muse-crew 0.7.6 → 0.7.8

package/API.md

@@ -293,6 +293,11 @@ Returns `{ ok: true, runs: [...], events: [...] }`.
 
 The platform records workflow run status in `runtime.workflow_runs` — separate from our telemetry. When a workflow dies on a fatal `agent()` failure (e.g. "subagent bootstrap is no longer authorized"), our telemetry shows a run with no events, but the platform knows why. This monitor correlates platform failures with our tasks.
 
+Two layers, in order of preference:
+
+1. **Prevention — the launcher stays alive.** Async workflow `agent()` authorization is tied to the launcher's lifetime: if the cron tick ends while a workflow is still running, the workflow's next `agent()` call fails. So the poll tick runs with a 90-minute execution timeout (`timeout_secs: 5400` in `seed/crons.json`) and its Step 5 monitor stays alive until every launched run reaches a terminal state. A launcher that outlives its runs never triggers the failure in the first place.
+2. **Recovery — per-tick correlation through the durable mapping.** If the launcher dies early anyway (platform kill, cell recycle), the next tick's Step 0 finds the dead run, `record-platform-failure` correlates it via the `platform_run_tasks` mapping, and `retry-platform-failure` requeues the task — at most ~3 minutes later, with the ghost session settled so the dispatcher treats it as a retry candidate immediately.
+
 ### `record-platform-failure`
 
 Record a platform workflow run failure. Correlates the task in this order: (1) the durable `platform_run_tasks` mapping written by `acknowledge-dispatch-run`, (2) timestamp proximity (±60s) between `platform_created_at` and crew telemetry launch time (fallback for runs launched before the mapping existed), (3) an explicit `crew_run_id`/`task_id` when provided. A failure that correlates to no task is kept with `task_id: null` and reported as skipped by retry.
@@ -324,6 +329,12 @@ Returns `{ ok: true, failures: [...] }`.
 
 Retry a task whose workflow died on a platform failure. Clears the stale reservation, re-queues the task to `todo`, and increments the retry count. If `retry_count` >= `max_retries` (default 3), parks the task instead.
 
+**Ghost-session settlement:** the dead workflow's `agent_sessions` row still says `running`, and the dispatcher skips any task whose latest session is running ("work in flight"). The retry settles it atomically with the state change, so the task is redispatchable on the very next tick instead of waiting out the 1-hour zombie-session sweep:
+- on `requeued`: running sessions → `stalled` (the dispatcher already treats `stalled` as a retry candidate);
+- on `parked`: running sessions → `failed` (what `recover-task` accepts), same as `park-task`.
+
+Returns `{ ok: true, action: "requeued"|"parked"|"skipped", ..., settled_sessions: <n> }`.
+
 **Supersede guard:** if a newer platform run has been linked for this task since this failure's run, the task is already owned by the successor — the retry is skipped instead of clobbering live work (a late detection of an old dead run never resets a redispatched task).
 
 | Field | Type | Notes |

package/docs/guide.md

@@ -99,6 +99,30 @@ After init completes, it returns a summary:
 
 Re-running init against an existing setup returns `"unchanged"` (or `"updated"` with the converged field names) for each cron, with no other mutations.
 
+### Uninstall
+
+Uninstalling a crew removes its scheduler crons and deletes the crew home — one flow, never a manual two-step. Launch it as a workflow through the agent's workflow tools:
+
+```
+workflow_launch with:
+  scriptPath: "<install-path>/workflows/crew-uninstall.js"
+  args: {
+    crewHome: "~/workspace/.my-crew",
+    confirm: true
+  }
+```
+
+`crewHome` is required; `confirm` must be exactly `true` or the run blocks. `force` (default `false`) overrides the live-work check described below.
+
+The run has four phases:
+
+1. **Gates** — the crew home must be inside the workspace (uninstall refuses to delete anything outside it), and `confirm: true` must be present. Either missing blocks the run before anything is touched.
+2. **Safety** — if any task is `in_progress`, the run blocks unless `force: true`. Uninstalling under live workflows would strand them.
+3. **Crons** — removes the crew's scheduler jobs, and only those: the exact ids from `$CREW_HOME/.cron-registry.json` (written by init; covers id overrides), plus discovery of `crew-poll-*` jobs whose body contains the crew home path (covers installs from before the registry existed). Anything not on that union is never touched — shared crons are safe by construction, and a missing home still gets its orphaned crons removed.
+4. **Home** — best-effort `git worktree prune` on the crew's project repos, then deletes the crew home directory and verifies it is gone.
+
+Dashboard artifacts are left untouched — uninstall removes the crew instance (its crons and its home), never the user's artifacts.
+
 ## Connecting an existing project
 
 Projects are registered through the API, not through init. Init sets up the infrastructure and registers the task service as the first project; you register additional projects separately.

package/lib/crew-api.js

@@ -847,14 +847,32 @@ commands["retry-platform-failure"] = (db, args) => {
     if (task && task.state !== "parked") {
       const msg = "Platform workflow failed " + (failure.retry_count + 1) + "x: " +
         failure.error_message.substring(0, 200);
-      db.prepare("UPDATE tasks SET state = 'parked', updated_at = datetime('now') WHERE id = ?")
-        .run(failure.task_id);
-      db.prepare("DELETE FROM dispatch_reservations WHERE task_id = ?").run(failure.task_id);
-      db.prepare(
-        `INSERT INTO events (task_id, event_type, message) VALUES (?, 'parked', ?)`
-      ).run(failure.task_id, msg);
+      const ts = new Date().toISOString();
+      db.exec("BEGIN");
+      try {
+        db.prepare("UPDATE tasks SET state = 'parked', updated_at = datetime('now') WHERE id = ?")
+          .run(failure.task_id);
+        db.prepare("DELETE FROM dispatch_reservations WHERE task_id = ?").run(failure.task_id);
+        // Settle the ghost session: a parked task never keeps a running
+        // session, and 'failed' is what recover-task accepts.
+        const settled = db.prepare(
+          `UPDATE agent_sessions
+           SET status = 'failed', ended_at = ?,
+               notes = COALESCE(notes, '') || ' Parked: platform retry exhausted.'
+           WHERE task_id = ? AND status = 'running'`
+        ).run(ts, failure.task_id);
+        db.prepare(
+          `INSERT INTO events (id, type, task_id, identity, message, timestamp)
+           VALUES (?, 'note', ?, NULL, ?, ?)`
+        ).run(uuid(), failure.task_id, "Parked: " + msg, ts);
+        db.exec("COMMIT");
+        return { ok: true, action: "parked", reason: "max retries exceeded", retry_count: failure.retry_count, settled_sessions: Number(settled.changes) };
+      } catch (e) {
+        db.exec("ROLLBACK");
+        throw e;
+      }
     }
-    return { ok: true, action: "parked", reason: "max retries exceeded", retry_count: failure.retry_count };
+    return { ok: true, action: "parked", reason: "max retries exceeded", retry_count: failure.retry_count, settled_sessions: 0 };
   }
   // Clear reservation and re-queue for retry.
   db.exec("BEGIN");
@@ -863,22 +881,36 @@ commands["retry-platform-failure"] = (db, args) => {
     db.prepare(
       "UPDATE tasks SET state = 'todo', updated_at = datetime('now') WHERE id = ? AND state != 'done'"
     ).run(failure.task_id);
+    // Settle the ghost session atomically with the requeue: the platform
+    // workflow is dead, but its agent_sessions row still says 'running' —
+    // and the dispatcher skips any task whose latest session is running
+    // (crew-dispatch.js "work in flight"). Without this, the requeued task
+    // would sit until the 1-hour zombie-session sweep. 'stalled' is what
+    // the dispatcher already treats as a retry candidate.
+    const ts = new Date().toISOString();
+    const settled = db.prepare(
+      `UPDATE agent_sessions
+       SET status = 'stalled', ended_at = ?,
+           notes = COALESCE(notes, '') || ' Platform retry: launcher died; session settled for redispatch.'
+       WHERE task_id = ? AND status = 'running'`
+    ).run(ts, failure.task_id);
     db.prepare(
       `UPDATE platform_run_failures
        SET retry_count = retry_count + 1, last_retry_at = datetime('now')
        WHERE platform_run_id = ?`
     ).run(args.platform_run_id);
     db.exec("COMMIT");
+    return {
+      ok: true,
+      action: "requeued",
+      task_id: failure.task_id,
+      retry_count: failure.retry_count + 1,
+      settled_sessions: Number(settled.changes),
+    };
   } catch (e) {
     db.exec("ROLLBACK");
     throw e;
   }
-  return {
-    ok: true,
-    action: "requeued",
-    task_id: failure.task_id,
-    retry_count: failure.retry_count + 1,
-  };
 };
 
 commands["park-task"] = (db, args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -36,21 +36,22 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 
    If the dispatcher returned no claims or the claims array is empty, report: NO_DISPATCH and exit.
 
-5. **Monitor launched workflows within this tick (tick-bounded — 2026-09-13):** The platform ties async workflow subagent authorization to the launcher's lifetime: when THIS tick ends (120s timeout), any still-running workflow's next `agent()` call may fail with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". You cannot prevent that by staying alive — this tick WILL end at 120s, so a "stay alive until terminal" monitor is fiction. The design that survives launcher death is per-tick recovery: watch while you live, and let the next tick's Step 0 continue through the durable platform run -> task mapping.
-   - For each launched run_id, poll its status every ~20 seconds via muse.db (you have ~100s of monitoring budget — leave margin before the 120s kill):
+5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.
+   - For each launched run_id, poll its status every ~2 minutes via muse.db:
      ```sql
      SELECT status, error FROM runtime.workflow_runs WHERE run_id = '<run_id>'
      ```
    - **If status is `completed`:** Done. Log success and stop monitoring this run.
    - **If status is `failed`:** Check if it's a platform `agent()` error (error contains "subagent bootstrap", "reservation owner is terminal", "bootstrap was cancelled", or "workflow agent call failed"):
-     - **Platform error:** Record it and retry immediately (same two commands as Step 0). If the retry says `requeued` AND you have at least ~40s left in this tick AND retries remain (max 3 per task per tick):
+     - **Platform error:** Record it and retry immediately (same two commands as Step 0). If the retry says `requeued` and retries remain (max 3 per task):
           - Re-acquire the reservation: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} reserve-dispatch --json '{"task_id": "<task_id>"}'`
           - If `acquired` is true, re-launch via workflow_launch_async with the same scriptPath and args, acknowledge with the new run_id, and continue monitoring the NEW run_id.
           - If `acquired` is false, stop — another dispatcher claimed it.
-       If the retry result says `parked` (3 attempts exhausted), stop monitoring this task.
+       If the retry result says `parked` (attempts exhausted), stop monitoring this task.
      - **Task-level error (not a platform error):** The workflow's own error handling applies. Stop monitoring this run.
    - **If status is `running` or `paused`:** Continue polling.
-   - **Tick end:** At ~100s elapsed, stop monitoring and exit. Do NOT try to outlive the 120s timeout — the monitor's job is not to prevent launcher death (impossible) but to recover from it fast. Anything that dies after you leave is caught by the next tick's Step 0 via the mapping, at most ~3 minutes later. That is the designed recovery path, not a fallback.
+   - **Monitor ceiling:** 90 minutes from tick start. If a run is still not terminal then (pathological — the work phase caps each `agent()` call at 60 minutes), exit; the next tick's Step 0 continues recovery through the durable mapping.
+   - **Backstop (not the plan, the insurance):** If THIS launcher dies early for any reason (platform kill, cell recycle), the next tick's Step 0 detects the dead run through the durable platform run -> task mapping and retries it — at most ~3 minutes later. The mapping exists so a dead launcher never strands a task for an hour; the monitor exists so the launcher rarely dies mid-run in the first place.
    - When all launched workflows are terminal or retry-exhausted, exit silently.
 
 6. Exit silently.

package/seed/crons.json

@@ -10,7 +10,7 @@
         "every": "3m",
         "kind": "interval"
       },
-      "timeout_secs": 120,
+      "timeout_secs": 5400,
       "title": "Muse Crew polling loop"
     }
   ],

package/workflows/crew-init.js

@@ -363,9 +363,18 @@ try {
     "      Call cron_update with only the fields that differ. If nothing differs,\n" +
     "      do not call cron_update. Record action 'updated' with the updated field\n" +
     "      names, or 'unchanged' with no updated fields.\n" +
-    "3. Return { passed: true, summary: { crons: [...] } } with one entry per\n" +
-    "   manifest entry, in manifest order: { id, action: 'created' | 'updated' |\n" +
-    "   'unchanged', updated_fields: [...] }.",
+    "3. Write the cron registry at " + crewHome + "/.cron-registry.json — the exact\n" +
+    "   record a later uninstall uses to find these jobs. Build this JSON (one entry\n" +
+    "   per manifest entry, in manifest order, using the live ids from step 2):\n" +
+    "   {\"version\":1,\"instanceId\":\"" + instanceId + "\",\"owner\":\"" + cronOwner + "\",\n" +
+    "    \"crons\":[{\"id\":<live id>,\"manifestId\":<entry.id>}, ...]}\n" +
+    "   Write it with printf '%s' and a single-quoted heredoc so the shell\n" +
+    "   interpolates nothing, then read it back to confirm it parses.\n" +
+    "4. Return { passed: true, summary: { crons: [...], registry: {...} } } with one\n" +
+    "   crons entry per manifest entry, in manifest order:\n" +
+    "   { id, action: 'created' | 'updated' | 'unchanged', updated_fields: [...] },\n" +
+    "   and registry: { path: \"" + crewHome + "/.cron-registry.json\",\n" +
+    "   ids: [<live id>, ...] } echoing the ids written to disk.",
     {
       key: "crons-1",
       label: "Create and converge cron jobs",
@@ -387,9 +396,17 @@ try {
                   },
                   required: ["id", "action", "updated_fields"]
                 }
+              },
+              registry: {
+                type: "object",
+                properties: {
+                  path: { type: "string" },
+                  ids: { type: "array", items: { type: "string" } }
+                },
+                required: ["path", "ids"]
               }
             },
-            required: ["crons"]
+            required: ["crons", "registry"]
           }
         },
         required: ["passed", "summary"]
@@ -399,10 +416,12 @@ try {
 } catch (e) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron setup failed", message: String(e.message || e) } };
 }
-if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.crons)) {
-  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron manifest invalid", message: "seed/crons.json failed validation or produced no crons list" } };
+if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.crons) ||
+    !cronsResult.summary.registry || !Array.isArray(cronsResult.summary.registry.ids)) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron manifest invalid", message: "seed/crons.json failed validation, produced no crons list, or wrote no cron registry" } };
 }
-log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" + c.action; }).join(", "));
+log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" + c.action; }).join(", ") +
+    "; registry: " + cronsResult.summary.registry.path + " (" + cronsResult.summary.registry.ids.join(", ") + ")");
 
 
 // ── Summary ───────────────────────────────────────────────────────────
@@ -416,5 +435,6 @@ return {
   releaseHash: releaseResult.hash,
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
-  crons: cronsResult.summary.crons
+  crons: cronsResult.summary.crons,
+  registry: cronsResult.summary.registry
 };

package/workflows/crew-uninstall.js

@@ -0,0 +1,264 @@
+export const meta = {
+  name: "crew-uninstall",
+  description: "Uninstall a Muse Crew instance: remove its scheduler cron jobs, then delete the crew home directory. Destructive and irreversible — requires confirm: true, and refuses to run while any task is in_progress unless force: true. Only the crew's own crons are removed (exact registry plus body-match discovery); shared crons are never touched. Dashboard artifacts are left alone.",
+  phases: [
+    { name: "gates", title: "Containment gate and explicit confirmation" },
+    { name: "safety", title: "Refuse while work is live (unless forced)" },
+    { name: "crons", title: "Remove the crew's scheduler crons" },
+    { name: "home", title: "Delete the crew home directory" }
+  ]
+};
+
+// ── Arguments ──────────────────────────────────────────────────────────
+const inputs = args ?? {};
+const crewHome = inputs.crewHome;
+const confirm = inputs.confirm;
+const force = inputs.force;
+
+if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew");
+
+// ── Pure decision helpers ──────────────────────────────────────────────
+// The agent is a sensor, not a judge: it reports raw facts (HOME, expanded
+// paths, existence, in-progress counts) and the verdicts below are computed
+// here, deterministically. (Prompt hardening is a smell — this is the
+// mechanical version.)
+function expandTilde(p, home) {
+  if (p === "~") return home;
+  if (p.indexOf("~/") === 0) return home + p.slice(1);
+  return p;
+}
+function uninstallGateDecide(facts) {
+  // facts: { home, crewHomeExpanded }
+  // Uninstall deletes a directory tree — it must never run against a home
+  // outside the workspace. Same prefix rule as crew-init's Gate 0.
+  var workspace = facts.home + "/workspace";
+  var launchable = facts.crewHomeExpanded.indexOf(workspace + "/") === 0;
+  return { workspace: workspace, launchable: launchable };
+}
+function confirmDecide(c) {
+  // Strict: only the boolean true counts. "true", 1, and undefined do not.
+  if (c === true) return { ok: true, message: "" };
+  return {
+    ok: false,
+    message: "crew-uninstall is destructive and irreversible: it removes the crew's scheduler cron jobs and deletes the crew home directory. Re-run with confirm: true to proceed."
+  };
+}
+function safetyDecide(inProgressCount, f) {
+  // Live work strands if its home disappears mid-run. Refuse unless forced.
+  if (inProgressCount > 0 && f !== true) {
+    return {
+      ok: false,
+      message: inProgressCount + " task(s) are in_progress. Uninstalling now would strand their workflows. Re-run with force: true to uninstall anyway, or finish/park the work first."
+    };
+  }
+  return { ok: true, message: "" };
+}
+
+// ── Gates: containment + confirmation ──────────────────────────────────
+phase("gates");
+var gateFacts;
+try {
+  gateFacts = await agent(
+    "Report filesystem facts for a crew uninstall. Do not judge — just report.\n\n" +
+    "Requested crewHome: " + crewHome + "\n\n" +
+    "Steps (run in shell):\n" +
+    "1. home=$(echo $HOME)\n" +
+    "2. Expand a leading ~/ in the requested crewHome against $HOME (leave other paths untouched).\n" +
+    "3. Report whether the expanded path exists: test -e \"<expanded>\"; echo EXISTS:$?\n" +
+    "4. Return JSON { home, crewHomeExpanded, homeExists } where homeExists is true\n" +
+    "   when the path exists.",
+    {
+      key: "uninstall-gates",
+      label: "Validate uninstall target",
+      schema: {
+        type: "object",
+        properties: {
+          home: { type: "string" },
+          crewHomeExpanded: { type: "string" },
+          homeExists: { type: "boolean" }
+        },
+        required: ["home", "crewHomeExpanded", "homeExists"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Uninstall validation failed", message: String(e.message || e) } };
+}
+var gateResult = uninstallGateDecide(gateFacts);
+if (!gateResult.launchable) {
+  return {
+    __hatchWorkflowControl: "blocked",
+    result: {
+      blocked_reason: "crewHome is not workspace-contained",
+      message: "crewHome must be inside the workspace (" + gateResult.workspace + "). Requested: " + gateFacts.crewHomeExpanded + ". Uninstall refuses to delete anything outside the workspace."
+    }
+  };
+}
+var crewHomeExpanded = gateFacts.crewHomeExpanded;
+var confirmation = confirmDecide(confirm);
+if (!confirmation.ok) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Uninstall not confirmed", message: confirmation.message } };
+}
+log("Uninstall confirmed for " + crewHomeExpanded + (gateFacts.homeExists ? "" : " (crew home already gone — removing orphaned crons only)"));
+
+// ── Safety: refuse while work is live (unless forced) ───────────────────
+phase("safety");
+var safetyFacts = { homeExists: gateFacts.homeExists, inProgress: 0 };
+if (gateFacts.homeExists) {
+  try {
+    safetyFacts = await agent(
+      "Report whether this crew has live work. Do not judge — just report.\n\n" +
+      "crewHome: " + crewHomeExpanded + "\n\n" +
+      "Steps (run in shell):\n" +
+      "1. If \"" + crewHomeExpanded + "/crew-state.db\" exists, run:\n" +
+      "   sqlite3 \"" + crewHomeExpanded + "/crew-state.db\" \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
+      "   Report the number. When the database is missing, the count is 0.\n" +
+      "2. Return JSON { homeExists: true, inProgress: <number> }.",
+      {
+        key: "uninstall-safety",
+        label: "Check for live work",
+        schema: {
+          type: "object",
+          properties: {
+            homeExists: { type: "boolean" },
+            inProgress: { type: "number" }
+          },
+          required: ["homeExists", "inProgress"]
+        }
+      }
+    );
+  } catch (e) {
+    return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Safety check failed", message: String(e.message || e) } };
+  }
+}
+var safety = safetyDecide(safetyFacts.inProgress, force);
+if (!safety.ok) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Live work in progress", message: safety.message } };
+}
+log("Safety: " + safetyFacts.inProgress + " in_progress task(s)" + (force === true ? " (forced)" : ""));
+
+// ── Remove the crew's scheduler crons ──────────────────────────────────
+// Two sources, unioned: the exact registry written by crew-init (covers id
+// overrides), and discovery (covers installs from before the registry
+// existed, and a registry that was never written). A job is only removed
+// when it is on that union — never by guesswork.
+phase("crons");
+var cronsResult;
+try {
+  cronsResult = await agent(
+    "Remove this crew instance's scheduler cron jobs — and nothing else.\n\n" +
+    "crewHome: " + crewHomeExpanded + "\n\n" +
+    "Steps:\n" +
+    "1. Registry: if \"" + crewHomeExpanded + "/.cron-registry.json\" exists, read it\n" +
+    "   and take its crons[].id list as registry candidates.\n" +
+    "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
+    "   call cron_view and keep it as a discovery candidate when the job body\n" +
+    "   contains the crewHome string '" + crewHomeExpanded + "' (the poll body template\n" +
+    "   embeds the crew home path). The bare id 'crew-poll' with no instance suffix\n" +
+    "   is never a live crew job — never remove it.\n" +
+    "3. Removal list = registry candidates ∪ discovery candidates, deduped.\n" +
+    "   SAFETY: remove only jobs on this list. When in doubt about any job, fail\n" +
+    "   closed (passed: false) instead of guessing.\n" +
+    "4. For each id on the removal list: call cron_remove. A job that is already\n" +
+    "   gone records action 'already_gone'.\n" +
+    "5. Call cron_list again and confirm none of the removed ids remain. If any\n" +
+    "   remain, return passed: false.\n" +
+    "6. Return { passed: true, summary: { removed: [...] } } with one entry per\n" +
+    "   removal-list id: { id, source: 'registry' | 'discovery',\n" +
+    "   action: 'removed' | 'already_gone' }. An empty removal list is a pass\n" +
+    "   with removed: [].",
+    {
+      key: "uninstall-crons",
+      label: "Remove the crew's crons",
+      schema: {
+        type: "object",
+        properties: {
+          passed: { type: "boolean" },
+          summary: {
+            type: "object",
+            properties: {
+              removed: {
+                type: "array",
+                items: {
+                  type: "object",
+                  properties: {
+                    id: { type: "string" },
+                    source: { type: "string", enum: ["registry", "discovery"] },
+                    action: { type: "string", enum: ["removed", "already_gone"] }
+                  },
+                  required: ["id", "source", "action"]
+                }
+              }
+            },
+            required: ["removed"]
+          }
+        },
+        required: ["passed", "summary"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: String(e.message || e) } };
+}
+if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.removed)) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: "The cron-removal agent did not pass. No further teardown was attempted; the crew home is untouched." } };
+}
+var removedDesc = cronsResult.summary.removed.map(function (r) { return r.id + "=" + r.action; }).join(", ");
+log("Crons: " + (removedDesc || "(none belonged to this crew)"));
+
+// ── Delete the crew home directory ─────────────────────────────────────
+phase("home");
+var homeRemoved = false;
+if (gateFacts.homeExists) {
+  var homeResult;
+  try {
+    homeResult = await agent(
+      "Delete the crew home directory.\n\n" +
+      "crewHome: " + crewHomeExpanded + "\n\n" +
+      "Steps:\n" +
+      "1. Best-effort worktree hygiene (failures do not block): if\n" +
+      "   \"" + crewHomeExpanded + "/crew-state.db\" exists, list the repo_path values\n" +
+      "   from its projects table and run 'git worktree prune' in each. Ignore errors.\n" +
+      "2. Run: rm -rf \"" + crewHomeExpanded + "\"\n" +
+      "3. Verify: test ! -e \"" + crewHomeExpanded + "\" — fail closed (passed: false)\n" +
+      "   if the path still exists.\n" +
+      "4. Return { passed: true, summary: { removed: true } }.",
+      {
+        key: "uninstall-home",
+        label: "Delete the crew home",
+        schema: {
+          type: "object",
+          properties: {
+            passed: { type: "boolean" },
+            summary: {
+              type: "object",
+              properties: {
+                removed: { type: "boolean" }
+              },
+              required: ["removed"]
+            }
+          },
+          required: ["passed", "summary"]
+        }
+      }
+    );
+  } catch (e) {
+    return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: String(e.message || e) } };
+  }
+  if (!homeResult.passed || !homeResult.summary || homeResult.summary.removed !== true) {
+    return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: "The crew home could not be deleted. Its crons were already removed; delete " + crewHomeExpanded + " manually." } };
+  }
+  homeRemoved = true;
+  log("Crew home deleted: " + crewHomeExpanded);
+} else {
+  log("Crew home already gone — nothing to delete.");
+}
+
+// ── Summary ────────────────────────────────────────────────────────────
+return {
+  message: "Muse Crew uninstalled.",
+  crewHome: crewHomeExpanded,
+  removed_crons: cronsResult.summary.removed,
+  crew_home_removed: homeRemoved,
+  note: "Dashboard artifacts were left untouched — uninstall removes the crew instance (its crons and its home), never the user's artifacts."
+};