nccgs 2.0.0 → 2.1.0

package/.claude/nccgs/MEMORY.md

@@ -1,9 +1,10 @@
 # NCCGS — portable framework decisions
 
 NCCGS means **New Claude Code Game Studio** and targets **Claude Code**.
-This is the prepared 2.0.0 stable package. It has not been published.
-Local preparation does not change npm tags. Native RC4 qualification is scoped
-to its frozen archive; see README.md and CHANGELOG.md for evidence boundaries.
+This is the unpublished 2.1.0 source, adding reversible project uninstallation.
+The earlier 2.0.0 release was published on 2026-10-28; its archive is unchanged.
+Local preparation does not change npm tags. Native qualification remains scoped
+to its frozen archives; see README.md and CHANGELOG.md for evidence boundaries.
 Project-specific authorizations, provider sessions, budgets and internal development
 history are retained separately, outside the public package. Nothing in this file
 authorizes spending, provider access or changes to a user's project by itself.
@@ -20,6 +21,9 @@ authorizes spending, provider access or changes to a user's project by itself.
   remains unknown. Never infer execution from a requested alias or a handoff marker.
 - Preserve failed attempts, negative reviews, task history, evidence and consumed
   allowances. An update, migration, retry or new report must not reset spent budgets.
+- Uninstall only from an external terminal after sessions and owned work stop.
+  Preserve game source, custom files and .nccgs history/budgets. Uninstall never
+  closes tasks, waives review/acceptance or authorizes deleting retained records.
 - Known-solution or contaminated benchmark baselines remain reference-only; do not
   score them as independent NCCGS runs.
 

package/.claude/nccgs/VERSION

@@ -1 +1 @@
-2.0.0
+2.1.0

package/.claude/nccgs/tools/compile-policy.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { json, loadPipeline } from "./policy.mjs";
+import { acquireInstallationLease } from "./installation-guard.mjs";
 
 export function renderAgent(template, route) {
   const match = template.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -98,6 +99,8 @@ export function generated(project) {
   return outputs;
 }
 export function compile(project, write = false) {
+  const lease = write ? acquireInstallationLease(project, "nccgs-policy") : null;
+  try {
   const differences = [];
   for (const [relative, content] of generated(project)) {
     const file = path.join(project, relative);
@@ -106,6 +109,7 @@ export function compile(project, write = false) {
     if (write) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, content, "utf8"); }
   }
   return differences;
+  } finally { lease?.release(); }
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   const project = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");

package/.claude/nccgs/tools/configure-models.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { atomicJson, hash, json, profilePolicy, contained, resolveExecution } from "./policy.mjs";
 import { renderAgent } from "./compile-policy.mjs";
 import { fingerprintFile } from "./integrity.mjs";
+import { acquireInstallationLease } from "./installation-guard.mjs";
 
 const args = process.argv.slice(2);
 const values = flag => args.flatMap((arg, index) => {
@@ -12,6 +13,8 @@ const values = flag => args.flatMap((arg, index) => {
   return [args[index + 1]];
 });
 const project = path.resolve(values("--project")[0] || path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../.."));
+const lease = acquireInstallationLease(project, "nccgs-agents");
+try {
 const explicit = values("--profile")[0];
 const { name, profile, pipeline } = profilePolicy(project, explicit);
 // Profile changes never change the execution policy or pending task obligations.
@@ -90,3 +93,4 @@ console.log(`NCCGS model profile '${name}' configured; ${writes.length} agent fi
 console.log("Model configuration records requested aliases/effort only. Runtime resolution requires Claude Code observation; execution policy and existing task approvals are unchanged.");
 if (legacyPolicy && !policyPattern.test(oldPolicy)) console.log("Legacy project policy preserved; model selection is stored in activation/install metadata until explicit policy migration.");
 for (const warning of warnings) console.warn(warning);
+} finally { lease.release(); }

package/.claude/nccgs/tools/installation-guard.mjs

@@ -0,0 +1,55 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+import { containedPath } from "./paths.mjs";
+import { acquireLock, ownerState } from "./process-lock.mjs";
+
+const unverifiedAdmission = cause => new Error("NCCGS installation admission is busy or unverified; the lock may be changing or unreadable. Retry after other work finishes; inspect permissions or retained lock records if it persists.", { cause });
+
+export function assertInstallationAvailable(project, ownToken = null) {
+  for (const relative of [".nccgs/uninstall.lock", ".nccgs/uninstall.lock.recovery"]) {
+    const lock = containedPath(project, relative);
+    if (fs.existsSync(lock)) {
+      let record;
+      try {
+        record = JSON.parse(fs.readFileSync(lock, "utf8"));
+        if (!record || typeof record !== "object" || Array.isArray(record)) throw new Error("Invalid lock record");
+      } catch (error) { throw unverifiedAdmission(error); }
+      if (relative === ".nccgs/uninstall.lock" && ownToken && record.token === ownToken) continue;
+      if (ownerState(record) !== "dead")
+        throw new Error(record.operation === "installation-admission"
+          ? "NCCGS installation admission is busy or unverified; another launch or configuration is being admitted. Retry after it finishes."
+          : "NCCGS uninstall is active or unverified; wait for it to finish before starting other work.");
+    }
+  }
+  const directory = containedPath(project, ".nccgs/uninstall");
+  if (!fs.existsSync(directory)) return;
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const folder = containedPath(project, `.nccgs/uninstall/${entry.name}`);
+    if (!fs.statSync(folder).isDirectory()) continue;
+    const file = containedPath(project, `.nccgs/uninstall/${entry.name}/manifest.json`);
+    if (!fs.existsSync(file)) continue;
+    const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!["completed", "restored", "cancelled"].includes(manifest.status))
+      throw new Error(`Interrupted uninstall ${entry.name}; inspect its backup and use uninstall --rollback before starting other work.`);
+  }
+}
+
+// Serialize admission with uninstall/rollback. No new cooperating writer can
+// leave a transient lease during apply/restore; the session lease then protects
+// the entire operation after this short gate is released. Nested configurators
+// may register their own leases without holding the gate for their lifetime.
+export function acquireInstallationLease(project, operation) {
+  assertInstallationAvailable(project);
+  let gate;
+  try { gate = acquireLock(containedPath(project, ".nccgs/uninstall.lock"), { operation: "installation-admission" }); }
+  catch (error) {
+    // A competing admission may have arrived after the first check. Explain the
+    // current holder without retrying, taking over, or changing its lease.
+    assertInstallationAvailable(project);
+    throw unverifiedAdmission(error);
+  }
+  try {
+    assertInstallationAvailable(project, gate.record.token);
+    return acquireLock(containedPath(project, `.nccgs/sessions/${crypto.randomUUID()}.lock`), { operation });
+  } finally { gate.release(); }
+}

package/CHANGELOG.md

@@ -1,8 +1,43 @@
 # Changelog
 
+## 2.1.0 — Unreleased
+
+- Handle the final LOW diagnostic finding: empty, incomplete, unreadable or
+  disappearing admission locks refuse with an actionable message, preserving
+  the original error cause. Keep ownership checks and explicit retry unchanged.
+
+- Resolve the follow-up review's two low-severity observations: distinguish
+  admission contention from active uninstall, and record session recovery as an
+  immutable pending receipt plus a separate success/failure outcome. Missing or
+  malformed outcomes remain unconfirmed; prior attempts and reviews stay intact.
+
+- Resolve the first independent maintenance review's four findings: add explicit
+  hash-bound operator recovery for crashed launcher leases with immutable receipts;
+  retain unknown process-state refusal and all task/job/run ownership checks.
+  Serialize run/install/agent/migration/policy admissions against uninstall,
+  cancel pre-mutation refusals without stranded receipts, and return backup IDs
+  even when empty-directory cleanup produces warnings. Historical negative review
+  and packages stay unchanged; the corrected archive requires fresh qualification.
+
+- Add `nccgs uninstall --project DIR`, a read-only `--dry-run` and guarded
+  `--rollback ID`. Remove unchanged inventoried framework files and exact NCCGS
+  hooks/imports; preserve customized files, shared Claude preferences, game source
+  and the full `.nccgs` policy/task/review/evidence/budget history.
+- Save every removed/replaced byte in a project-local uninstall receipt before
+  changing files. Refuse unsafe paths, ambiguous custom hooks, active/unverified
+  work and rollback over later user edits; attempt restoration on write failure.
+- Register `nccgs run` sessions so uninstallation cannot race a new managed
+  launch. An interrupted uninstall blocks launch/update until recovery. No process
+  is killed and no task, acceptance requirement, review or budget is reset.
+- The published 2.0.0 archive remains unchanged. This feature receives local
+  framework and installation tests; it is not a new Claude Code/Unity benchmark.
+  See [uninstall and recovery](docs/UNINSTALL.md).
+
 ## 2.0.0 — 2026-10-28
 
-Prepared stable package; unpublished. Local preparation does not move npm tags.
+Published to npm on 2026-10-28. The following notes describe its original
+preparation scope; the exact publication and native qualification have separate
+frozen receipts. No new version is published by preparing 2.1.0.
 
 - Publish existing external operator Editor start, graceful shutdown command and
   settled stop receipts into immutable reviewer-readable project bundles. Preserve

package/MEMORY.md

@@ -1,9 +1,10 @@
 # NCCGS — portable framework decisions
 
 NCCGS means **New Claude Code Game Studio** and targets **Claude Code**.
-This is the prepared 2.0.0 stable package. It has not been published.
-Local preparation does not change npm tags. Native RC4 qualification is scoped
-to its frozen archive; see README.md and CHANGELOG.md for evidence boundaries.
+This is the unpublished 2.1.0 source, adding reversible project uninstallation.
+The earlier 2.0.0 release was published on 2026-10-28; its archive is unchanged.
+Local preparation does not change npm tags. Native qualification remains scoped
+to its frozen archives; see README.md and CHANGELOG.md for evidence boundaries.
 Project-specific authorizations, provider sessions, budgets and internal development
 history are retained separately, outside the public package. Nothing in this file
 authorizes spending, provider access or changes to a user's project by itself.
@@ -20,6 +21,9 @@ authorizes spending, provider access or changes to a user's project by itself.
   remains unknown. Never infer execution from a requested alias or a handoff marker.
 - Preserve failed attempts, negative reviews, task history, evidence and consumed
   allowances. An update, migration, retry or new report must not reset spent budgets.
+- Uninstall only from an external terminal after sessions and owned work stop.
+  Preserve game source, custom files and .nccgs history/budgets. Uninstall never
+  closes tasks, waives review/acceptance or authorizes deleting retained records.
 - Known-solution or contaminated benchmark baselines remain reference-only; do not
   score them as independent NCCGS runs.
 

package/README.md

@@ -1,12 +1,13 @@
 # NCCGS — New Claude Code Game Studio
 
-**2.0.0** is a prepared stable package for standalone game-development
-orchestration in **Claude Code**. It is not published and does not move npm tags.
-It includes handoff automation, bounded task slicing and Unity repair, protected
+**2.1.0** is the unpublished next package for standalone game-development
+orchestration in **Claude Code**. It adds reversible project uninstallation;
+the published **2.0.0** archive remains unchanged. Local preparation moves no npm tags.
+It retains handoff automation, bounded task slicing and Unity repair, protected
 final-review allocation, managed Unity settlement and exact first-import output
 declarations. New repair steps block unsaved loaded scenes before execution.
 See [handoff operations](docs/HANDOFF-AUTOMATION.md), [bounded repair](docs/BOUNDED-REPAIR.md),
-[task slicing](docs/TASK-SLICING.md) and [release notes](CHANGELOG.md).
+[task slicing](docs/TASK-SLICING.md), [uninstallation](docs/UNINSTALL.md) and [release notes](CHANGELOG.md).
 
 Claude Code handles intake, planning, specialist dispatch, testing, independent
 review and reporting. External review can be configured separately. This major
@@ -25,9 +26,14 @@ This is scoped workflow evidence, not broad game-quality or productivity proof.
 Version 2.0.0 keeps those runtime guards and adds a receipt publisher so external
 Editor stop evidence is available inside the reviewer's project. It does not
 operate processes or alter acceptance. See [Editor evidence](docs/EDITOR-SESSION-EVIDENCE.md).
-Release receipts separately record archive tests, installation/upgrades and
-independent maintenance review. Preparation does not publish npm or claim a new
-full Unity game run through the stable archive. Frozen history remains intact.
+The exact 2.0.0 archive subsequently passed its scoped native Unity qualification
+and was published on 2026-10-28. Frozen release receipts retain its tests and
+independent reviews. The new 2.1.0 uninstaller receives local filesystem/CLI tests;
+that does not claim another Claude Code/Unity run. The first independent maintenance
+review required four fixes; this candidate adds those fixes and awaits qualification
+of its exact archive, including a fresh independent review. Earlier verdicts remain
+unchanged in their separate receipts.
+Frozen history remains intact.
 See [release status](docs/RELEASE-STATUS.md), [upgrading](UPGRADING.md),
 [Vietnamese quick start](docs/HUONG-DAN-MIGRATE-VA-SU-DUNG.md) and [decisions](MEMORY.md).
 
@@ -68,7 +74,7 @@ The studio retains 47 roles (13 active by default, including Game Designer), 36
 rules, lifecycle hooks and unmodified official Unity Skills. Enable specialists
 when their expertise resolves a concrete problem; do not dispatch the whole studio.
 
-## Try the prepared stable package
+## Try the local 2.1.0 package
 
 Requirements: Claude Code and Node.js 18+. Unity CLI/Pipeline is needed for live
 Unity operations. Run against a disposable Unity project first:
@@ -76,14 +82,14 @@ Unity operations. Run against a disposable Unity project first:
 Use the locally prepared archive and its accompanying SHA-256 manifest:
 
 ```powershell
-$NccgsArchive = "D:\path\to\nccgs-2.0.0.tgz"
+$NccgsArchive = "D:\path\to\nccgs-2.1.0.tgz"
 npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject" --dry-run
 npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject"
 npx --yes --package "$NccgsArchive" nccgs doctor --project "D:\path\to\UnityProject"
 ```
 
-Before publication, use this local archive. After publication, pin nccgs@2.0.0
-for repeatability; npm tags are not changed by this preparation. Use update for an existing installation only after reviewing its
+Before 2.1.0 publication, use this local archive. Published nccgs@2.0.0 does not
+include the uninstall command. Use update for an existing installation only after reviewing its
 dry run and backup. See [the tested upgrade matrix](docs/UPGRADE-QUALIFICATION.md) and its limits.
 The installer preserves customized files and unrelated Claude settings, records
 overrides and backs up replacements. Do not use --force as an ordinary update path.
@@ -139,6 +145,23 @@ Independent review uses Opus/high. These aliases are requested routes. Real Clau
 model resolution and provider access must be verified in the target session.
 Historical `astra-claude` routes remain available under compatibility execution.
 
+## Remove NCCGS when it is no longer needed
+
+Close Claude Code sessions, then preview and apply from an external terminal:
+
+```powershell
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject" --dry-run
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject"
+```
+
+This also supports an existing 2.0.0 installation without updating it first.
+Game source, customized files and `.nccgs` history/budgets remain. The command
+removes unchanged managed files and exact framework hooks/imports, saves a backup
+and refuses active or uncertain work. Use `uninstall --rollback ID` to restore
+that backup when no later edits conflict. Shared permission/model settings stay
+because their ownership was not recorded by earlier installers.
+See [details and recovery](docs/UNINSTALL.md).
+
 ## Maintainer verification and limits
 
 These commands run from a source/package checkout. They are not extra steps for

package/UPGRADING.md

@@ -1,7 +1,7 @@
-# Upgrading NCCGS 2.0.0
+# Upgrading NCCGS 2.1.0
 
-Current prepared stable package: **2.0.0**, unpublished. Preparation does not change
-npm `next` or `latest`. Use the local archive for reproducible evaluation.
+Current source: **2.1.0**, unpublished. Version 2.0.0 was published on 2026-10-28.
+Preparation does not change npm tags. Use the local 2.1.0 archive for evaluation.
 Read [release status](docs/RELEASE-STATUS.md) for what has and has not been verified.
 
 ## Choose the operation
@@ -12,6 +12,8 @@ Read [release status](docs/RELEASE-STATUS.md) for what has and has not been veri
 | Existing NCCGS installation | `update` | Updates managed files; preserves project-owned policy and customizations |
 | Intentionally adopt standalone execution | `migrate-execution --to standalone` | Explicitly changes execution configuration; separate from updating files |
 | Resume work | `run` | Launches Claude Code with the project's configured obligations |
+| Stop using NCCGS in this project | `uninstall` | Removes unchanged framework files/hooks; retains source, customizations and history |
+| Undo removal | `uninstall --rollback ID` | Restores verified backup bytes, refusing later edits |
 
 **Historical published-1.3.0 → RC3 upgrade qualification covers its tested fixture matrix.**
 See [upgrade qualification](docs/UPGRADE-QUALIFICATION.md) for scope and the RC2
@@ -26,7 +28,7 @@ Unity project with Assets, Packages and ProjectSettings. Live Unity operations
 also require the appropriate Unity Editor/CLI integration.
 
 ```powershell
-$NccgsArchive = "D:\path\to\nccgs-2.0.0.tgz"
+$NccgsArchive = "D:\path\to\nccgs-2.1.0.tgz"
 npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject" --dry-run
 npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject"
 npx --yes --package "$NccgsArchive" nccgs doctor --project "D:\path\to\UnityProject"
@@ -66,6 +68,10 @@ that selects the published stable channel, not this unpublished local archive.
 
 ## Optional execution-policy migration
 
+For removal instead of migration, use [uninstall and recovery](docs/UNINSTALL.md).
+The 2.1.0 CLI can remove an existing 2.0.0 installation directly. Removing or
+reinstalling never resets prior task, review, acceptance or budget obligations.
+
 After installing/updating, migrate only when the owner intends to adopt standalone.
 Review any active task's pinned obligations before changing policy.
 
@@ -108,5 +114,5 @@ game quality, completion of a task or human acceptance.
 
 Existing projects that intentionally use Astra/Fable keep their configured chain.
 See [compatibility gates](.claude/nccgs/protocols/task-gates.md). Historical 1.4/1.5
-guides describe their original versions; this document governs the current 2.0.0 package's
+guides describe their original versions; this document governs the current 2.1.0 package's
 installation commands and release status.

package/VERSION

@@ -1 +1 @@
-2.0.0
+2.1.0

package/docs/HUONG-DAN-MIGRATE-VA-SU-DUNG.md

@@ -1,12 +1,13 @@
-# Hướng dẫn cài đặt và sử dụng NCCGS 2.0.0
+# Hướng dẫn cài đặt và sử dụng NCCGS 2.1.0
 
-Gói stable đang chuẩn bị: **2.0.0**, chưa phát hành npm.
-Dùng gói cục bộ cùng mã SHA-256 đi kèm; việc chuẩn bị không đổi các kênh npm.
+Mã nguồn tiếp theo: **2.1.0**, chưa phát hành npm; bổ sung lệnh gỡ NCCGS.
+Bản **2.0.0** đã phát hành ngày 28/10/2026 và được giữ nguyên.
+Dùng gói 2.1.0 cục bộ cùng mã SHA-256 đi kèm; việc chuẩn bị không đổi các kênh npm.
 Biên bản operator dừng Editor phải được đưa vào hồ sơ reviewer bằng
 [hướng dẫn bằng chứng Editor](EDITOR-SESSION-EVIDENCE.md).
-Đây là gói stable đang chuẩn bị. Nâng cấp từ npm 1.3.0 đã được kiểm chứng trong phạm vi
-[các tình huống thử](UPGRADE-QUALIFICATION.md); chạy trọn một đầu việc mới bằng
-chính gói stable này vẫn là bước riêng chưa hoàn tất. Xem [trạng thái phát hành](RELEASE-STATUS.md).
+Kiểm thử tính năng gỡ là kiểm thử framework; không được tính thành một lượt
+Claude Code/Unity mới. Các bằng chứng cũ vẫn gắn với đúng gói đã kiểm chứng.
+Xem [trạng thái phát hành](RELEASE-STATUS.md).
 
 ## Cài mới vào bản sao dự án
 
@@ -15,7 +16,7 @@ Chức năng điều khiển Unity cần thêm Editor/CLI phù hợp. Thay đư
 dự án của bạn; đọc kết quả xem trước rồi mới áp dụng:
 
 ```powershell
-$NccgsArchive = "D:\path\to\nccgs-2.0.0.tgz"
+$NccgsArchive = "D:\path\to\nccgs-2.1.0.tgz"
 npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject" --dry-run
 npx --yes --package "$NccgsArchive" nccgs install --project "D:\path\to\UnityProject"
 npx --yes --package "$NccgsArchive" nccgs doctor --project "D:\path\to\UnityProject"
@@ -37,6 +38,34 @@ execution policy, dùng `migrate-execution --to standalone --dry-run` theo hư
 Không tự đổi task cũ, xóa lịch sử hay đặt lại số lượt đã dùng. Sau thay hook/cấu hình,
 mở lại phiên Claude Code.
 
+## Gỡ NCCGS khi không còn dùng
+
+Đóng các phiên Claude Code và chờ worker/kiểm tra kết thúc. Từ terminal bên ngoài,
+dùng gói 2.1.0 cục bộ để xem trước rồi gỡ khỏi đúng dự án:
+
+```powershell
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject" --dry-run
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject"
+```
+
+Có thể gỡ trực tiếp dự án đã cài 2.0.0, không cần nâng cấp trước. Lệnh chỉ xóa
+tệp quản lý còn nguyên bản và tháo hook/import NCCGS; giữ mã game, tệp tùy chỉnh,
+lịch sử task/review/nghiệm thu/chi phí và cấu hình trong `.nccgs`. Các thiết lập
+Claude dùng chung được giữ vì bản cũ chưa ghi nhận quyền sở hữu từng giá trị.
+
+Kết quả trả về mã `id` của bản sao lưu. Để khôi phục, dùng cùng gói với
+`uninstall --project DIR --rollback ID --dry-run`, sau đó bỏ `--dry-run`.
+Khôi phục sẽ bị chặn nếu tệp đã được sửa tiếp. Lệnh không dừng tiến trình, không
+xóa lịch sử và không hoàn lại ngân sách. Xem [chi tiết](UNINSTALL.md).
+
+Nếu launcher bị dừng bất thường, dùng `recover-session --id UUID --dry-run` để
+xem khóa. Chỉ xác nhận `--confirm-process-tree-stopped` sau khi operator đã kiểm
+tra toàn bộ cây tiến trình thực sự dừng; PID chết không đủ để suy ra điều đó.
+Lệnh yêu cầu đúng mã băm xem trước và lý do, lưu nguyên khóa cùng biên bản,
+không chạm khóa task/job/run. Các lệnh agent/migration/policy cũng bị chặn trong
+lúc gỡ. Gỡ bị chặn trước khi sửa tệp được ghi là `cancelled`; lỗi dọn thư mục
+rỗng chỉ là cảnh báo và vẫn trả về mã rollback.
+
 ## Bắt đầu một đầu việc rõ ràng
 
 ```powershell
@@ -64,14 +93,14 @@ nguyên nhân và kết quả sửa lại.
 
 ## Hỗ trợ handoff, Unity repair và chia nhỏ task trong NCCGS 2.0.0
 
-Source hiện có thêm các hỗ trợ chưa phát hành lên npm. Coordinator dùng
+Các hỗ trợ đã có từ 2.0.0 được giữ nguyên trong 2.1.0. Coordinator dùng
 `task dispatch-prompt` để lấy prompt và khung bàn giao PARTIAL cho lượt đã đăng ký.
 Worker có thể dùng `task handoff-validate` để phát hiện lỗi cấu trúc trước khi kết
 thúc; repair worker theo giới hạn riêng của gói repair. Sau khi reviewer hoàn thành,
 coordinator dùng `task record-review` để ghi đúng kết luận từ handoff đã ghim,
 qua đầy đủ cổng kiểm tra hiện có. Các lệnh này không tự chấp thuận hay đóng task.
 Xem [cú pháp và giới hạn](HANDOFF-AUTOMATION.md). Dùng source/package mới theo quy
-trình nâng cấp; các lệnh ở trên dùng chính gói 2.0.0 cục bộ chưa phát hành.
+trình nâng cấp; các lệnh ở trên dùng chính gói 2.1.0 cục bộ chưa phát hành.
 
 Repair cũ giữ nguyên. Gói mới `unity-code` cho sửa/tạo tối đa 8 tệp mã; `unity-editor`
 cho sửa scene/prefab/asset bằng thao tác Editor đã chốt trước. Tệp mới phải được

package/docs/RELEASE-STATUS.md

@@ -1,10 +1,27 @@
-# NCCGS 2.0.0 stable preparation
-
-Prepared stable package: **2.0.0**, unpublished. No npm publication or tag mutation
-has occurred. The release directory contains the exact local archive, SHA-256,
-regression/install/upgrade results and a separate maintenance review.
-
-## Current evidence boundary
+# NCCGS release status
+
+Current source: **2.1.0**, unpublished. It adds reversible project uninstallation,
+safe backup/rollback and launch/update protection during interrupted removal.
+See [removal semantics](UNINSTALL.md). Local tests do not claim a new native
+Claude Code/Unity run. The first independent maintenance review returned
+CHANGES_REQUIRED. This candidate adds logged operator session reconciliation,
+shared admission locking for configuration writers, pre-mutation cancellation
+and best-effort directory cleanup. Its exact archive requires fresh full
+regression and independent review; the earlier negative verdict is retained.
+
+Version **2.0.0** was published on 2026-10-28 after exact-archive qualification.
+The frozen publication receipt verified npm metadata and downloaded bytes,
+fresh consumer installation and all 472 packaged files. Its archive SHA-256 is
+`008df044b2486b273dbd0716782823b60da9750a676fa41cd4651a0e2f149cf3`.
+Its maintenance audit and native Unity case completed with independent PASS;
+the Unity case retained all 28 criteria/385 assertions, handoff, repair and the
+unsaved-scene guard. Detailed private task/provider/cost receipts stay outside
+the public package. That evidence does not transfer to 2.1.0 automatically.
+
+## Historical 2.0.0 preparation evidence
+
+The preparation-time notes below are retained for context. Their pending stable
+run/publication statements were superseded by the exact 2.0.0 completion above.
 
 - Exact RC4 archive SHA-256: a1db9783f3f4077c742cbc346d0fa935c438fdd783e13c058e13b0bd0521bbf6.
   The 2026-10-28 native Claude Code case qualified dirty-scene refusal, subsequent

package/docs/UNINSTALL.md

@@ -0,0 +1,134 @@
+# Remove NCCGS from a project
+
+`uninstall` is available in the **unpublished 2.1.0 package**. The published
+2.0.0 CLI does not have this command. Use the local 2.1.0 archive (or its source
+CLI) to remove an existing 2.0.0 installation; no preliminary update is needed.
+
+Close Claude Code sessions and let managed workers/verification finish first.
+Run from an external terminal. The command checks recorded process ownership,
+dispatches, runs and jobs; it never kills processes, settles jobs or closes tasks.
+Sessions launched directly with `claude`, or with older launchers, may have no
+session record, so they must also be closed by the operator.
+
+## Preview and remove
+
+```powershell
+$NccgsArchive = "D:\path\to\nccgs-2.1.0.tgz"
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject" --dry-run
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject"
+```
+
+From this source checkout, use `node scripts/cli.mjs uninstall --project DIR`
+with the same options. Always name the intended project. The package refuses
+to uninstall its own source directory.
+
+The preview writes nothing and lists files to remove, shared files to edit and
+modified/unknown inventoried files to preserve. There is no `--force` or history
+purge option. A repeated uninstall reports `NOT_INSTALLED` after successful removal.
+
+| Item | Result |
+|---|---|
+| Unchanged inventoried NCCGS/Unity skills, agents, protocols and tools | Removed after fingerprint checks |
+| Optional generated NCCGS agents | Removed only if their recorded fingerprints still match |
+| Customized or unknown managed files; unrelated files in `.claude` | Kept in place |
+| Exact NCCGS hooks and canonical import in `CLAUDE.md` | Removed; unrelated hooks and owner text kept |
+| Unchanged NCCGS bootstrap `CLAUDE.md` | Removed |
+| Game source, scenes, prefabs, packages and project settings | Unchanged |
+| `.nccgs` policy, task history, reviews, evidence, budgets and prior backups | Kept byte for byte |
+| Generic Claude permission/model preferences | Kept; older installers did not track their ownership |
+
+A retained custom NCCGS skill or agent may still be discoverable by Claude and
+may refer to removed tools. The output identifies those files for manual review;
+they are not silently deleted. Unknown non-inventoried owner files are never
+claimed as NCCGS-owned. Customized compound hooks/imports must be separated by
+the owner before removal, because automatically editing them could lose behavior.
+
+## Backup and recovery
+
+Removal prints an `id` and saves a manifest plus original file bytes beneath
+`.nccgs/uninstall/<id>/`. Keep that directory if you may need recovery.
+
+```powershell
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject" --rollback "PRINTED-UUID" --dry-run
+npx --yes --package "$NccgsArchive" nccgs uninstall --project "D:\path\to\UnityProject" --rollback "PRINTED-UUID"
+npx --yes --package "$NccgsArchive" nccgs doctor --project "D:\path\to\UnityProject"
+```
+
+Use the same package for recovery. All backup hashes and destination files are
+checked before restoration; a later edit or damaged backup causes refusal. The
+receipt and history remain after restoration. A write failure attempts automatic
+restoration; an interrupted operation requires inspection and explicit rollback.
+New launch/install/update operations refuse an incomplete uninstall receipt.
+Do not delete locks or receipts merely to bypass this check.
+
+Agent reconfiguration, execution migration and policy regeneration also participate
+in the uninstall admission lock. New cooperating operations cannot register a
+session while removal/rollback holds this lock. A refusal before any managed file
+is changed leaves a `cancelled` receipt with its diagnostic and backups; it does
+not require rollback. After changes begin, normal ownership checks still apply to
+restoration. Unrecorded/older concurrent operations require operator inspection.
+Failure to remove an empty directory is a warning after successful removal; the
+result still returns the backup path and rollback ID.
+
+Two launches/configuration commands can briefly contend for the admission lock.
+This reports `installation admission is busy or unverified`, rather than claiming
+an uninstall is running. Retry once the other operation finishes; the command
+does not retry automatically or take over a live/unverified lock.
+Empty, incomplete, unreadable or disappearing lock records also produce the
+busy/unverified diagnostic, retaining the original cause for inspection. They
+never authorize admission or automatic recovery. A holder that releases before
+the error recheck still results in refusal; retry explicitly once work settles.
+
+## Recover a crashed launcher lease
+
+Closing a terminal forcibly or a crash can leave a `nccgs run` lease in
+`.nccgs/sessions/<UUID>.lock`. An unmanaged child's descendants cannot be proven
+stopped merely because its launcher and child PIDs are dead. Uninstall therefore
+continues to refuse this unknown state automatically.
+
+The external operator can explicitly reconcile **only that launcher lease**:
+
+```powershell
+npx --yes --package "$NccgsArchive" nccgs recover-session --project "D:\path\to\UnityProject" --id "SESSION-UUID" --dry-run
+```
+
+Independently inspect and stop the entire session process tree first, including
+any child that spawned before its PID was recorded. Rebooting the host and checking
+that the session has not restarted is one way to establish that boundary. Only
+when this is true, use the preview's SHA-256 and record how it was confirmed:
+
+```powershell
+npx --yes --package "$NccgsArchive" nccgs recover-session --project "D:\path\to\UnityProject" --id "SESSION-UUID" --sha256 "HASH-FROM-PREVIEW" --confirm-process-tree-stopped --reason "Describe how the full session tree was confirmed stopped"
+```
+
+This is a human/operator attestation, **not automatic descendant proof**. The
+command refuses live/unverified recorded PIDs, a foreign host, changed hashes,
+wrong operation, unsafe IDs and invocation inside Claude Code. It archives the
+exact original lease and a receipt with the operator's reason under
+`.nccgs/session-recoveries/<id>/`. It never kills a process or edits task/job/run
+locks, verdicts, history or budgets. Other active/unknown work still blocks
+uninstall. A missing child PID during `spawning` explicitly remains unobserved
+in the receipt; the operator must establish shutdown independently before confirming.
+Keep the receipts and retry the original uninstall/rollback only after all work
+has settled. There is no age-based or automatic eviction of unknown leases.
+
+Each recovery writes an immutable `receipt.json` with status `pending` before
+moving the lease, then a separate `outcome.json` with status `completed` or
+`failed`. The outcome identifies the pending receipt by SHA-256. A rename failure
+leaves the original lease in place and records the error; it is not a successful
+recovery. If a crash or write failure leaves no valid outcome, completion remains
+unconfirmed: inspect both the original lease and the archive, retaining every
+record. The lease may already have moved if recording completion failed. A pending
+receipt alone never proves success, and the command does not report success when
+it cannot record completion. Retrying a failed move creates a new receipt; it
+does not overwrite the earlier attempt.
+
+Reinstalling later reuses retained policy and task records. It does not replenish
+spent money, turns, reviews or time. Restoring an old uninstall must not overwrite
+a subsequent installation. Removal/rollback is a maintenance action, not a task
+PASS, independent review, acceptance decision or a new allowance.
+
+The command removes the project integration only. It does not uninstall Claude
+Code, Unity, Node.js, global npm packages or npm's cache, and makes no provider
+calls. Symlinks/junctions, malformed records and uncertain process ownership fail
+closed rather than permitting deletion outside the checked project.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nccgs",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Unity-first game-studio operating system for Claude Code",
   "license": "MIT",
   "type": "module",