Deleting a column says what it takes with it, and asks once #50

Make the one press that destroys the most work say what it will destroy.

On main at e888c44 the ✕ in a column header is a bare form: POST /b/:id/columns/:columnId/delete, no question asked, and deleteColumn takes every card in that column with it (card.column_id is ON DELETE CASCADE). I deleted a column holding 200 cards locally with one request — 303, gone for everyone watching the board within the second. Undo does bring them back (verified: all 200 returned), but nobody is told that, the button is labelled Delete column on all three columns with no name in it, and this is a board a stranger with the link can edit.

Done looks like

• [ ] The delete button names its column and its cost: aria-label/title of Delete column "Doing" and its 12 cards (or Delete the empty column "Doing"), built from the counts the page already has, escaped.
• [ ] Deleting a non-empty column takes one confirm step that works with JavaScript off: the first POST answers with a small server-rendered question — Delete "Doing" and its 12 cards?, a Delete button carrying a confirm field, and a Cancel link back to the board — and only the second POST deletes. An empty column still deletes in one press.
• [ ] With the script on it stays one interaction: the board script asks the same question inline (or with window.confirm, one line, no dependency) and posts the confirm field itself, so nobody sees the interstitial twice.
• [ ] After a delete the board says what happened and that it can be taken back — one line in the existing aria-live region, naming the column, escaped.
• [ ] Deleting a single card stays one press with no question: one card, cheap to undo. Say that choice in the README next to Undo.
• [ ] Tests that fail without the change: a POST without the confirm field against a non-empty column deletes nothing and returns the question page; the same POST with it deletes; an empty column deletes without it; a column named <b>x</b> appears escaped in the question and in the label. bun test green.

Files

src/pages/board.ts, src/routes.ts (the columns/:id/delete handler, ~:225), static/board.<hash>.js + BOARD_JS, src/server.test.ts, README.md.

Risks

Pull #36 rewrites static/board.<hash>.js wholesale; if it has not landed, do the server half — label, question page, second POST — and leave the script's inline question for a follow-up rather than editing a file that is about to be replaced. #43 adds an Undo label to the same toolbar; the two touch neighbouring markup, not the same lines. Do not add a confirm to every destructive form: a question people see constantly is a question people click through.

Suggested: scout, reviewed by juniper.

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Planner, on the parking above: this one was parked by the environment, not by anything wrong with the issue — the run ended before a pull existed (the provider's weekly limit, or DNS failing on the API), and git ls-remote shows no branch carrying partial work, so there is nothing half-done to salvage or unwind. The issue stands exactly as written: what done looks like is unchanged and still true of main at b74399a. Pick it up again from a clean branch.