@bongos/core 1.19.319 → 1.19.320

package/scripts/gds/ship-git.js

@@ -0,0 +1,100 @@
+// scripts/gds/ship-git.js — the shell/git/argv runners and the injection-safe merge-argv builders.
+//
+// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
+// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
+// original ship.js lines 560-638 unchanged. ship.js remains the facade that
+// re-exports every name and owns the CLI entry point, so the ship contract and
+// every flag are untouched, and the other scripts that import from it are too.
+
+'use strict';
+
+const { execSync, execFileSync } = require('node:child_process');
+
+function gitOk(cmd, opts = {}) {
+  try {
+    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], ...opts }).trim();
+  } catch (_) {
+    return null;
+  }
+}
+
+function shellOk(cmd, opts = {}) {
+  try {
+    execSync(cmd, { stdio: 'inherit', ...opts });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+// argvOk / argvOut — the two no-shell exec primitives behind the git/gh wrappers.
+// Run `<cmd> <args...>` so each arg reaches the program as a literal argv element
+// (never interpolated into a shell string) — the discipline that closes the
+// autoMerge injection (#681), since branch names + DB-sourced value_summary flow
+// through here. `shell: false` is forced AFTER the opts spread so a caller can
+// never pass `{ shell: true }` and silently re-enable shell interpretation — the
+// no-shell guarantee is the whole point and must not be overridable.
+//   argvOk  — exit status only → boolean (gitArgvOk / ghArgvOk). stdio 'inherit'.
+//   argvOut — capture trimmed stdout → string|null (ghJson / fetchDeployedVersion).
+//             Default stdio captures BOTH stdout and stderr; a caller that must
+//             DISCARD stderr passes its own `stdio: ['ignore','pipe','ignore']`.
+function argvOk(cmd, args, opts = {}) {
+  try {
+    execFileSync(cmd, args, { stdio: 'inherit', ...opts, shell: false });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+function argvOut(cmd, args, opts = {}) {
+  try {
+    return execFileSync(cmd, args, {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      ...opts,
+      shell: false,
+    }).trim();
+  } catch (_) {
+    return null;
+  }
+}
+
+// gitArgvOk — the git boolean runner. The boolean/`stdio:'inherit'` contract
+// matches shellOk so callers can swap one for the other; see buildMergeArgv + the
+// #681 regression test.
+function gitArgvOk(args, opts = {}) {
+  return argvOk('git', args, opts);
+}
+
+// sanitizeGitHubRefs — rewrite "#NNN" → "task NNN" in any text that lands on a
+// GitHub-rendered surface that can't carry a markdown link (commit messages,
+// PR titles). GitHub autolinks every bare "#NNN" there to its OWN PR/issue
+// number space, which our GDS task ids long since diverged from — so a value
+// summary like "#914 player straw hat" rendered a dead link to issues/914 on
+// every merge commit (task 916). Pure + exported for the regression test.
+function sanitizeGitHubRefs(text) {
+  return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
+}
+
+// buildMergeArgv — construct the argv for the auto-merge commit. Pure +
+// exported so the regression test can assert the untrusted value_summary lands
+// as a single literal argv element (never spliced into a shell string). The
+// merge message is `Merge <branch>: <summary>` with task refs de-#-ed (commit
+// messages can't carry markdown links, so a bare "#NNN" would autolink to a
+// dead GitHub issue — task 916); transport stays argv, never a shell string.
+function buildMergeArgv(branch, valueSummary) {
+  const summary = sanitizeGitHubRefs(valueSummary) || `(no value summary)`;
+  const mergeMsg = `Merge ${branch}: ${summary}`;
+  return ['merge', '--no-ff', branch, '-m', mergeMsg];
+}
+
+module.exports = {
+  argvOk,
+  argvOut,
+  buildMergeArgv,
+  gitArgvOk,
+  gitOk,
+  sanitizeGitHubRefs,
+  shellOk,
+};

package/scripts/gds/ship-grade-steps.js

@@ -0,0 +1,376 @@
+// scripts/gds/ship-grade-steps.js — the grade step shared by shipMain and regradeMain: payload, reuse, scoring, printing.
+//
+// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
+// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
+// original ship.js lines 2580-2927 unchanged. ship.js remains the facade that
+// re-exports every name and owns the CLI entry point, so the ship contract and
+// every flag are untouched, and the other scripts that import from it are too.
+
+'use strict';
+const { getServerReward } = require('./ship-state.js');
+
+const fs = require('node:fs');
+const os = require('node:os');
+const { cliClient, rewardPolicy } = require('./cli-lib');
+const { gitOk } = require('./ship-git.js');
+const { resolveInstanceBase } = require('./ship-deploy-target.js');
+const { computeRawDiffHash, reconstructPanelIssues, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
+
+// ---------- Shared grade-step helpers (used by shipMain AND regradeMain) ----------
+//
+// #678: the grade step is factored out of shipMain so the `--regrade` recovery
+// path can reuse it verbatim instead of replicating ~50 lines (the trap that
+// learning #43 warned about — "runSubagentGrader in ship.js is NOT exported, so
+// replicate its ~10 lines"). These helpers are behavior-preserving lifts of the
+// inline blocks shipMain used before; both paths now share one implementation.
+
+// Map a grader result into the POST /tasks/:id/grade request body. Forwards the
+// advisory sub-scores (economy/security/efficiency) only when present so the
+// server's validateAndScore re-records them (back-compat: omitted when null).
+function buildGradePayload(gradeResult, committedFiles = null) {
+  return {
+    // touches[] cleanup [3/8] (task 878): pass the real committed changed-files
+    // so the server keys the shipper badges off the diff, not touches[].
+    ...(Array.isArray(committedFiles) && committedFiles.length > 0
+      ? { committed_files: committedFiles }
+      : {}),
+    subagent_output: {
+      functional_fidelity: gradeResult.rubric_scores?.functional_fidelity,
+      code_quality: gradeResult.rubric_scores?.code_quality,
+      ...(gradeResult.rubric_scores?.economy != null
+        ? { economy: gradeResult.rubric_scores.economy }
+        : {}),
+      ...(gradeResult.rubric_scores?.security_score != null
+        ? { security_score: gradeResult.rubric_scores.security_score }
+        : {}),
+      ...(gradeResult.rubric_scores?.efficiency_score != null
+        ? { efficiency_score: gradeResult.rubric_scores.efficiency_score }
+        : {}),
+      notes_md: gradeResult.notes_md,
+      confidence: gradeResult.signals?.confidence ?? null,
+      issues: gradeResult.issues,
+    },
+    signals: gradeResult.signals,
+  };
+}
+
+// Log the grader panel's own API spend (#486 / ADR 0028 path 1). Best-effort +
+// idempotent on (source, source_ref): a cost-log failure must never block a
+// ship/re-grade, and re-grading at the same HEAD is a no-op.
+async function logGraderPanelCost(taskId, gradeResult) {
+  const panelCostUsd = Number(gradeResult.panel_cost_usd) || 0;
+  if (panelCostUsd <= 0) return;
+  const headSha = gitOk('git rev-parse --short HEAD') || 'nohead';
+  const costPost = await (await cliClient()).cost.postCost({
+    body: {
+      task_id: Number(taskId),
+      amount_usd: panelCostUsd,
+      category: 'api',
+      source: 'grader',
+      source_ref: `grade-${taskId}-${headSha}`,
+      description: `grader panel (${gradeResult.grader_kind || 'subagent'}) on #${taskId}`,
+    },
+  });
+  // An idempotent conflict returns HTTP 200 {skipped:true} (cost.js), so
+  // costPost.ok is TRUE on a skip — check `skipped` first.
+  if (costPost.data && costPost.data.skipped) {
+    console.log(`  grader cost already logged for ${headSha} (idempotent skip)`);
+  } else if (costPost.ok) {
+    console.log(`  grader cost logged: $${panelCostUsd.toFixed(4)} → cost_log (category=api, source=grader)`);
+  } else {
+    console.log(`  grader cost log skipped (non-fatal): HTTP ${costPost.status}`);
+  }
+}
+
+// task 1002662: assemble the delta-aware prior-round context for a --regrade.
+// Pure (no git/network) so the payload shape is unit-tested. Returns null when
+// there is no prior grade worth being delta-aware of; otherwise:
+//   forPanel — { round, findings_md, response_md, interim_md } for the worker
+//              prompts (fenced as untrusted by the shared scaffold);
+//   audit    — the compact regrade block recorded into the new grade's signals
+//              so grade_attempts rounds read as remediation history (the
+//              task-1002661 reader consumes this).
+const PRIOR_ROUND_TEXT_CAP = 4000;
+function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits = '', interimDiffStat = '' }) {
+  if (!storedGrade || typeof storedGrade !== 'object') return null;
+  const issues = Array.isArray(storedGrade.issues) ? storedGrade.issues : [];
+  const notes = typeof storedGrade.notes_md === 'string' ? storedGrade.notes_md.trim() : '';
+  if (issues.length === 0 && !notes) return null;
+  const verdictLine = `Prior verdict: ${storedGrade.passed ? 'PASS' : 'FAIL'} · score ${storedGrade.score ?? '?'}/10 · ${issues.length} finding(s)`;
+  const findingLines = issues.map((it) => `- [${it.severity || '?'}] ${it.worker || 'panel'} · ${it.file || '?'} — ${it.summary || ''}`);
+  const findings_md = [
+    verdictLine,
+    '',
+    ...(findingLines.length ? findingLines : ['(no per-finding rows — see the prior notes below)']),
+    ...(notes ? ['', 'Prior panel notes:', notes.slice(0, PRIOR_ROUND_TEXT_CAP)] : []),
+  ].join('\n');
+  const interimParts = [];
+  if (interimCommits) interimParts.push('Interim commits since the prior grade:', String(interimCommits).slice(0, PRIOR_ROUND_TEXT_CAP));
+  if (interimDiffStat) interimParts.push('', 'Interim diffstat:', String(interimDiffStat).slice(0, PRIOR_ROUND_TEXT_CAP));
+  const response = String(responseText || '').trim();
+  // Round numbering is self-consistent across regrades: the first grade is
+  // round 1; each regrade reads the prior signals.regrade.round when present.
+  const round = (Number(storedGrade.signals?.regrade?.round) || 1) + 1;
+  return {
+    forPanel: {
+      round,
+      findings_md,
+      response_md: response ? response.slice(0, PRIOR_ROUND_TEXT_CAP) : null,
+      interim_md: interimParts.length ? interimParts.join('\n') : null,
+    },
+    audit: {
+      round,
+      prior_passed: storedGrade.passed === true,
+      prior_score: storedGrade.score ?? null,
+      prior_findings_count: issues.length,
+      response_present: Boolean(response),
+      interim_present: Boolean(interimCommits || interimDiffStat),
+    },
+  };
+}
+
+// Run the subagent grader against the committed diff, POST the result to the
+// rank-open /tasks/:id/grade endpoint, and log the panel cost on success.
+// Returns the raw apiCall response so the caller can branch on .ok / read the
+// grade. Shared by the ship path and the --regrade path.
+//
+// V4.R08: before spawning the adversarial panel we compute the raw diff hash
+// and check whether a stored PASS grade exists for the same hash. On a match
+// we re-POST the stored grade (marking it reused in signals) and skip the
+// panel entirely — cheap re-ships with an unchanged diff stay fast.
+// task 1002660: the COMPUTE half — the reuse lookup + the panel run. No server
+// writes, so shipMain can start it before the smoke gate and overlap the
+// multi-minute panel with smoke + the claim resolve. Returns
+// { kind: 'reuse', currentHash, reusedResult } | { kind: 'fresh', currentHash, gradeResult }.
+async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
+  // Compute the fingerprint of the raw (untruncated) diff so we can compare
+  // against any stored grade, independent of the display-truncation cap.
+  const currentHash = computeRawDiffHash(baseline);
+
+  if (currentHash) {
+    const storedGradeRes = await (await cliClient()).tasks.getTasksId({ id: taskId, query: { include: 'grade' } });
+    const storedGrade = storedGradeRes.ok ? (storedGradeRes.data.grade ?? null) : null;
+
+    if (shouldReuseGrade(storedGrade, currentHash)) {
+      console.log('  Grade reuse: stored PASS grade matches current diff hash — skipping panel.');
+      // Reuse the stored result with a reused marker so the audit trail is
+      // complete. We keep the original grader_kind and inject reuse metadata
+      // into signals so a bare table scan can spot reused grades.
+      const reusedSignals = {
+        ...(storedGrade.signals || {}),
+        reused_from_diff_hash: storedGrade.diff_hash,
+        reused_at: new Date().toISOString(),
+      };
+      const reusedResult = {
+        passed:        storedGrade.passed,
+        score:         storedGrade.score,
+        threshold:     storedGrade.threshold,
+        grader_kind:   storedGrade.grader_kind,
+        grader_version: storedGrade.grader_version,
+        rubric_scores: storedGrade.rubric_scores,
+        notes_md:      storedGrade.notes_md,
+        signals:       reusedSignals,
+        // task 1002660: carry the original panel's issues (rebuilt from
+        // signals.workers[].issues — the row stores them nowhere else) so the
+        // reused PASS stands on the same substance/evidence it passed with.
+        issues:        reconstructPanelIssues(storedGrade.signals),
+      };
+      return { kind: 'reuse', currentHash, reusedResult };
+    }
+  }
+
+  const gradeResult = await runSubagentGrader({
+    task,
+    valueSummary: summary,
+    baseline,
+    changedFiles: committedFiles,
+    priorRound: priorRound?.forPanel ?? null,
+  });
+  // task 1002662: record the regrade audit block on the new grade's signals so
+  // this round is readable as remediation history (grade_attempts keeps one row
+  // per round; the latest grade's signals.regrade names what it responded to).
+  if (priorRound?.audit) {
+    gradeResult.signals = { ...(gradeResult.signals || {}), regrade: priorRound.audit };
+  }
+  return { kind: 'fresh', currentHash, gradeResult };
+}
+
+// The RECORD half: POST the computed grade + log the panel cost. `precomputed`
+// (a promise from computeGradeResult, task 1002660) lets the ship path hand in
+// the overlapped computation; the --regrade path passes nothing and computes
+// inline — behavior identical to the pre-split gradeAndRecord either way.
+async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null }) {
+  const computed = await (precomputed
+    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound }));
+
+  if (computed.kind === 'reuse') {
+    const payload = { ...buildGradePayload(computed.reusedResult, committedFiles), diff_hash: computed.currentHash };
+    return (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
+    // No logGraderPanelCost — the panel didn't run, there's no cost to log.
+  }
+
+  const { gradeResult } = computed;
+  const payload = { ...buildGradePayload(gradeResult, committedFiles), diff_hash: computed.currentHash ?? undefined };
+  const gradePost = await (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
+  // Log the panel's cost once the grade is recorded — independent of the
+  // pass/fail VERDICT (the panel ran, and cost money, either way), but only
+  // when the POST itself succeeded (a failed POST means nothing was recorded).
+  if (gradePost.ok) await logGraderPanelCost(taskId, gradeResult);
+  return gradePost;
+}
+
+// Build the grade verdict display block as a string (per-axis scores + notes +
+// issues + next-step hints). Pure + exported so the #943 grader-unavailable vs
+// FAIL branch is unit-tested without capturing stdout. printGradeOutcome just
+// prints what this returns.
+function formatGradeOutcome(g, taskId) {
+  const out = [];
+  // #943: a TOTAL grader outage (every gating worker failed to spawn / the
+  // grader was bypassed pre-spawn) is NOT a quality rejection — it's "the grader
+  // could not run". Present it distinctly so a worker-infra failure never reaches
+  // the builder as a misleading "FAIL · 0/10 — fix the issues" (the session-1659
+  // false-FAIL). There are no issues to fix; the path forward is re-grade when the
+  // grader is reachable, or manual-confirm.
+  if (g.signals?.panel_outcome === 'unavailable') {
+    const reason = g.signals?.grader_unavailable_reason;
+    out.push('');
+    out.push(`Subagent grade: GRADER UNAVAILABLE${reason ? ` (${reason})` : ''}  ·  no quality signal produced — NOT a quality rejection`);
+    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
+    out.push('');
+    out.push('The grader could not run (infra/outage/bypass) — there are no findings to fix. Task stays at completed.');
+    out.push('When the grader is reachable again, re-grade:');
+    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
+    out.push('Or land it now via manual-confirm:');
+    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/gds/tasks/${taskId}/confirm`);
+    return out.join('\n');
+  }
+
+  // task 1002614 (map P-2): a protected-path refusal used to render as an
+  // ordinary quality FAIL — "fix the issues and --regrade" — although no rank of
+  // the builder's can land that diff. Present it as the authorization wall it is
+  // (the #943 grader-unavailable branch is the precedent for a distinct shape).
+  // Keyed off the guard name so it also reads grades from servers predating the
+  // authorization_refusal marker.
+  const guardTripped = g.signals?.server_guard?.tripped || [];
+  const permRefusal = g.signals?.server_guard?.authorization_refusal === true
+    || guardTripped.some((t) => t.guard === 'permission_path');
+  if (!g.passed && permRefusal) {
+    out.push('');
+    out.push('Subagent grade: REFUSED (authorization)  ·  not a quality verdict — your work was not judged and rejected');
+    out.push('');
+    out.push('The committed diff touches PROTECTED surfaces above your rank, so the server');
+    out.push('refused to accept it — no re-attempt at your rank can land this diff as-is.');
+    if ((g.issues || []).length > 0) {
+      out.push('');
+      out.push('What was refused (file · rule):');
+      for (const it of g.issues.filter((i) => String(i.worker || '').includes('permission-path'))) {
+        out.push(`  ${it.file || '?'} — ${it.summary || ''}`);
+      }
+    }
+    out.push('');
+    out.push('Ways forward:');
+    out.push('  - Split the protected files out of your diff and re-ship the rest, or');
+    out.push('  - hand this task to a builder at/above the floor the refusal names.');
+    out.push(`(--regrade re-runs the same server check and will refuse again unless the diff changes.)`);
+    return out.join('\n');
+  }
+
+  const verdict = g.passed ? 'PASS' : 'FAIL';
+  out.push('');
+  out.push(`Subagent grade: ${verdict}  ·  blended ${g.score}/10  ·  threshold ${g.threshold} (both axes)`);
+  if (g.rubric_scores) {
+    const ff = g.rubric_scores.functional_fidelity;
+    const cq = g.rubric_scores.code_quality;
+    if (ff != null) out.push(`  functional_fidelity: ${ff}/10`);
+    if (cq != null) out.push(`  code_quality:        ${cq}/10`);
+  }
+  if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
+  if ((g.issues || []).length > 0) {
+    out.push('');
+    out.push(`Issues (${g.issues.length}):`);
+    for (const it of g.issues) {
+      const sev = String(it.severity || '?').padEnd(7);
+      out.push(`  [${sev}] ${it.file || '?'} — ${it.summary || ''}`);
+    }
+  }
+  if (!g.passed) {
+    out.push('');
+    out.push('Grade failed — task stays at completed. Fix the issues above, commit, then re-grade:');
+    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
+    out.push('Last resort (only if the grade was wrong):');
+    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/gds/tasks/${taskId}/confirm`);
+  }
+  return out.join('\n');
+}
+
+// Print the grade verdict + per-axis scores + notes + issues. On a FAIL, print
+// both the re-grade hint (the cheap default) and the Archon override curl (the
+// last resort — see feedback_prefer_regrade_over_override). #943: a total grader
+// outage prints as "GRADER UNAVAILABLE", not a 0/10 FAIL — see formatGradeOutcome.
+function printGradeOutcome(g, taskId) {
+  console.log(formatGradeOutcome(g, taskId));
+}
+
+// Print the credits line + multiplier breakdown + idea bonus + unlocked
+// achievements from a grade/confirm response.
+function printCreditsAndAchievements({ postGradeStatus, credits, creditsRaw, creditsMultiplier, ideaBonusInfo, justUnlocked }) {
+  console.log('');
+  if (postGradeStatus === 'completed') {
+    console.log(`Credits awarded: ${credits} (none — task at completed, grade not passed)`);
+  } else if (postGradeStatus === 'confirmed') {
+    console.log(`Credits awarded: ${credits} (none yet — credits land when the task merges to main)`);
+  } else if (!rewardPolicy(getServerReward()).perTaskCredit) {
+    // cost-plus-only (ADR 0146): the per-task estimate is never paid, so this is
+    // 0 BY DESIGN. Left unexplained it reads as a broken payout — it sent a real
+    // session diagnosing the reward gate on 2026-07-26 (task 1002469).
+    console.log(`Credits awarded: ${credits} — expected: this instance pays cost-plus only.`);
+    console.log("  The task's estimate is a guide, never a payout. You're paid for this session's");
+    console.log('  real cost + 20%, booked separately from your token spend.');
+  } else {
+    console.log(`Credits awarded: ${credits}`);
+  }
+  // Write the credits flag so the NEXT Claude turn plays the credits-awarded
+  // sound via the Stop hook (task 582). Only when credits were actually awarded.
+  if (typeof credits === 'number' && credits > 0) {
+    const tmpDir = process.platform === 'win32'
+      ? (process.env.TEMP || process.env.TMP || os.tmpdir()) : '/tmp';
+    try { fs.writeFileSync(require('path').join(tmpDir, 'otb-credits'), ''); } catch (_) {}
+  }
+  if (creditsRaw != null && creditsMultiplier != null && Number(creditsMultiplier) !== 1.0) {
+    const mult = Number(creditsMultiplier).toFixed(2).replace(/0$/, '').replace(/\.$/, '.0');
+    console.log(`  Kind multiplier: ${creditsRaw}c × ${mult}× → ${credits}c`);
+  }
+  if (ideaBonusInfo && ideaBonusInfo.ideaBonusAwarded > 0) {
+    console.log(
+      `  Idea-promotion bonus: +${ideaBonusInfo.ideaBonusAwarded}c paid to builder #${ideaBonusInfo.bonusBuilderId} (idea #${ideaBonusInfo.ideaId})`
+    );
+  }
+  for (const ach of justUnlocked || []) {
+    const bonus = ach.credit_bonus > 0 ? ` (+${ach.credit_bonus}c bonus)` : '';
+    console.log(`✨ Achievement unlocked: ${ach.name}${bonus}`);
+  }
+}
+
+// chooseBroadcastTargets — the ship-broadcast channel router (task 990) now lives
+// in src/bongos/ship-broadcast.js (task 1045) so the server-mediated publish path
+// shares the exact same security-sensitive routing. Imported at the top of this
+// file; still re-exported below for tests/ship_broadcast_routing.mjs.
+
+// task 1442: play the task-shipped "ship bell". ship.js runs as its own process
+// (not inside a Claude turn), so it plays the sound directly rather than via the
+// Stop hook. Called at the confirmed/shipped success milestone so it rings on
+// the ci/async landing path too — there ship.js exits at 'confirmed' and the
+// deploy finishes later server-side, which is exactly why the old post-deploy
+// call site never fired (bug #1442). Resolve the builder's chosen variant from
+// the local prefs file; fall back to 'ship'. Best-effort: playSound swallows all
+// errors and is a silent no-op with no audio player, so this can never fail a ship.
+
+module.exports = {
+  buildGradePayload,
+  buildPriorRoundContext,
+  computeGradeResult,
+  formatGradeOutcome,
+  gradeAndRecord,
+  printCreditsAndAchievements,
+  printGradeOutcome,
+};