (error) {
+          console.log(`  Pulumi destroy failed${dirLabel}: ${error.message}`);
+          p.log.warn(
+            `You may need to manually clean up resources${dirLabel} in the Hetzner console.`,
+          );
+        }
+      }),
+    );
+
+    // Sweep for orphaned servers not in the Pulumi stack's resource graph.
+    // This catches servers created by a partially-failed `pulumi up` that
+    // never made it into the persisted state.
+    s.start('Checking for orphaned servers');
+    try {
+      const allServers = await hetznerListServers(hetznerToken);
+      const orphanedServers = allServers.filter((sv) => {
+        const labels = sv.labels || {};
+        return (
+          labels['managed-by'] === 'vibecarbon' &&
+          labels.project === projectConfig.projectName &&
+          clusterNames.some(
+            (cn) => labels.environment === cn.replace(`${projectConfig.projectName}-`, ''),
+          )
+        );
+      });
+      if (orphanedServers.length > 0) {
+        s.stop(`Found ${orphanedServers.length} orphaned server(s)`);
+        for (const sv of orphanedServers) {
+          s.start(`Deleting orphaned server: ${sv.name} (${sv.public_net?.ipv4?.ip || sv.id})`);
+          try {
+            await hetznerDeleteServer(hetznerToken, sv.id);
+            results.servers.push(sv.name);
+            s.stop(`Deleted ${sv.name}`);
+          } catch (error) {
+            s.stop(`Failed to delete ${sv.name}: ${error.message}`);
+          }
+        }
+      } else {
+        s.stop('No orphaned servers found');
+      }
+    } catch (error) {
+      s.stop(`Orphan server check failed: ${error.message}`);
+    }
+
+    // HA k8s: delete the shared SSH key created OUTSIDE Pulumi by
+    // src/lib/deploy/k8s/ha/index.js (named `${project}-${env}-ha-key`).
+    // Both Pulumi stacks reference it via `existingSshKeyId`, so neither
+    // stack's destroy removes it — without this manual cleanup it leaks
+    // on every HA destroy and the next preflight scan blocks the matrix
+    // (RCA from k8s-ha 2026-04-30: post-destroy sweep flagged the same
+    // key as REGRESSION every run).
+    if (isHAK8s && hetznerToken) {
+      const haSshKeyName = `${projectConfig.projectName}-${envName}-ha-key`;
+      s.start(`Deleting shared HA SSH key: ${haSshKeyName}`);
+      try {
+        const deleted = await hetznerDeleteSSHKey(hetznerToken, haSshKeyName);
+        if (deleted) results.sshKeys.push(haSshKeyName);
+        s.stop(deleted ? 'HA SSH key deleted' : 'HA SSH key not found');
+      } catch (error) {
+        s.stop(`Failed to delete HA SSH key: ${error.message}`);
+      }
+    }
+  }
+
+  cleanupLocalEnvFiles(cwd, envName);
+
+  if (!hasPulumiStack) {
+    // Manual API cleanup for compose deployments — k8s mode is fully
+    // Pulumi-managed and was already torn down above.
+    for (const server of envConfig.servers || []) {
+      s.start(`Deleting server: ${server.name} (${server.ip})`);
+      try {
+        const deleted = await hetznerDeleteServer(hetznerToken, server.id);
+        if (deleted) results.servers.push(server.name);
+        s.stop(deleted ? `Server ${server.name} deleted` : `Server ${server.name} not found`);
+      } catch (error) {
+        s.stop(`Failed to delete ${server.name}: ${error.message}`);
+      }
+    }
+
+    // 3. Delete Hetzner firewalls
+    for (const server of envConfig.servers || []) {
+      const fwName = `${server.name}-fw`;
+      s.start(`Deleting firewall: ${fwName}`);
+      try {
+        const deleted = await hetznerDeleteFirewall(hetznerToken, fwName);
+        if (deleted) results.firewalls.push(fwName);
+        s.stop(deleted ? `Firewall ${fwName} deleted` : `Firewall ${fwName} not found`);
+      } catch (error) {
+        s.stop(`Failed to delete firewall: ${error.message}`);
+      }
+    }
+
+    // 4. Delete Hetzner SSH key.
+    // Pulumi (src/lib/iac/programs/hetzner-k8s.js) names the SSH key
+    //   `${projectName}-${environment}-${location}-key`
+    // (`vibecarbon-` prefix dropped — the project name is already unique).
+    // This branch only runs when Pulumi state is missing, so we have to
+    // know the location to find the key. Fall back to the prefix-only
+    // form for older deploys that may not have a region in envConfig.
+    const k8sRegion = envConfig.region || envConfig.servers?.[0]?.region;
+    const sshKeyName = k8sRegion
+      ? `${projectConfig.projectName}-${envName}-${k8sRegion}-key`
+      : null;
+    if (sshKeyName) {
+      s.start(`Deleting SSH key: ${sshKeyName}`);
+      try {
+        const deleted = await hetznerDeleteSSHKey(hetznerToken, sshKeyName);
+        if (deleted) results.sshKeys.push(sshKeyName);
+        s.stop(deleted ? 'SSH key deleted' : 'SSH key not found');
+      } catch (error) {
+        s.stop(`Failed to delete SSH key: ${error.message}`);
+      }
+    }
+  } // end manual API cleanup
+
+  // Clean up Kubernetes-managed resources (created by CCM/CSI at runtime,
+  // not by the Pulumi program). These must run for ALL deployments since
+  // they aren't in any stack's resource graph.
+
+  s.start('Cleaning up orphaned volumes');
+  try {
+    const serverNames = (envConfig.servers || []).map((sv) => sv.name);
+    const knownVolumeIds = [...new Set(allClusterVolumeIds)];
+    const deletedVolumes = await hetznerCleanupOrphanedVolumes(
+      hetznerToken,
+      projectConfig.projectName,
+      envName,
+      serverNames,
+      knownVolumeIds,
+      [...clusterLocations],
+    );
+    results.volumes = deletedVolumes;
+    s.stop(
+      deletedVolumes.length > 0
+        ? `Deleted ${deletedVolumes.length} orphaned volume(s)`
+        : 'No orphaned volumes found',
+    );
+  } catch (error) {
+    s.stop(`Volume cleanup failed: ${error.message}`);
+  }
+
+  // 4.5 Delete S3 bucket (the Pulumi backend bucket itself, created during
+  // deploy bootstrap, not part of any stack's resource graph)
+  // Use the saved bucket name from config, or fall back to the predictable deploy-time name.
+  // The deploy script creates buckets as sanitizeBucketName(projectName) → e.g. "myapp-storage".
+  const s3BucketName = envConfig.s3?.bucket || sanitizeBucketName(projectConfig.projectName);
+  const s3Region = envConfig.s3?.region || 'fsn1';
+  s.start(`Deleting S3 bucket: ${s3BucketName}`);
+  try {
+    // S3 credentials from env vars or credentials file (prompts if needed)
+    const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+    if (s3Creds) {
+      const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
+      try {
+        const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
+        if (result.deleted) {
+          results.s3Bucket = s3BucketName;
+          s.stop(
+            result.objectsRemoved > 0
+              ? `S3 bucket deleted (${result.objectsRemoved} objects removed)`
+              : 'S3 bucket deleted',
+          );
+        }
+      } catch (bucketError) {
+        // NoSuchBucket means it was already deleted or never created — not an error
+        if (bucketError.name === 'NoSuchBucket' || bucketError.$metadata?.httpStatusCode === 404) {
+          s.stop('S3 bucket not found (already deleted or never created)');
+        } else {
+          throw bucketError;
+        }
+      }
+    } else {
+      s.stop('S3 bucket skipped (no credentials available)');
+      results.issues.push({
+        step: 'S3 bucket',
+        detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
+        hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
+      });
+    }
+  } catch (error) {
+    s.stop(`S3 bucket deletion failed: ${error.message}`);
+    results.issues.push({
+      step: 'S3 bucket',
+      detail: `${s3BucketName} (${s3Region}) not deleted: ${error.message}`,
+      hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
+    });
+  }
+
+  // Backup bucket: preserved by default, deleted with --purge-backups.
+  await handleBackupBucket(envConfig, projectConfig, args, s);
+
+  // 5. Delete GitHub environment
+  s.start(`Deleting GitHub environment: ${envName}`);
+  try {
+    results.github = deleteGitHubEnvironment(envName);
+    s.stop(
+      results.github ? 'GitHub environment deleted' : 'GitHub environment not found (or no access)',
+    );
+  } catch (error) {
+    s.stop(`Failed to delete GitHub environment: ${error.message}`);
+  }
+
+  // 6. Update project config
+  s.start('Updating project configuration');
+  delete projectConfig.environments[envName];
+  saveProjectConfig(projectConfig);
+  s.stop('Configuration updated');
+
+  // Summary
+  const deletedCount =
+    results.servers.length +
+    results.volumes.length +
+    results.firewalls.length +
+    results.sshKeys.length +
+    results.dns.length +
+    results.healthChecks.length +
+    results.loadBalancers.length +
+    (results.s3Bucket ? 1 : 0) +
+    (results.github ? 1 : 0);
+
+  p.note(
+    `
+${c.success('Deleted resources:')}
+    Servers:        ${results.servers.length > 0 ? results.servers.join(', ') : 'None'}
+    Volumes:        ${results.volumes.length > 0 ? results.volumes.join(', ') : 'None'}
+    Firewalls:      ${results.firewalls.length > 0 ? results.firewalls.join(', ') : 'None'}
+    SSH Keys:       ${results.sshKeys.length > 0 ? results.sshKeys.join(', ') : 'None'}
+    DNS Records:    ${results.dns.length > 0 ? results.dns.join(', ') : 'None'}
+    Health Checks:  ${results.healthChecks.length > 0 ? results.healthChecks.join(', ') : 'None'}
+    Load Balancers: ${results.loadBalancers.length > 0 ? results.loadBalancers.join(', ') : 'None'}
+    S3 Bucket:      ${results.s3Bucket || 'None'}
+    GitHub Env:     ${results.github ? envName : 'None'}
+
+${c.dim(`Total: ${deletedCount} resources deleted`)}
+  `,
+    'Destruction Complete',
+  );
+
+  const { formatted: timeStr } = tracker.finish();
+  destroyOutro(envName, timeStr, results);
+}
+
+// ============================================================================
+// RUN FUNCTION (called by CLI entry point)
+// ============================================================================
+
+export async function run(args) {
+  // Re-inject args into process.argv for the main function
+  const originalArgv = process.argv;
+  process.argv = ['node', 'destroy', ...args];
+  try {
+    await main();
+  } finally {
+    process.argv = originalArgv;
+  }
+}
+
+// ============================================================================
+// EXPORTS FOR TESTING
+// ============================================================================
+
+export {
+  cloudflareDeleteDNSRecord,
+  cloudflareDeleteHealthCheck,
+  deleteGitHubEnvironment,
+  getApiToken,
+  hetznerCleanupAutoscalerWorkers,
+  hetznerCleanupLoadBalancers,
+  hetznerCleanupOrphanedVolumes,
+  hetznerDeleteFirewall,
+  hetznerDeleteLoadBalancer,
+  hetznerDeleteServer,
+  hetznerDeleteSSHKey,
+  hetznerDeleteVolume,
+  hetznerListLoadBalancers,
+  hetznerListNetworks,
+  hetznerListServers,
+  hetznerListVolumes,
+  loadCredentials,
+  loadProjectConfig,
+  main,
+  SPEC,
+  saveProjectConfig,
+  VERSION,
+};