nccgs 2.0.0-rc.3 → 2.0.0

package/docs/HUONG-DAN-MIGRATE-VA-SU-DUNG.md

@@ -1,9 +1,12 @@
-# Hướng dẫn cài đặt và sử dụng NCCGS 2.0 RC
+# Hướng dẫn cài đặt và sử dụng NCCGS 2.0.0
 
-Bản hiện tại: **2.0.0-rc.3**, kênh npm **next**. `latest` là kênh stable riêng.
-Đây là ứng viên phát hành. Nâng cấp từ npm 1.3.0 đã được kiểm chứng trong phạm vi
+Gói stable đang chuẩn bị: **2.0.0**, chưa phát hành npm.
+Dùng gói cục bộ cùng mã SHA-256 đi kèm; việc chuẩn bị không đổi các kênh npm.
+Biên bản operator dừng Editor phải được đưa vào hồ sơ reviewer bằng
+[hướng dẫn bằng chứng Editor](EDITOR-SESSION-EVIDENCE.md).
+Đây là gói stable đang chuẩn bị. Nâng cấp từ npm 1.3.0 đã được kiểm chứng trong phạm vi
 [các tình huống thử](UPGRADE-QUALIFICATION.md); chạy trọn một đầu việc mới bằng
-chính RC này vẫn là bước riêng chưa hoàn tất. Xem [trạng thái phát hành](RELEASE-STATUS.md).
+chính gói stable này vẫn là bước riêng chưa hoàn tất. Xem [trạng thái phát hành](RELEASE-STATUS.md).
 
 ## Cài mới vào bản sao dự án
 
@@ -12,14 +15,15 @@ Chức năng điều khiển Unity cần thêm Editor/CLI phù hợp. Thay đư
 dự án của bạn; đọc kết quả xem trước rồi mới áp dụng:
 
 ```powershell
-npx --yes nccgs@2.0.0-rc.3 install --project "D:\path\to\UnityProject" --dry-run
-npx --yes nccgs@2.0.0-rc.3 install --project "D:\path\to\UnityProject"
-npx --yes nccgs@2.0.0-rc.3 doctor --project "D:\path\to\UnityProject"
+$NccgsArchive = "D:\path\to\nccgs-2.0.0.tgz"
+npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject" --dry-run
+npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject"
+npx --yes --package "$NccgsArchive" nccgs doctor --project "D:\path\to\UnityProject"
 ```
 
-Có thể dùng `nccgs@next` để theo RC mới nhất; dùng số phiên bản cụ thể để tái lập.
+Dùng đúng gói cục bộ và SHA-256 đã ghi; các kênh npm không chọn gói chưa phát hành này.
 Cài mới mặc định dùng Claude Code standalone, không yêu cầu Astra/Fable. Dự án cũ
-vẫn giữ nghĩa vụ đã cấu hình; không tự bỏ một bước duyệt chỉ vì cài RC.
+vẫn giữ nghĩa vụ đã cấu hình; không tự bỏ một bước duyệt chỉ vì cài gói mới.
 
 ## Dự án đã cài NCCGS
 
@@ -36,7 +40,7 @@ mở lại phiên Claude Code.
 ## Bắt đầu một đầu việc rõ ràng
 
 ```powershell
-npx --yes nccgs@2.0.0-rc.3 run --project "D:\path\to\UnityProject"
+npx --yes --package "$NccgsArchive" nccgs run --project "D:\path\to\UnityProject"
 ```
 
 Trong Claude Code, cung cấp mục tiêu, phạm vi, yêu cầu cố định, phần được phép sửa
@@ -57,3 +61,27 @@ mong muốn, không phải bằng chứng model thực chạy. Chỉ gọi chuy
 review hợp lệ và mọi gate áp dụng đều đạt. Nghiệm thu kỹ thuật và quyết định nghiệm
 thu của người dùng được ghi riêng. Một lượt thất bại phải được giữ cùng chi phí,
 nguyên nhân và kết quả sửa lại.
+
+## Hỗ trợ handoff, Unity repair và chia nhỏ task trong NCCGS 2.0.0
+
+Source hiện có thêm các hỗ trợ chưa phát hành lên npm. Coordinator dùng
+`task dispatch-prompt` để lấy prompt và khung bàn giao PARTIAL cho lượt đã đăng ký.
+Worker có thể dùng `task handoff-validate` để phát hiện lỗi cấu trúc trước khi kết
+thúc; repair worker theo giới hạn riêng của gói repair. Sau khi reviewer hoàn thành,
+coordinator dùng `task record-review` để ghi đúng kết luận từ handoff đã ghim,
+qua đầy đủ cổng kiểm tra hiện có. Các lệnh này không tự chấp thuận hay đóng task.
+Xem [cú pháp và giới hạn](HANDOFF-AUTOMATION.md). Dùng source/package mới theo quy
+trình nâng cấp; các lệnh ở trên dùng chính gói 2.0.0 cục bộ chưa phát hành.
+
+Repair cũ giữ nguyên. Gói mới `unity-code` cho sửa/tạo tối đa 8 tệp mã; `unity-editor`
+cho sửa scene/prefab/asset bằng thao tác Editor đã chốt trước. Tệp mới phải được
+Unity import và tạo metadata trước khi worker kết thúc. Không sửa tay GUID hay
+dùng kết quả thao tác Editor thay bằng chứng kiểm thử. Khi thao tác Editor chưa rõ
+đã dừng hay chưa, giữ lượt repair và quyền sở hữu cho tới khi được đối soát; không
+tự chạy lại hoặc hoàn ngân sách. Xem [luồng repair và mẫu gói](BOUNDED-REPAIR.md).
+
+Với task quá lớn cho một lượt, dùng `task slice-preview`, `task slice-plan` và
+`task slice-status` để chia thành các phần có mục tiêu, tệp và phụ thuộc rõ ràng
+trong cùng task. Phần cuối tích hợp toàn bộ điều kiện gốc trước review độc lập.
+Các phần dùng chung ngân sách hiện có; lịch sử, lượt thất bại và các cổng nghiệm
+thu vẫn được giữ. Xem [hướng dẫn chia nhỏ task](TASK-SLICING.md).

package/docs/PHASE-1-OPERATIONS.md

@@ -1,7 +1,7 @@
 # Phase 1: durable verification and bounded continuation
 
 These verification and continuation mechanisms originated in the 1.5 preview
-and are included in 2.0 RC. Historical test descriptions below retain their original
+and are included in 2.0.0. Historical test descriptions below retain their original
 scope. See [current release status](RELEASE-STATUS.md) for completed and pending checks.
 
 ## Run a verification once
@@ -50,6 +50,47 @@ Framework options end at `--`. A helper's later `--project` is passed to that he
 it is not interpreted as the framework root. The framework's own `--project` must
 still resolve to the bound root. Shell composition and expansion remain blocked.
 
+## Unity-generated IDE files on first import
+
+Before `task init` for a new Unity project, declare its known derived files in
+`.nccgs/inputs.json`. Preserve existing canonical inputs, build outputs and check
+timeouts. For example, add this optional field to the existing manifest, replacing
+the project/assembly names with the actual outputs:
+
+```json
+"unityGeneratedFiles": [
+  "Assembly-CSharp.csproj",
+  "MyGame.slnx",
+  ".vscode/extensions.json",
+  ".vscode/launch.json",
+  ".vscode/settings.json",
+  "UserSettings/EditorUserSettings.asset",
+  "UserSettings/Search.settings"
+]
+```
+
+This is an explicit declaration of derived output, not automatic recognition of
+file contents or proof that Unity was the writer. Inspect existing files first;
+do not list user-owned IDE settings, custom project files or any file consumed as
+a build/test input. Such files remain tracked and may also be canonical inputs.
+If another tool builds from a root `.csproj`, that file is an input, not an output.
+
+Only exact root `.csproj`/`.sln`/`.slnx` paths and the five IDE/user-setting paths
+shown above are allowed, at most 256 entries in an actual Unity project. Whole
+directories, globs, traversal, links, duplicates and overlap with canonical inputs
+are rejected. All other files, including nested project files, `.vscode/tasks.json`,
+source/tests, assets and their `.meta` files, packages and ProjectSettings remain
+covered by the existing source snapshot. No Git ignore file is consulted.
+
+The manifest itself remains a canonical input pinned at task initialization.
+Managed requests capture each declared file's original hash or absence; receipts
+retain the before/after hashes and changed paths. This metadata change record is
+separate from source integrity and never overrides a failed command, timeout,
+source change, criterion or review. Missing/null output hashes mean absence, not
+an unverified source exemption. Empty/omitted declarations retain the previous
+strict behavior. Changing the list changes the canonical fingerprint; it cannot
+retroactively repair a FAIL, reuse a stale approval or reset a task's allowance.
+
 ## Supervise headless Claude Code
 
 Initialize an implementation task first. Start from an external terminal:
@@ -76,6 +117,61 @@ invocation receives only the remaining allowance. Missing/decreasing usage block
 another invocation and remains unknown, not zero. Client list-cost is not billing,
 and in-flight provider requests can exceed a stop threshold.
 
+For pinned dispatch cost limits, supervised admission can cover missing worker
+cost using the whole-session allowance plus verified prior session totals. It
+retains unknown worker telemetry and records the separate budget basis. One
+project-wide supervision lock prevents concurrent allowance reuse; unexplained
+worker sessions or missing prior cost fail closed. A fresh authorized run must
+fit the remainder of every ancestor cap; it cannot erase spent attempts or cost.
+
+### Protect the final independent review before starting work
+
+Before the first session, the external operator registers an allocation on the
+root task (children inherit it):
+
+```text
+node .claude/nccgs/tools/task.mjs budget-plan --id ROOT --file .nccgs/evidence/budget-plan.json
+```
+
+The JSON has `schemaVersion: 1`, a human-readable `authority`, `totalUsd`,
+`finalReviewUsd`, `totalDurationMs`, and `finalReviewDurationMs`. For a USD 12,
+75-minute case, reserving USD 4 and 15 minutes leaves at most USD 8 and 60 minutes
+for design, design review, implementation, verification and repair together.
+This is an explicit allocation, not a prediction that every reviewer will finish.
+Provider requests in flight can exceed a stop threshold; actual terminal usage is
+always retained and subtracted, never inferred for individual workers.
+
+Use `nccgs run ... --budget-phase work` (the default) for those work sessions.
+The supervisor clamps the requested session allowance and deadline to the
+remaining shared work allocation. A fresh session or child task cannot take the
+protected amount. Finish the implementation record and invoke
+`node .claude/nccgs/tools/task.mjs report --id TASK --outcome partial --summary "Awaiting protected independent review"`.
+A prose PARTIAL response is not itself a task record. NCCGS 2.0.0 can settle it without
+another model invocation only when the protected work phase has current recorded
+implementation, all latest checks and automatic criteria pass, no active work,
+and complete session cost. It writes an attributed PARTIAL report through the
+normal lifecycle. Otherwise the bounded continuation/blocked path remains.
+See [deterministic handoff](HANDOFF-AUTOMATION.md#deterministic-protected-work-handoff).
+Then start `nccgs run ... --budget-phase final-review` on that same
+implementation task with a fresh native coordinator/reviewer session. The latter
+may use unused work funds as well as its protected remainder; all previous spend
+stays charged. Design review cannot use the final delivery reserve.
+
+The final-review phase admits only independent delivery reviewer dispatches and
+settlement of existing evidence. Source workers, repairs and new verification
+jobs are rejected; all normal review/acceptance gates still apply. A negative
+review can return to work only if its original work time/cost remain. A retry,
+replacement session or recovered launcher never restores spent review funds.
+`task budget-status --id TASK` shows settled totals, protected remainder and the
+current allocation, explicitly leaving in-flight actual cost unknown.
+
+Plan terms are pinned once; native sessions cannot register or replace them.
+Missing allocation/run history or a started worker without correlated supervised
+session coverage fails closed, even if the old task omitted optional `maxCostUsd`.
+An existing case cannot reserve
+money already spent or receive a later deadline. A separately authorized new
+case has its own budget and must retain/report the earlier case's cost and result.
+
 Run records and native streams live in `.nccgs/runs/RUN_ID/`. Resume a recoverable
 external launcher interruption with:
 
@@ -89,6 +185,19 @@ usage and ambiguous launch windows block recovery. This is not an unlimited retr
 service. Keep local job/run ownership records in their original project; move only
 archived evidence when collecting a report.
 
+An installed framework update changes the source fingerprint of an open plan or
+audit. Do not reuse its old analysis/review or silently edit its baseline. An
+external operator can run `task.mjs migrate-framework --id TASK --decision FILE`
+with a JSON decision containing `reason`, `authority`, and `beforeFiles` (the exact
+sorted `[path, sha256]` inventory from the original snapshot). The command proves
+that inventory against the locked baseline and permits changes only under
+`.claude/`, with unchanged canonical inputs and execution/pipeline policy. It
+archives all old stages and the exact delta, retains task identity and budgets,
+and requires fresh native analysis plus independent review. Missing original
+inventory, game/source changes, live workers or pending checks block migration.
+This is an external maintenance operation, never automatic acceptance or a
+budget extension.
+
 ## Process ownership and locks
 
 On Windows 10+, the bundled inspectable C# helper uses a named Windows Job Object,
@@ -101,6 +210,38 @@ change PowerShell/system policy, install a runtime, or require WMI access.
 On POSIX, foreground commands use an owned process group; commands must not detach
 or daemonize out of that group. Windows is the locally tested platform for this change.
 
+In the prepared 2.0.0 package, managed verification commands and their
+wrappers inherit `UNITY_NO_AUTH_BROKER=1`.
+Unity CLI then uses its supported direct OS-keyring authentication path instead
+of starting a resident auth broker that waits two idle minutes after a short test.
+The flag is scoped to the command tree: the caller's environment, stored account
+settings, peer-signature policy, credentials and other environment entries are
+not changed. No environment values are added to the saved command specification.
+All actual descendants remain owned; root exit, test XML or a wrapper's PASS
+alone cannot release the group or publish the verification receipt. Surviving
+children still hold the slot until exit or the original timeout; an interrupted
+or timed-out command still fails. These source fixes do not rewrite old jobs,
+reviews, acceptance definitions or budgets.
+
+For cold Unity compilation on Windows, the helper can request graceful shutdown
+of a qualified Roslyn server after the command root has exited. It first verifies
+that only recognized Unity compiler servers and system console hosts remain in
+the Job Object. The exact open named-pipe connection must belong to that live,
+owned compiler PID before any shutdown bytes are sent. Connection and I/O waits
+are bounded; an acknowledgement never counts as process completion. The normal
+empty-group check, original root exit code and original deadline still apply.
+No compiler outside the job is stopped, and no global compiler setting is changed.
+
+Qualification currently covers the Roslyn 4.3.1 / .NET host binary pair measured
+with Editor 6000.3.17f1 and Unity CLI 1.0.0-beta.14 on Windows. The compiler and host
+SHA-256 hashes and exact protocol revision are pinned in
+`windows-compiler-server.cs`; matching a process name or version string is not
+sufficient. Unknown binaries, ambiguous process data or another remaining worker
+do not authorize shutdown. They retain normal ownership and may still time out.
+The helper cache includes both C# source hashes, so updating this logic rebuilds
+the executable. Adding another binary pair requires protocol and real cold-run
+qualification, not widening detection to every `dotnet` or `VBCSCompiler` process.
+
 Local task/orchestration locks can recover a verifiably dead owner. Engine locks
 also require all managed descendants to be gone. Recovery writes an audit entry;
 it never refunds a dispatch, fabricates completion or resets a ledger. Live owners,

package/docs/PHASE-2-OPERATIONS.md

@@ -1,7 +1,7 @@
 # Phase 2: measured acceptance and a protected repair cycle
 
 These acceptance and dispatch mechanisms originated in the 1.5 preview and are
-included in 2.0 RC. They do not tune a game or rewrite frozen evaluations. See
+included in 2.0.0. They do not tune a game or rewrite frozen evaluations. See
 [current release status](RELEASE-STATUS.md) for validation scope.
 
 The owner revised the evaluation scope on 2026-10-04: NCCGS must support delivery

package/docs/RELEASE-STATUS.md

@@ -1,20 +1,101 @@
-# NCCGS 2.0 RC release status
+# NCCGS 2.0.0 stable preparation
 
-Current candidate: **2.0.0-rc.3**. Release channel: **next**. Latest/stable is not
-promoted by this candidate. Pin the exact version for reproducible evaluation.
+Prepared stable package: **2.0.0**, unpublished. No npm publication or tag mutation
+has occurred. The release directory contains the exact local archive, SHA-256,
+regression/install/upgrade results and a separate maintenance review.
+
+## Current evidence boundary
+
+- Exact RC4 archive SHA-256: a1db9783f3f4077c742cbc346d0fa935c438fdd783e13c058e13b0bd0521bbf6.
+  The 2026-10-28 native Claude Code case qualified dirty-scene refusal, subsequent
+  scene repair and deterministic PARTIAL handoff without a continuation. All five
+  checks, 28 unchanged criteria/385 assertions, 19 EditMode and 8 PlayMode tests
+  passed; independent review was PASS with no mandatory conditions, then normal
+  closure. It spent USD7.8510068/12 in 16 min 12 s, retaining the failed attempt.
+- The reviewer retained one LOW evidence-location finding: operator stop receipts
+  existed outside its project tree. Version 2.0.0 adds a publisher and protocol to
+  expose those existing bytes to reviewers. Old verdicts and frozen files remain
+  unchanged. See [Editor lifecycle evidence](EDITOR-SESSION-EVIDENCE.md).
+- Existing acceptance, independent review, source, process and budget gates remain
+  mandatory. The Editor helper only validates and copies operator evidence; it
+  does not stop an Editor, query a live process or approve a task. An explicit
+  read-only `native-result` handoff transport also captures exact correlated
+  worker output when the client requires returned text; it never rewrites a
+  historical failed attempt, a verdict or a pending condition.
+- Stable archive framework tests and maintenance review are separate from a full
+  native Unity run through the stable archive. That broader new run is not claimed.
+  Publication, human acceptance and broad productivity remain separate decisions.
+
+## Historical release notes
+
+The following notes preserve their earlier preparation-time status. Statements
+about pending RC4 execution below were superseded by the exact-RC4 case above.
+
+### Earlier RC preparation record
+
+Prepared candidate: **2.0.0-rc.4**, unpublished. No npm tag is changed and stable
+is not promoted. Use the local archive and its SHA-256 manifest for evaluation.
+
+RC4 collects handoff automation, bounded task slices, typed Unity repair, process
+settlement, first-import output declarations and protected review budgets. It
+adds deterministic PARTIAL work handoff and an atomic dirty-scene precondition.
+The historical RC3 archive and all frozen native cases remain unchanged. Their
+execution evidence does not qualify these last additions or the exact RC4 archive.
+See [handoff operations](HANDOFF-AUTOMATION.md), [bounded repair](BOUNDED-REPAIR.md)
+and [task slicing](TASK-SLICING.md).
 
 ## What the evidence supports
 
 | Check | Status and scope |
 |---|---|
+| RC4 deterministic work handoff and dirty-scene precondition (2026-10-28 Asia/Saigon) | Framework fixtures exercise prose-only PARTIAL settlement, stale/failed/missing evidence, current negative checks, idempotent recovery, unchanged final-review reserve and legacy reservations. An operator probe with Unity 6000.3.17f1 / CLI 1.0.0-beta.14 blocked named dirty and non-active additive untitled scenes without source loss, then allowed the saved-scene operation with existing GUIDs retained. The owned Editor exited normally and its process group was verified dead. These additions have no new Claude Code execution credit. |
+| RC4 release preparation | Local archive only. Accompanying release receipts record full regression, source/archive hashes, fresh install and disposable upgrade results. Exact-RC native workflow qualification and publication remain separate pending steps. |
 | Framework functional regression | Previous maintained source: 183 PASS, 0 FAIL, 6 Windows symlink skips across 189 tests. RC3 changes installer recognition of previously generated agents and adds a focused regression. Installer/policy suites and exact-archive upgrade qualification are rerun for this change. |
 | Scoped native delivery V2 case | 24/24 criteria,137 EditMode,52 PlayMode and independent unconditional Claude Code PASS. Operator-assisted; used a frozen framework with a session-only reviewer capacity override. |
+| Unreleased source: slices and Unity code repair (2026-10-27) | Actual Claude Code workers delivered two dependent slices in one task, then repaired a disclosed post-review fault through a typed `unity-code` packet. The real PlayMode failure remains recorded. Fresh final checks passed 24/24 original criteria (349 assertions), 16/16 EditMode and 7/7 PlayMode; both independent reviews were unconditional PASS. Original tests, installed framework, role limits, task history and total budgets were retained. No capacity override. |
+| Managed Unity test settlement fix (2026-10-27) | On Windows with Unity CLI 1.0.0-beta.14 and Editor 6000.3.17f1, observed the idle auth broker remaining inside the owned process group. The process-local direct-keyring setting reduced warm EditMode total time from 121.37 s to 7.46 s; final PlayMode took 26.75 s. Post-wrapper settlement was 0.373/0.383 s. All 24 unchanged criteria passed (16/16 EditMode, 7/7 PlayMode). Framework regression: 207 PASS, 0 FAIL, 6 Windows symlink skips across 213 tests. Operator-run maintenance; no new Claude session or modification of the prior native evidence. |
+| Cold Unity compiler settlement fix (2026-10-27) | Qualified compiler/host binary pair: Windows, Editor 6000.3.17f1, Roslyn 4.3.1, CLI 1.0.0-beta.14. Graceful shutdown of the exact owned compiler pipe settled a fresh-project run in 28.55 s; its source-change guard correctly retained FAIL when Unity generated IDE files. With those initialization files present and Library removed, a fresh full compilation passed 16/16 EditMode in 31.28 s. PlayMode passed 7/7 in 28.89 s; all 24 unchanged criteria (349 assertions) passed. Framework regression: 208 PASS, 0 FAIL, 6 Windows symlink skips across 214 tests. The original 360 s deadline and process ownership remain. Operator-run maintenance, not a new Claude game run; previous failures, reviews and spent budgets remain immutable. |
+| First-import source classification (2026-10-27) | With nine exact generated IDE/local metadata files declared before init, a project with no Library or IDE files passed its first real EditMode attempt: 16/16 in 31.53 s. Their absence and resulting hashes are retained in the receipt; source stayed unchanged. Fresh PlayMode passed 7/7 in 30.82 s. All 24 original criteria (349 assertions) passed. Framework regression: 215 PASS, 0 FAIL, 6 Windows symlink skips across 221 tests, including seven focused source/output guard tests. Opt-in declarations are canonical inputs; undeclared source/configuration remains tracked. Windows, Editor 6000.3.17f1 and CLI 1.0.0-beta.14; operator-run maintenance, not new Claude execution. Previous source-change FAIL, reviews and budgets are retained. |
+| Fresh-project full native component workflow (2026-10-27) | Actual Claude Code completed native design and independent design review, two dependent implementation slices from API scaffolds, whole-task review, a disclosed post-review fault, typed existing-code repair and fresh independent re-review. First cold EditMode passed 16/16 in 35.17 s with all nine generated outputs audited; no timeout or source drift. The fault produced a retained real 6 PASS/1 FAIL PlayMode run. Final EditMode passed 16/16 in 9.45 s and PlayMode 7/7 in 26.71 s; all 24 unchanged criteria (349 assertions) passed. All three independent reviews were unconditional PASS. The design/implementation parent-child lifecycle shared 7/12 dispatches, USD 10.214066/12 and 25 min 28 s/75 min, with no continuation or extension. Installed framework, checks, source controls, process ownership, history and earlier evidence remained intact; both owned process groups settled. |
 | RC package integrity | Release procedure verifies version consistency, public contents, documentation links, and install/doctor on a fresh disposable fixture using the packed archive. This is not an upgrade or provider task test. |
+| Native new-script and scene/prefab repair attempt (2026-10-27) | NOT QUALIFIED. A native designer completed an extension contract preserving all original 24 criteria and adding four fixed criteria (385 assertions total); structural validation passed. The coordinator pinned optional per-worker `maxCostUsd: 12`, but the worker's native cost was null, so the next reservation correctly failed closed before independent design review. Actual whole-session cost was USD 2.3247276/12; 1/12 dispatches and no review invocation. No native script creation, asset repair or Unity acceptance checks occurred. Pinned controls, unknown telemetry, partial report, source and earlier evaluations remain unchanged; all owned process groups stopped. |
 | Upgrade from published npm 1.3.0 | Qualified within the disposable fixture matrix; RC2 exposed a generated-agent issue corrected in RC3. See [scope and limits](UPGRADE-QUALIFICATION.md). |
+| Supervised cost coverage and continued asset repair (2026-10-27 UTC) | PARTIAL, not delivery-qualified. Missing worker cost now uses a separately recorded supervised-session ceiling plus verified historical native spend; worker cost stays unknown. A framework-only baseline migration archived stale analysis and required fresh native validation and independent design PASS. Actual Claude workers then created/imported the new script and repaired the existing prefab and connected scene via pinned Unity operations. Initial 16/19 and intermediate 17/19 EditMode results remain as failures; final 19/19 EditMode, 8/8 PlayMode and all 28 criteria/385 assertions passed. Aggregate spend including both earlier blocked phases is USD 11.589259/12, with 5/12 dispatches and 1/3 reviews in 58 min/75. The coordinator stopped before implementation recording and final independent review; task remains PARTIAL/unclosed. No verdict, review allowance, source exemption or total cap was manufactured. Framework regression: 218 PASS, 0 FAIL, 6 Windows symlink skips across 224 tests. |
 | Fresh task through this exact RC | PENDING — separate qualification step. Earlier delivery evidence is not attributed to a new run. |
+| Protected final-review allocation and new-script/asset repair (2026-10-28 Asia/Saigon) | QUALIFIED within the disclosed fixture. A separately authorized new USD12/75-minute case pinned USD4/15 minutes for final independent review. Native design/design review spent USD2.9107512; a requested USD9.0892488 work session was clamped to USD5.0892488, and actual repair/verification spending was USD3.6935616. Two native workers created/imported the script and repaired the prefab/connected scene through three pinned Editor operations. Initial 16/19 and intermediate 17/19 EditMode failures remain; final 19/19 EditMode, 8/8 PlayMode and all 28 unchanged criteria/385 assertions passed. The protected review session received USD5.3956872, spent USD3.2125752, imported the fresh independent unconditional PASS unchanged, and normally closed the same implementation task. Total USD9.816888/12, 22 min 35 s/75, 5/12 dispatches, 2/3 reviewers and 1/1 automatic continuation. The work coordinator returned prose PARTIAL without recording the task report, so its continuation-limit stop remains recorded; the separately planned review phase completed delivery. All 32 final audit checks passed; frozen source controls, process ownership, prior evidence and the old USD11.589259 PARTIAL remain intact. Combined prior plus new cost is USD21.406147. |
 | Human third-party acceptance | Separate decision; not supplied by installation, tests or this release status. |
 | Broad game quality/productivity | Not established. No universal quality, balance, cost or efficiency claim. |
 
+The 2026-10-27 cases use a known component, unchanged tests and deliberate
+regressions. The fresh-project case starts with API scaffolds and existing metadata;
+native workers author the implementation, but its fixed brief and tests are reused.
+It qualifies the exercised workflow, not independent game creation, large-project
+productivity, new-file import or scene/prefab repair. Design and implementation use
+separate required lifecycle sessions under one cumulative budget, not replacement
+attempts. The native workers and Unity tests ran locally; detailed task, provider
+and measurement evidence is retained outside the public package. This source
+qualification does not qualify the exact published RC archive or promote a release.
+
+The 2026-10-28 reserve case qualifies the exact new-script/import and existing
+prefab/scene repair path exercised against Editor 6000.3.17f1 and Unity CLI
+1.0.0-beta.14. It used a warmed, disclosed fixture and copied dependency code,
+not a cold start or blind game creation. The final reviewer retained one LOW
+non-blocking process finding about a missing dirty-scene precondition; no source
+loss or acceptance impact was observed. The frozen native installation remains
+unchanged. Subsequent source hardening adds coverage checks for legacy worker
+sessions even without optional per-worker cost limits, and explicitly prompts
+the lifecycle `report` command; those additions receive framework tests, not
+new native-execution credit.
+Pre-RC4 maintained-source regression: 230 PASS, 0 FAIL and 6 Windows symlink skips
+across 236 tests; the focused reserve/supervisor suites passed all 30 tests.
+
+The settlement fixes do not bypass live descendants. The original cold-project
+compiler-server timeout remains a failed historical attempt. The subsequent
+compiler fix requests graceful shutdown only for the qualified binary pair;
+unknown compilers retain the normal wait and may still time out. Neither change
+removes every possible engine startup, compilation or shutdown delay. See
+[managed process ownership](PHASE-1-OPERATIONS.md#process-ownership-and-locks).
+
 ## Public package boundary
 
 The package contains the CLI, framework roles/protocols/hooks, project scaffold,
@@ -29,7 +110,7 @@ change current defaults or add new delivery gates. Current installation guidance
 is in [UPGRADING.md](../UPGRADING.md) and the
 [Vietnamese quick start](HUONG-DAN-MIGRATE-VA-SU-DUNG.md).
 
-## RC3 change scope
+## Historical RC3 change scope
 
 RC1 already standardized package metadata and removed private memory. RC2 finishes
 public documentation: current standalone defaults, exact-version npm commands,

package/docs/TASK-SLICING.md

@@ -0,0 +1,57 @@
+# Chia nhỏ task lớn trong NCCGS
+
+Tính năng này được đóng gói trong bản chuẩn bị `2.0.0`, chưa phát hành npm.
+NCCGS vẫn dùng Claude Code để điều phối và thực thi.
+
+Task lớn được chia thành các phần việc có mục tiêu, tệp được sửa và quan hệ phụ
+thuộc rõ ràng **trong cùng task**. Mỗi phần nhận đúng các điều kiện nghiệm thu gốc
+liên quan. Phần tích hợp cuối nhận toàn bộ điều kiện. Chia nhỏ không tự tạo task
+con, thêm lượt review hay tăng ngân sách.
+
+1. Coordinator đọc task và thiết kế đã review, chọn ít phần nhất đủ để mỗi lượt
+   làm việc có phạm vi rõ ràng. Mỗi phần có 1–8 tệp cụ thể; cả kế hoạch có 2–12 phần.
+   Tính cả test và metadata Unity cần tạo. Phần cuối có thể vừa làm hành vi cuối
+   vừa tích hợp, tránh thêm một bước bàn giao hình thức.
+2. Dùng mẫu `.nccgs/templates/task-slices.json`, điền task ID, contract hash,
+   snapshot hiện tại, agent, tệp, phụ thuộc và ID điều kiện gốc. Lưu bản nháp vào
+   `.nccgs/evidence/slice-plans/`. Mỗi điều kiện gốc, kể cả điều kiện thủ công,
+   phải có một phần chịu trách nhiệm chính. Các cổng nghiệm thu vẫn thuộc task.
+3. Chạy preview để kiểm tra cấu trúc và phần ngân sách còn lại, rồi đăng ký:
+
+```text
+node .claude/nccgs/tools/task.mjs slice-preview --id TASK --file .nccgs/evidence/slice-plans/TASK.json
+node .claude/nccgs/tools/task.mjs slice-plan --id TASK --file .nccgs/evidence/slice-plans/TASK.json
+node .claude/nccgs/tools/task.mjs slice-status --id TASK
+```
+
+4. Lưu đối tượng `next` từ status vào tệp request và dùng luồng `reserve` →
+   `dispatch-prompt` → Agent foreground → handoff hiện có. Các lệnh mới không tự
+   khởi chạy agent. Hoàn tất từng phần trước khi làm phần tiếp theo. Checkpoint
+   sớm của task vẫn phải được đo trước khi mở rộng.
+5. Khi mọi phần có trạng thái `DELIVERED`, chạy kiểm tra trên kết quả tích hợp
+   hiện tại, ghi implementation bằng lượt tích hợp cuối, rồi review độc lập và
+   nghiệm thu theo task gốc. `DELIVERED` chỉ xác nhận bàn giao đầy đủ, không phải
+   PASS. Reviewer phải độc lập với tất cả người đã triển khai các phần.
+
+Ngân sách đã ghim, ngân sách cha, chi phí/thời gian đo được và ngân sách phiên
+`nccgs run` tiếp tục áp dụng. Nếu chưa có giới hạn dispatch được ghim, đăng ký kế
+hoạch dùng mức mặc định hiện có của task. Kế hoạch phải đủ chỗ cho các phần còn
+lại, review độc lập và phần dự phòng repair/QA/review gốc. Đây là mức tối thiểu về
+số lượt, không bảo đảm đủ tiền hoặc thời gian cho mọi lần thử lại. Không tự tăng
+giới hạn để hoàn tất kế hoạch.
+
+Khi cần điều chỉnh, giữ các lượt cũ, tạo plan ID mới với lý do và `supersedes`
+trỏ đến kế hoạch hiện tại. Giữ ID các phần đã thử. Thay đổi phạm vi một phần hoặc
+chạy lại phần nền tảng sẽ làm các kết quả phụ thuộc hết hiệu lực; chúng cần lượt
+bàn giao mới. Phần không thay đổi có thể tái sử dụng khi lần thử mới nhất và các
+phụ thuộc vẫn hợp lệ. Lịch sử, kết luận review âm tính và ngân sách đã tiêu không
+bị xóa. Repair sau tích hợp dùng đúng luồng repair đã có.
+
+Xem [giao thức đầy đủ](../.claude/nccgs/protocols/task-slices.md),
+[handoff](HANDOFF-AUTOMATION.md) và [Unity repair](BOUNDED-REPAIR.md).
+Ngày 2026-10-27, một lượt Claude Code/Unity thực đã kiểm chứng hai phần phụ thuộc
+trong cùng task, tích hợp, review độc lập, lỗi PlayMode được ghi nhận, repair và
+review độc lập lần nữa. Cả 24 điều kiện gốc đạt lại; test, lịch sử và ngân sách
+tổng được giữ nguyên. Đây là ca hồi quy có kiểm soát trên component đã có lời
+giải, gồm lỗi được chủ động cài để kiểm chứng repair; chưa chứng minh hiệu quả
+trên task lớn hoặc game mới. Xem [phạm vi bằng chứng](RELEASE-STATUS.md).

package/docs/UPGRADE-QUALIFICATION.md

@@ -1,6 +1,6 @@
 # Published 1.3.0 upgrade qualification
 
-Target: **2.0.0-rc.3**. This is installation/configuration qualification on Windows
+Historical target: **2.0.0-rc.3**. This is installation/configuration qualification on Windows
 with Node.js 24.12.0 using the published npm 1.3.0 archive and the exact RC3 archive.
 It does not establish Node 18, macOS/Linux, provider execution or gameplay results.
 

package/docs/WORKFLOWS.md

@@ -1,4 +1,4 @@
-# NCCGS workflows — 2.0 RC
+# NCCGS workflows — 2.0.0
 
 New installations use standalone Claude Code execution with the claude-standalone
 model profile. The coordinator owns intake, planning, dispatch, verification and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nccgs",
-  "version": "2.0.0-rc.3",
+  "version": "2.0.0",
   "description": "Unity-first game-studio operating system for Claude Code",
   "license": "MIT",
   "type": "module",
@@ -28,7 +28,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "tag": "next",
+    "tag": "latest",
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {

package/scaffold/.nccgs/templates/repair-unity-code.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": 2,
+  "repairType": "unity-code",
+  "taskId": "REPLACE_WITH_TASK_ID",
+  "contractHash": "REPLACE_WITH_CURRENT_CONTRACT_HASH",
+  "sourceSnapshot": "REPLACE_WITH_CURRENT_SOURCE_SNAPSHOT",
+  "problem": "Describe the recorded failure and its evidence.",
+  "solution": "State the chosen correction, relevant callers and regression coverage.",
+  "changes": [
+    { "path": "Assets/REPLACE_WITH_SOURCE.cs", "operation": "edit", "instruction": "Apply the exact chosen correction; preserve the full acceptance contract." }
+  ],
+  "context": [],
+  "verification": ["REPLACE_WITH_REQUIRED_CHECK_NAME"],
+  "unity": {
+    "steps": []
+  },
+  "budget": { "workCalls": 24, "readCalls": 12, "handoffCalls": 3, "durationMs": 900000 }
+}

package/scaffold/.nccgs/templates/repair-unity-editor.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 2,
+  "repairType": "unity-editor",
+  "taskId": "REPLACE_WITH_TASK_ID",
+  "contractHash": "REPLACE_WITH_CURRENT_CONTRACT_HASH",
+  "sourceSnapshot": "REPLACE_WITH_CURRENT_SOURCE_SNAPSHOT",
+  "problem": "Describe the recorded scene, prefab or asset failure.",
+  "solution": "State the chosen Editor operation and how it saves only the exact affected files.",
+  "changes": [
+    { "path": "Assets/REPLACE_WITH_PREFAB.prefab", "operation": "edit", "instruction": "Apply and save the chosen correction through Unity Editor APIs." }
+  ],
+  "context": [],
+  "verification": ["REPLACE_WITH_REQUIRED_CHECK_NAME"],
+  "unity": {
+    "capabilities": { "path": ".nccgs/evidence/REPLACE_WITH_UNITY_DISCOVERY.json", "sha256": "REPLACE_WITH_CAPTURED_HASH" },
+    "steps": [
+      { "id": "apply-and-save", "command": "eval", "arguments": ["REPLACE_WITH_CHOSEN_CSHARP_BODY_USING_FULLY_QUALIFIED_TYPES"], "timeoutMs": 30000 }
+    ]
+  },
+  "budget": { "workCalls": 20, "readCalls": 8, "handoffCalls": 3, "durationMs": 900000 }
+}

package/scaffold/.nccgs/templates/task-slices.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "taskId": "REPLACE_WITH_EXISTING_TASK_ID",
+  "contractHash": "REPLACE_WITH_CURRENT_CONTRACT_HASH",
+  "sourceSnapshot": "REPLACE_WITH_CURRENT_SOURCE_SNAPSHOT",
+  "planId": "delivery-one",
+  "supersedes": null,
+  "reason": "Split the existing contract into bounded assignments within its remaining budget.",
+  "integration": "integrate",
+  "slices": [
+    {
+      "id": "foundation",
+      "objective": "Implement the first coherent behavior and its targeted test.",
+      "agent": "nccgs-gameplay-programmer",
+      "dependsOn": [],
+      "writePaths": ["Assets/REPLACE_WITH_FIRST_SOURCE.cs", "Assets/Tests/REPLACE_WITH_FIRST_TEST.cs"],
+      "criteria": ["REPLACE_WITH_ORIGINAL_CRITERION_ID"]
+    },
+    {
+      "id": "integrate",
+      "objective": "Implement the remaining behavior and integrate the full original contract.",
+      "agent": "nccgs-gameplay-programmer",
+      "dependsOn": ["foundation"],
+      "writePaths": ["Assets/REPLACE_WITH_SECOND_SOURCE.cs", "Assets/Tests/REPLACE_WITH_INTEGRATION_TEST.cs"],
+      "criteria": ["REPLACE_WITH_REMAINING_ORIGINAL_CRITERION_ID"]
+    }
+  ]
+}

package/scripts/cli.mjs

@@ -171,6 +171,10 @@ Usage:
   nccgs run --supervise --task ID --prompt-file FILE --session-budget-usd N [--max-resumes 2] [--timeout-ms 3600000] -- [provider options]
   nccgs run --recover-run RUN_ID [--project DIR] [--claude EXECUTABLE]
   nccgs task init|snapshot|ref|observe|verify|acceptance-status|record|check|close|bind|extend-review|refresh-inputs|migrate-evidence [options]
+  nccgs task dispatch-prompt|handoff-validate|record-review --id TASK --dispatch ID [--file HANDOFF]
+  nccgs task repair-editor --id TASK --dispatch ID --step STEP  (admitted Unity repair worker only)
+  nccgs task slice-preview|slice-plan --id TASK --file PLAN  (same task and budget)
+  nccgs task slice-status --id TASK
   nccgs agents --enable <role> | --disable <role> [--project <directory>]
   nccgs policy [--write]              Check/regenerate package routing
   nccgs migrate-execution --to standalone [--external-review off|advisory|required] [--model-profile <profile>] [--dry-run]

package/scripts/run.mjs

@@ -16,13 +16,14 @@ export function launchPlan(argv, env = process.env) {
     const option = options[i];
     if (option === "--dry-run") { dryRun = true; continue; }
     if (option === "--supervise") { supervised = true; continue; }
-    if (!["--project", "--claude", "--task", "--prompt-file", "--max-resumes", "--timeout-ms", "--session-budget-usd", "--recover-run"].includes(option) || !options[i + 1] || options[i + 1].startsWith("--")) throw new Error(`Invalid run option: ${option}; put Claude arguments after --`);
+    if (!["--project", "--claude", "--task", "--prompt-file", "--max-resumes", "--timeout-ms", "--session-budget-usd", "--recover-run", "--budget-phase"].includes(option) || !options[i + 1] || options[i + 1].startsWith("--")) throw new Error(`Invalid run option: ${option}; put Claude arguments after --`);
     const value = options[++i];
     if (option === "--project") project = path.resolve(value);
     else if (option === "--claude") binary = value;
     else if (option === "--task") supervision.taskId = value;
     else if (option === "--prompt-file") supervision.promptFile = path.resolve(value);
     else if (option === "--recover-run") { supervision.recoverRun = value; supervised = true; }
+    else if (option === "--budget-phase") { if (!["work", "final-review"].includes(value)) throw new Error("Budget phase must be work or final-review"); supervision.budgetPhase = value; }
     else if (option === "--max-resumes") supervision.maxResumes = Number(value);
     else if (option === "--timeout-ms") supervision.timeoutMs = Number(value);
     else supervision.budgetUsd = Number(value);
@@ -35,14 +36,14 @@ export function launchPlan(argv, env = process.env) {
   for (const argument of forwarded) if (conflicting.test(argument)) throw new Error(`NCCGS owns session permission/root settings; conflicting option: ${argument}`);
   if (supervised) {
     if (supervision.recoverRun) {
-      if (forwarded.length || supervision.taskId || supervision.promptFile || supervision.budgetUsd !== undefined || options.includes("--max-resumes") || options.includes("--timeout-ms")) throw new Error("Recovery preserves the original prompt, limits and provider arguments");
+      if (forwarded.length || supervision.taskId || supervision.promptFile || supervision.budgetUsd !== undefined || supervision.budgetPhase || options.includes("--max-resumes") || options.includes("--timeout-ms")) throw new Error("Recovery preserves the original prompt, limits and provider arguments");
     } else {
       if (!supervision.taskId || !supervision.promptFile || !Number.isFinite(supervision.budgetUsd) || supervision.budgetUsd <= 0) throw new Error("Supervision needs --task, --prompt-file and --session-budget-usd");
       if (!Number.isSafeInteger(supervision.maxResumes) || supervision.maxResumes < 0 || supervision.maxResumes > 5 || !Number.isSafeInteger(supervision.timeoutMs) || supervision.timeoutMs < 1000 || supervision.timeoutMs > 86400000) throw new Error("Invalid supervision continuation/time limits");
       const owned = /^(?:-p|--print|--output-format|--input-format|--session-id|--resume|-r|--continue|-c|--fork-session|--no-session-persistence|--max-budget-usd|--verbose|--bg|--background|--remote|--cloud)(?:=|$)/;
       for (const argument of forwarded) if (owned.test(argument)) throw new Error(`Supervisor owns native lifecycle option: ${argument}`);
     }
-  } else if (options.some(option => ["--task", "--prompt-file", "--max-resumes", "--timeout-ms", "--session-budget-usd"].includes(option))) throw new Error("Lifecycle options require --supervise");
+  } else if (options.some(option => ["--task", "--prompt-file", "--max-resumes", "--timeout-ms", "--session-budget-usd", "--budget-phase"].includes(option))) throw new Error("Lifecycle options require --supervise");
   return { project, binary, dryRun, mode, args: ["--permission-mode", mode === "full" ? "bypassPermissions" : "default", ...forwarded],
     supervision: supervised ? supervision : null, env: { ...env, NCCGS_PROJECT_ROOT: project, NCCGS_TASK_AUTONOMY: mode,
       // Native auto-backgrounding can otherwise turn a claimed foreground worker