fix(scorm): weight final quiz 75% + last-attempt scoring; mandate XOT…

[RichardoC]

… validation

The final comprehensive quiz's results were effectively not reaching the LMS grade. Root cause, traced through Xerte's xttracking_scorm1.2.js: SCORM 1.2 reports a single cmi.core.score.raw for the whole package, computed as a weighted average across quizzes. With no trackingWeight on any quiz, all 8 contributed equally (1/8 = 12.5% each), so the final quiz was nearly invisible despite COURSE_SPEC.md specifying themes 25% / final 75%. Separately, trackingMode="full_first" locked each quiz's first attempt forever, trapping learners in bad scores on tricky questions.

Changes to source/data.xml + source/preview.xml (identical):

• trackingMode: full_first -> "full" (last attempt counts; retries can improve the recorded grade).
• trackingWeight="1" on the 7 theme quizzes, trackingWeight="21" on the final comprehensive quiz -> final is 21/28 = 75% of the LMS grade, themes 7/28 = 25%, matching COURSE_SPEC.md.

Validated end-to-end through a running XOT (docker-container branch) instance on host port 8088:

• play.php?template_id=1 returns 200; HTML5 editor opens and loads trackingWeight into lo_data for all 8 quizzes.
• Editor Publish round-trip PRESERVES trackingWeight + trackingMode="full" in data.xml (the lo_data loader reads it and the Publish serializer writes it back) -- editor-based edits are safe, no re-application needed.
• SCORM export is valid SCORM 1.2 (one SCO) and the exported template.xml carries trackingMode="full", trackingWeight 1x7 + 21, 45 questions, 8 quizzes, 0 empty options.

Guidance updates:

• docs/PROJECT_CONTEXT.md: added convention 9 -- "Validate every source/data.xml change through XOT before shipping" (MANDATORY), with concrete checks; rewrote the "How to make changes" workflow to include the XOT-validation step and a direct-attribute-push routine; added a "SCORM scoring" section explaining the weighted-average + lesson_status behaviour; corrected the editor round-trip caveat to "verified to survive"; updated the verification checklist greps and host port (8088).
• docs/COURSE_VERIFICATION.md: fix docs: explain why this project exists #3 records the XOT validation results and references convention 9; removed the obsolete "weighting not applied" deviation.
• docs/AGENT_COURSE_GUIDE.md: corrected both tracking-weight notes to reflect that trackingWeight survives a Publish round-trip.

Note: cmi.core.lesson_status still goes incomplete -> passed/failed only when all 48 pages are completed (no unmarkForCompletion on content pages). If an LMS hides score.raw while incomplete, learners must finish the final quiz and let the package fire LMSFinish for the grade to post. Left unchanged per the owner's call; document if it becomes an issue.

Generated with pi 0.80.2 and GLM 5.2

[github-actions]

📖 Course content preview

Download the course-preview artifact from the workflow run and open index.html to read the full course (pages + quizzes, correct answers marked ✓):

• Workflow run: https://github.com/RichardoC/secure-code-training/actions/runs/28457962626
• Artifact (scroll to "Artifacts"): https://github.com/RichardoC/secure-code-training/actions/runs/28457962626#artifacts

This preview is generated from source/data.xml by tools/render_preview.py. It is for review only — the playable SCORM package is built by the release workflow.