Delete a namespace and everything in it

IRREVERSIBLE. Forwards Kairos's native delete resource="namespace", which tears down the namespace's shards, vector and BM25 indexes, pending WAL records and object-store copy in one commit and invalidates the read-path cache. There is no tombstone and no undo window. It bills ONE unit — emptying a 10,000-memory namespace by calling forget in a loop used to bill 10,000, and took quadratic time because every forget rewrites the whole bank.

?confirm= is required and must equal {ns} exactly. The path parameter alone is not enough: namespace is the same argument every recall and remember carries, so a mis-set variable can produce it, while a second field that must repeat it cannot. Anything else is 400 confirmation_required, and nothing is forwarded upstream. It is a fixed echo, not a nonce — a client that timed out retries the identical request.

There is no wildcard, prefix or pattern form of this route, and there will not be one. The exact name is the only selector.

Admin or Owner, deliberately stricter than per-memory forget, which any writing Member may call. Also subject to the credential's scoped_namespaces.

dropped: false means the namespace did not exist — a successful no-op, which is what makes the retry safe. memories_deleted and chunks_deleted are counted BEFORE the drop, because afterwards there is nothing left to count; the same numbers go to the audit log and to the namespace.deleted webhook event.

Requires the memories:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:write — every key minted before scoping keeps working here.