@boyingliu01/xp-gate 0.20.0 → 0.20.2

package/hooks/pre-commit

@@ -242,6 +242,9 @@ record_gate_audit() {
   local passed="$3"
   local issues_found="$4"
   local start_ms="$5"
+  # Optional free-form detail (e.g. gate-3's effective CCN threshold, #507).
+  # Additive and omitted when absent, so existing callers stay unchanged.
+  local detail="${6:-}"
   local end_ms
   end_ms=$(now_ms)
   local duration_ms=$((end_ms - start_ms))
@@ -271,6 +274,7 @@ record_gate_audit() {
       --duration-ms "$duration_ms" \
       $duration_anomaly_flag \
       --trigger commit \
+      ${detail:+--detail "$detail"} \
       2>/dev/null
   } &
   disown 2>/dev/null || true
@@ -459,10 +463,36 @@ record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "0" "$GATE_0_S
 
 echo ""
 
-# Get list of changed files
-CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-
-if [ -z "$CHANGED_FILES" ]; then
+# Get list of changed files.
+#
+# Byte-identical mirrors (src/npm-package/**) are governed by CI Mirror Parity,
+# not by re-linting. Leaving them in this scan set double-counted every
+# lint/complexity signal and made jscpd report the source-vs-mirror pair as a
+# 100% whole-file clone, which then tripped Gate 6's "<=5 warnings must clear
+# to zero" rule on ANY edit to a mirrored file -- a warning that is
+# structurally impossible to clear. (Gate 6's MIRROR_EXCLUDE and #494's test
+# selection already exclude mirrors for the same reason.)
+#
+# IMPORTANT: the exclusion applies to the LINT SCAN CORPUS only. The early
+# exit below must key on the RAW staged list -- Gate 8 (secret scanning) is
+# unconditional and fail-closed (#499), and gating it behind a path-filtered
+# list would let a mirror-only commit land with zero secret scanning and no
+# CI backstop.
+# Single source of truth for the mirror-path filter (#510): every consumer
+# that must ignore the byte-identical npm-package mirrors (lint corpus here,
+# Boy Scout's new/modified split further down) reads this one regex, so the
+# two sites cannot drift apart.
+# dashboard/ is a standalone browser-only visualization page (document/Chart.js
+# globals, static HTML output). It is not part of the gate engine, never runs
+# in CI or hooks, and its chart-config object literals trip structural rules
+# (deep-nesting/long-function) that carry no signal for this codebase. Same
+# scope rationale as the mirror exclusion (#507 Delphi round-2 follow-up).
+MIRROR_PATH_FILTER='^src/npm-package/'
+DASHBOARD_PATH_FILTER='^dashboard/'
+RAW_CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" || true)
+
+if [ -z "$RAW_CHANGED_FILES" ]; then
   echo "No files changed. Skipping gates."
   exit 0
 fi
@@ -629,21 +659,21 @@ if [ -z "$PROJECT_LANGS" ] && [ -z "$_CONFIG_LANGS" ]; then
         PROJECT_LANGS="dart"
       fi
     elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
-      KOTLIN_FILES=$(find . -name "*.kt" -not -path "./.git/*" 2>/dev/null | wc -l)
+      KOTLIN_FILES=$(find . -name "*.kt" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | wc -l)
       if [ "$KOTLIN_FILES" -gt 0 ]; then
         PROJECT_LANGS="kotlin"
       else
         PROJECT_LANGS="java"
       fi
     elif [ -f "CMakeLists.txt" ] || [ -f "Makefile" ]; then
-      CPP_FILES=$(find . -maxdepth 2 \( -name "*.cpp" -o -name "*.cxx" -o -name "*.cc" \) -not -path "./.git/*" 2>/dev/null | head -1)
-      OBJC_FILES=$(find . -maxdepth 2 \( -name "*.m" -o -name "*.mm" \) -not -path "./.git/*" 2>/dev/null | head -1)
+      CPP_FILES=$(find . -maxdepth 2 \( -name "*.cpp" -o -name "*.cxx" -o -name "*.cc" \) -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
+      OBJC_FILES=$(find . -maxdepth 2 \( -name "*.m" -o -name "*.mm" \) -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$CPP_FILES" ]; then
         PROJECT_LANGS="cpp"
       elif [ -n "$OBJC_FILES" ]; then
         PROJECT_LANGS="objectivec"
       fi
-    elif [ -n "$(find . -maxdepth 2 -name "*.ps1" -not -path "./.git/*" 2>/dev/null | head -1)" ]; then
+    elif [ -n "$(find . -maxdepth 2 -name "*.ps1" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)" ]; then
       PROJECT_LANGS="powershell"
     fi
   fi
@@ -711,7 +741,7 @@ CHANGEDFILELIST
   # Only used when extension-based detection found nothing
   if [ -z "$PROJECT_LANGS" ]; then
     # Search for TypeScript/JavaScript projects
-    TSCONFIG_SUB=$(find . -maxdepth 2 -name "tsconfig.json" -not -path "./.git/*" -not -path "./node_modules/*" 2>/dev/null | head -1)
+    TSCONFIG_SUB=$(find . -maxdepth 2 -name "tsconfig.json" -not -path "./.git/*" -not -path "*/node_modules/*" -not -path "./node_modules/*" 2>/dev/null | head -1)
     if [ -n "$TSCONFIG_SUB" ]; then
       PROJECT_SUBDIR=$(dirname "$TSCONFIG_SUB")
       if [ -f "$PROJECT_SUBDIR/package.json" ] && grep -q "react-native" "$PROJECT_SUBDIR/package.json" 2>/dev/null; then
@@ -723,7 +753,7 @@ CHANGEDFILELIST
 
     # Search for Python projects
     if [ -z "$PROJECT_LANGS" ]; then
-      PYPROJECT_SUB=$(find . -maxdepth 2 -name "pyproject.toml" -not -path "./.git/*" 2>/dev/null | head -1)
+      PYPROJECT_SUB=$(find . -maxdepth 2 -name "pyproject.toml" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$PYPROJECT_SUB" ]; then
         PROJECT_LANGS="python"
         PROJECT_SUBDIR=$(dirname "$PYPROJECT_SUB")
@@ -732,7 +762,7 @@ CHANGEDFILELIST
 
     # Search for Go projects
     if [ -z "$PROJECT_LANGS" ]; then
-      GOMOD_SUB=$(find . -maxdepth 2 -name "go.mod" -not -path "./.git/*" 2>/dev/null | head -1)
+      GOMOD_SUB=$(find . -maxdepth 2 -name "go.mod" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$GOMOD_SUB" ]; then
         PROJECT_LANGS="go"
         PROJECT_SUBDIR=$(dirname "$GOMOD_SUB")
@@ -741,7 +771,7 @@ CHANGEDFILELIST
 
     # Search for Flutter/Dart projects
     if [ -z "$PROJECT_LANGS" ]; then
-      PUBSPEC_SUB=$(find . -maxdepth 2 -name "pubspec.yaml" -not -path "./.git/*" 2>/dev/null | head -1)
+      PUBSPEC_SUB=$(find . -maxdepth 2 -name "pubspec.yaml" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$PUBSPEC_SUB" ]; then
         if grep -q "flutter:" "$PUBSPEC_SUB" 2>/dev/null || [ -f "$(dirname "$PUBSPEC_SUB")/.metadata" ]; then
           PROJECT_LANGS="flutter"
@@ -754,8 +784,8 @@ CHANGEDFILELIST
 
     # Search for Java/Kotlin projects
     if [ -z "$PROJECT_LANGS" ]; then
-      POM_SUB=$(find . -maxdepth 2 -name "pom.xml" -not -path "./.git/*" 2>/dev/null | head -1)
-      GRADLE_SUB=$(find . -maxdepth 2 -name "build.gradle" -not -path "./.git/*" 2>/dev/null | head -1)
+      POM_SUB=$(find . -maxdepth 2 -name "pom.xml" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
+      GRADLE_SUB=$(find . -maxdepth 2 -name "build.gradle" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$POM_SUB" ] || [ -n "$GRADLE_SUB" ]; then
         MANIFEST_FILE="${POM_SUB:-$GRADLE_SUB}"
         PROJECT_SUBDIR=$(dirname "$MANIFEST_FILE")
@@ -770,7 +800,7 @@ CHANGEDFILELIST
 
     # Search for C++ projects
     if [ -z "$PROJECT_LANGS" ]; then
-      CMAKE_SUB=$(find . -maxdepth 2 -name "CMakeLists.txt" -not -path "./.git/*" 2>/dev/null | head -1)
+      CMAKE_SUB=$(find . -maxdepth 2 -name "CMakeLists.txt" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$CMAKE_SUB" ]; then
         PROJECT_LANGS="cpp"
         PROJECT_SUBDIR=$(dirname "$CMAKE_SUB")
@@ -779,7 +809,7 @@ CHANGEDFILELIST
 
     # Search for React Native projects (ios/ + android/ directories)
     if [ -z "$PROJECT_LANGS" ]; then
-      RN_SUB=$(find . -maxdepth 2 -type d -name "ios" -not -path "./.git/*" 2>/dev/null | head -1)
+      RN_SUB=$(find . -maxdepth 2 -type d -name "ios" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$RN_SUB" ]; then
         PROJECT_SUBDIR=$(dirname "$RN_SUB")
         if [ -d "$PROJECT_SUBDIR/android" ] || [ -f "$PROJECT_SUBDIR/package.json" ]; then
@@ -790,7 +820,7 @@ CHANGEDFILELIST
 
     # Search for PowerShell projects
     if [ -z "$PROJECT_LANGS" ]; then
-      PS_SUB=$(find . -maxdepth 2 -name "*.ps1" -not -path "./.git/*" 2>/dev/null | head -1)
+      PS_SUB=$(find . -maxdepth 2 -name "*.ps1" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | head -1)
       if [ -n "$PS_SUB" ]; then
         PROJECT_LANGS="powershell"
         PROJECT_SUBDIR=$(dirname "$PS_SUB")
@@ -815,7 +845,7 @@ CHANGEDFILELIST
 
   # ---- Documentation-only fallback ----
   if [ -z "$PROJECT_LANGS" ]; then
-    CODE_FILES=$(find . -type f \( -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.tsx" -o -name "*.java" -o -name "*.go" -o -name "*.rs" -o -name "*.cpp" -o -name "*.c" -o -name "*.swift" -o -name "*.kt" -o -name "*.sh" -o -name "*.dart" -o -name "*.ps1" \) -not -path "./.git/*" 2>/dev/null | wc -l)
+    CODE_FILES=$(find . -type f \( -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.tsx" -o -name "*.java" -o -name "*.go" -o -name "*.rs" -o -name "*.cpp" -o -name "*.c" -o -name "*.swift" -o -name "*.kt" -o -name "*.sh" -o -name "*.dart" -o -name "*.ps1" \) -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null | wc -l)
 
     if [ "$CODE_FILES" -eq 0 ]; then
       PROJECT_LANGS="documentation-only"
@@ -857,11 +887,21 @@ has_project_lang() {
 }
 # Switch to subdirectory if detected (for single-language subdirectory projects).
 # Multi-language projects stay at root — each adapter handles its own path.
+#
+# IN_PROJECT_SUBDIR records whether this cd actually happened. Git reports
+# staged paths relative to the repo root; after cd "$PROJECT_SUBDIR" the [ -f ]
+# probes below need subdirectory-relative paths (hence the PROJECT_SUBDIR
+# prefix strips in Gates 5a/5b/5c), but when the hook stays at the root
+# (multi-language projects) stripping the prefix makes every path-based check
+# resolve against the wrong directory — false BLOCKs in Gate 5a, silent no-ops
+# in 5b/5c. Only strip when we really are inside the subdirectory.
 ORIGINAL_DIR=""
+IN_PROJECT_SUBDIR=0
 _lang_count=$(echo "$PROJECT_LANGS" | wc -w)
 if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ "$PROJECT_LANG" != "documentation-only" ] && [ "$_lang_count" -le 1 ]; then
   ORIGINAL_DIR=$(pwd)
   cd "$PROJECT_SUBDIR"
+  IN_PROJECT_SUBDIR=1
   echo "Working in: $PROJECT_SUBDIR/"
   echo ""
 fi
@@ -891,20 +931,67 @@ else
   # in githooks/lib/typecheck.sh so a project's own checker (vue-tsc, svelte-check,
   # a `typecheck` script) is used instead of a hardcoded tsc that cannot resolve
   # single-file components (#436).
-  source "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh"
-  run_typescript_typecheck
-  TS_CHECK_EXIT=$?
+  #
+  # Resolve the TS project directory first (#470). The probes below used to run
+  # against the repo root only; in multi-language monorepos (e.g. web/ +
+  # backend/, where the hook stays at the root — see the cd block above)
+  # tsconfig.json / biome.json live in the language subdirectory, so the whole
+  # TS half of Gate 1 silently SKIPped ("tsconfig.json not found") while a
+  # project config existed. Order: repo root first (unchanged behaviour for
+  # plain projects), then the detected language subdirectory, then a shallow
+  # search.
+  TS_PROJECT_DIR=""
+  for _ts_dir in "." "${PROJECT_SUBDIR:-}"; do
+    [ -z "$_ts_dir" ] && continue
+    if [ -f "$_ts_dir/tsconfig.json" ] || [ -f "$_ts_dir/biome.json" ] || [ -f "$_ts_dir/biome.jsonc" ] \
+       || [ -f "$_ts_dir/eslint.config.js" ] || [ -f "$_ts_dir/.eslintrc.json" ] \
+       || [ -f "$_ts_dir/.eslintrc.js" ] || [ -f "$_ts_dir/.eslintrc.cjs" ]; then
+      TS_PROJECT_DIR="$_ts_dir"
+      break
+    fi
+  done
+  if [ -z "$TS_PROJECT_DIR" ]; then
+    _TSCONFIG_CAND=$(find . -maxdepth 2 \( -name tsconfig.json -o -name biome.json -o -name biome.jsonc -o -name eslint.config.js -o -name .eslintrc.json -o -name .eslintrc.js -o -name .eslintrc.cjs \) -not -path './.git/*' -not -path './node_modules/*' 2>/dev/null | head -1)
+    if [ -n "$_TSCONFIG_CAND" ]; then
+      TS_PROJECT_DIR=$(dirname "$_TSCONFIG_CAND")
+    fi
+  fi
+  [ -z "$TS_PROJECT_DIR" ] && TS_PROJECT_DIR="."
+  if [ "$TS_PROJECT_DIR" != "." ]; then
+    echo "   TypeScript project directory: $TS_PROJECT_DIR/"
+    # typecheck.sh is cwd-relative: run it from the TS project subdirectory in a
+    # subshell so the language loop's next iteration still starts at the root.
+    # Exit contract: 0 clean, 1 findings (block), 2 checker unavailable (skip).
+    # A cd/source infrastructure failure must NOT read as "type errors": map it
+    # to 2 (skip) so 1 stays reserved for real findings (#508 walkthrough).
+    ( cd "$TS_PROJECT_DIR" 2>/dev/null || exit 2 \
+      ; [ -r "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh" ] || exit 2 \
+      ; source "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh" && run_typescript_typecheck )
+    TS_CHECK_EXIT=$?
+  else
+    source "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh"
+    run_typescript_typecheck
+    TS_CHECK_EXIT=$?
+  fi
   if [ "$TS_CHECK_EXIT" -eq 1 ]; then
     exit 1
   fi
     
-    # Run ESLint linting if config exists
-    if [ -f ".eslintrc.json" ] || [ -f ".eslintrc.js" ] || [ -f ".eslintrc.cjs" ] || [ -f "eslint.config.js" ]; then
+    # Run ESLint linting if config exists (root or TS project subdirectory)
+    if [ -f "$TS_PROJECT_DIR/.eslintrc.json" ] || [ -f "$TS_PROJECT_DIR/.eslintrc.js" ] || [ -f "$TS_PROJECT_DIR/.eslintrc.cjs" ] || [ -f "$TS_PROJECT_DIR/eslint.config.js" ]; then
       echo "Running ESLint linting..."
       # Filter to only TS/JS files - ESLint config ignores non-matching files
       ESLINT_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' || true)
       if [ -n "$ESLINT_FILES" ]; then
-        ESLINT_OUTPUT=$(npx eslint $ESLINT_FILES -f json --no-warn-ignored 2>&1)
+        # File paths from git are repo-root relative, so they are correct from
+        # the root. Legacy .eslintrc.* configs are discovered by walking up from
+        # each linted file (found in the subdirectory automatically); flat
+        # configs are discovered from the CWD, so point at them explicitly.
+        if [ "$TS_PROJECT_DIR" != "." ] && [ -f "$TS_PROJECT_DIR/eslint.config.js" ]; then
+          ESLINT_OUTPUT=$(npx eslint --config "$TS_PROJECT_DIR/eslint.config.js" $ESLINT_FILES -f json --no-warn-ignored 2>&1)
+        else
+          ESLINT_OUTPUT=$(npx eslint $ESLINT_FILES -f json --no-warn-ignored 2>&1)
+        fi
         ESLINT_EXIT=$?
         if [ "$ESLINT_EXIT" -ne 0 ]; then
           if [ -f ".xp-gate/lint-baseline.json" ] && command -v node &> /dev/null; then
@@ -951,8 +1038,8 @@ else
       fi
     else
       echo "ℹ️  No ESLint configuration found - Skipping"
-      if [ -f "package.json" ] && command -v node &> /dev/null; then
-        HAS_ESLINT=$(node -e "try{const p=JSON.parse(require('fs').readFileSync('package.json','utf8'));const d=p.devDependencies||{};const deps=p.dependencies||{};console.log((d.eslint||deps.eslint)?'yes':'no')}catch{console.log('no')}") && true
+      if [ -f "$TS_PROJECT_DIR/package.json" ] && command -v node &> /dev/null; then
+        HAS_ESLINT=$(node -e "try{const p=JSON.parse(require('fs').readFileSync('$TS_PROJECT_DIR/package.json','utf8'));const d=p.devDependencies||{};const deps=p.dependencies||{};console.log((d.eslint||deps.eslint)?'yes':'no')}catch{console.log('no')}") && true
         if [ "$HAS_ESLINT" = "yes" ]; then
           echo "⚠️  WARNING: eslint is installed in package.json but no eslint config found"
           echo "   Either create .eslintrc.* / eslint.config.* or remove eslint from dependencies"
@@ -962,9 +1049,17 @@ else
     fi
 
     # ── Biome lint/format check ──
-    if [ -f "biome.json" ] || [ -f "biome.jsonc" ]; then
+    # Default the project dir so this branch stays runnable standalone
+    # (the gate-1-biome-noop suite extracts it verbatim); a no-op inside the
+    # hook, where TS_PROJECT_DIR is resolved above.
+    TS_PROJECT_DIR="${TS_PROJECT_DIR:-.}"
+    if [ -f "$TS_PROJECT_DIR/biome.json" ] || [ -f "$TS_PROJECT_DIR/biome.jsonc" ]; then
       echo "Running Biome lint/format check..."
-      BIOME_OUT=$(npx biome check --staged . 2>&1)
+      # Run from the TS project directory so Biome auto-discovers its config and
+      # scopes --staged to that subdirectory (mirrors the single-language subdir
+      # mode, which executes after cd "$PROJECT_SUBDIR"). Empirically verified:
+      # `biome check --staged .` from the subdir checks the staged files under it.
+      BIOME_OUT=$(cd "$TS_PROJECT_DIR" && npx biome check --staged . 2>&1)
       BIOME_STATUS=$?
       if [ "$BIOME_STATUS" -ne 0 ]; then
         # Biome exits 1 with `internalError/io - No files were processed` when the
@@ -989,8 +1084,8 @@ else
         echo "✅ PASSED - Biome check."
       fi
     else
-      if [ -f "package.json" ] && command -v node &> /dev/null; then
-        HAS_BIOME=$(node -e "try{const p=JSON.parse(require('fs').readFileSync('package.json','utf8'));const d=p.devDependencies||{};const deps=p.dependencies||{};console.log((d['@biomejs/biome']||deps['@biomejs/biome'])?'yes':'no')}catch{console.log('no')}") && true
+      if [ -f "$TS_PROJECT_DIR/package.json" ] && command -v node &> /dev/null; then
+        HAS_BIOME=$(node -e "try{const p=JSON.parse(require('fs').readFileSync('$TS_PROJECT_DIR/package.json','utf8'));const d=p.devDependencies||{};const deps=p.dependencies||{};console.log((d['@biomejs/biome']||deps['@biomejs/biome'])?'yes':'no')}catch{console.log('no')}") && true
         if [ "$HAS_BIOME" = "yes" ]; then
           echo ""
           echo "⚠️  WARNING: @biomejs/biome is installed in package.json but no biome.json found"
@@ -1252,7 +1347,66 @@ else
     echo "✅ PASSED - Basic shell script syntax check."
   fi
     ;;
-    
+
+    java)
+  # GATE 1 Java: wc-java-lint with fail-closed verdicts (#507 S1, DR-001).
+  # java.sh run_static_analysis verdict codes:
+  #   0=PASS 1=FAIL(violations) 2=BLOCK(execution error) 3=WARN(non-blocking).
+  # Every non-0/1/2 outcome is scored as WARN -- IN the denominator, so it
+  # forbids an overall PASS. Delphi round-2 A-MAJOR-1: these paths used to
+  # map to SKIP, which sits OUT of the denominator, letting a repo with no
+  # Java engine (or findings suppressed in report mode) report PASS/10.0
+  # while its Java quality was never verified.
+  # The adapter applies the XP_GATE_WC_JAVA_LINT=soft escape valve itself, so
+  # a 2 reaching this branch is hard: BLOCK the commit. Captured to a var
+  # (not piped) so the verdict code survives regardless of output length --
+  # `cmd | head` makes a long report die with SIGPIPE, which would turn a
+  # real verdict into an accident of line count.
+  ADAPTER_FILE=$(resolve_adapter_path "$CURRENT_LANG")
+  if [ -z "$ADAPTER_FILE" ] || ! source "$ADAPTER_FILE" 2>/dev/null; then
+    echo "⚠️  WARN - Java adapter not found (code quality NOT verified)"
+    GATE_1_STATUS="WARN"
+    GATE_1_DETAIL="java: adapter missing"
+  else
+    JAVA_G1_EXIT=0
+    # `|| JAVA_G1_EXIT=$?` (not a bare assignment): under a set -e consumer a
+    # non-zero verdict would abort the host hook before the mapping below.
+    JAVA_G1_OUTPUT=$(run_static_analysis 2>&1) || JAVA_G1_EXIT=$?
+    # SKIP/WARN reasons cross the command-substitution subshell as an
+    # `XP_G1_REASON: ...` stdout line -- an `export` inside the adapter can
+    # NEVER reach this process (#507 Delphi round-1 B-MAJOR-1: verified the
+    # subshell discards the child env). Parse, then strip from display.
+    JAVA_G1_REASON=$(printf '%s\n' "$JAVA_G1_OUTPUT" | sed -n 's/^XP_G1_REASON: //p' | head -1)
+    if [ -n "$JAVA_G1_REASON" ]; then
+      JAVA_G1_OUTPUT=$(printf '%s\n' "$JAVA_G1_OUTPUT" | grep -v '^XP_G1_REASON: ')
+    fi
+    [ -n "$JAVA_G1_OUTPUT" ] && echo "$JAVA_G1_OUTPUT" | head -40
+    case "$JAVA_G1_EXIT" in
+      0)
+        echo "✅ PASSED - Java code quality (wc-java-lint)."
+        ;;
+      1)
+        echo "❌ BLOCKED - Java static analysis violations (fix or add suppressions)"
+        exit 1
+        ;;
+      2)
+        echo "❌ BLOCKED - wc-java-lint unusable (fail-closed; unset XP_GATE_WC_JAVA_LINT=soft only if you accept the risk)"
+        exit 1
+        ;;
+      3)
+        echo "⚠️  WARN - Java code quality NOT verified (engine unavailable or downgraded)"
+        GATE_1_STATUS="WARN"
+        GATE_1_DETAIL="java: ${JAVA_G1_REASON:-unavailable (warn)}"
+        ;;
+      *)
+        echo "⚠️  WARN - Java code quality NOT verified (unexpected verdict $JAVA_G1_EXIT)"
+        GATE_1_STATUS="WARN"
+        GATE_1_DETAIL="java: unexpected verdict $JAVA_G1_EXIT"
+        ;;
+    esac
+  fi
+    ;;
+
     *)
       # Route to appropriate adapter for other languages
       ADAPTER_FILE=$(resolve_adapter_path "$CURRENT_LANG")
@@ -1287,9 +1441,13 @@ else
   done
 fi
 fi  # End: if ! any_changed_files_match (Issue #312 skip)
-GATE_1_STATUS="PASS"
+GATE_1_STATUS="${GATE_1_STATUS:-PASS}"
 GATE_1_TOOL="${PROJECT_LANGS}"
-record_gate_audit "gate-1" "code-quality" "$GATE_1_STATUS" "0" "$GATE_1_START"
+# The java branch may set GATE_1_STATUS=WARN + a GATE_1_DETAIL warn reason
+# (engine unavailable / soft or report downgrade); route it into the audit
+# trail via the S2 detail plumbing so a WARN verdict is diagnosable, not
+# silent. WARN stays IN the scoring denominator (Delphi round-2 A-MAJOR-1).
+record_gate_audit "gate-1" "code-quality" "$GATE_1_STATUS" "0" "$GATE_1_START" "${GATE_1_DETAIL:-}"
 
 # ============================================================================
 # GATE 2: Duplicate Code Detection (NEW gate)
@@ -1480,11 +1638,15 @@ else
   # --- BLOCK path: New .ts/.tsx files without corresponding tests ---
   NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v 'node_modules/' | grep -v '\.next/' | grep -v '\.nuxt/' | grep -v 'dist/' | grep -v 'build/' | grep -v '.turbo/' | grep -v '.cache/' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
-  # Strip PROJECT_SUBDIR prefix from new-TS-file paths when running in a subdirectory.
-  # git diff returns repo-root relative paths, but after cd "$PROJECT_SUBDIR"
-  # the test-pairing [ -f ] checks below need subdirectory-relative paths.
+  # Strip PROJECT_SUBDIR prefix from new-TS-file paths ONLY when the hook
+  # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1; single-language
+  # subdirectory projects). git diff returns repo-root relative paths; after
+  # cd "$PROJECT_SUBDIR" the test-pairing [ -f ] checks below need
+  # subdirectory-relative paths. When the hook stays at the repo root
+  # (multi-language projects) the paths must KEEP their prefix or every
+  # [ -f ] lookup misses and paired files are falsely BLOCKED.
   # (Mirrors the v0.14.31+ Gate 5b fix at lines 1603-1608; Gate 5a was missing it.)
-  if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$NEW_TS_FILES" ]; then
+  if [ "$IN_PROJECT_SUBDIR" = "1" ] && [ -n "$NEW_TS_FILES" ]; then
     NEW_TS_FILES=$(echo "$NEW_TS_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
   fi
 
@@ -1695,10 +1857,13 @@ else
   # each plugin directory).
   CHANGED_TEST_FILES=$(echo "$CHANGED_TEST_FILES" | grep -vE '^plugins/[^/]+/' || true)
 
-  # Strip PROJECT_SUBDIR prefix from test file paths when running in subdirectory.
-  # git diff returns repo-root relative paths, but after cd "$PROJECT_SUBDIR" (line 728)
-  # vitest and [ -f ] checks need subdirectory-relative paths. (v0.14.31+ fix)
-  if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$CHANGED_TEST_FILES" ]; then
+  # Strip PROJECT_SUBDIR prefix from test file paths ONLY when the hook
+  # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1). git diff returns
+  # repo-root relative paths; after cd "$PROJECT_SUBDIR" vitest and [ -f ]
+  # checks need subdirectory-relative paths. At the repo root (multi-language
+  # projects) stripping would silently skip the mock-density scan and feed
+  # vitest paths that do not exist. (v0.14.31+ fix, gated on the cd in v0.19.x)
+  if [ "$IN_PROJECT_SUBDIR" = "1" ] && [ -n "$CHANGED_TEST_FILES" ]; then
     CHANGED_TEST_FILES=$(echo "$CHANGED_TEST_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
   fi
 
@@ -1884,14 +2049,20 @@ else
           CHANGED_SRC_FILES=$(echo "$CHANGED_SRC_FILES" | grep -vE '^plugins/[^/]+/' || true)
           # Mirror handling is identical for source files: their test-adjacent
           # paths must never reach vitest as root-project targets (#494).
+          # Selection runs on repo-root relative paths (git diff output), before
+          # any PROJECT_SUBDIR stripping, so the bundled-mirror prefixes match.
           SELECTED_SRC_FILES=$(select_root_suite_targets "$CHANGED_SRC_FILES")
           if [ "$SELECTED_SRC_FILES" != "$CHANGED_SRC_FILES" ]; then
             echo "   ↪ Source selection adjusted for bundled mirrors (#494):"
             echo "     was: $(echo "$CHANGED_SRC_FILES" | tr '\n' ' ')"
             echo "     now: $(echo "$SELECTED_SRC_FILES" | tr '\n' ' ')"
           fi
-          # Strip PROJECT_SUBDIR prefix (same as CHANGED_TEST_FILES fix above)
-          if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$SELECTED_SRC_FILES" ]; then
+          # Strip PROJECT_SUBDIR prefix ONLY when the hook cd'd into the
+          # subdirectory (IN_PROJECT_SUBDIR=1; same gate as the CHANGED_TEST_FILES
+          # fix above — at the repo root the paths must stay root-relative or the
+          # related-test lookup and vitest targets resolve against the wrong dir,
+          # #470)
+          if [ "$IN_PROJECT_SUBDIR" = "1" ] && [ -n "$SELECTED_SRC_FILES" ]; then
             SELECTED_SRC_FILES=$(echo "$SELECTED_SRC_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
           fi
           CHANGED_SRC_COUNT=$(echo "$SELECTED_SRC_FILES" | grep -c '.' || true)
@@ -2608,9 +2779,9 @@ else
     # real source path stays unbudgeted. Exclude it and let the mirroring be
     # governed by Mirror Parity in CI, which compares content rather than
     # re-linting it. (See the same exclusion in adapters/powershell.sh.)
-    MIRROR_EXCLUDE='^src/npm-package/'
-    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | grep -v "$MIRROR_EXCLUDE" | tr '\n' ' ')
-    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | grep -v "$MIRROR_EXCLUDE" | tr '\n' ' ')
+    MIRROR_EXCLUDE="$MIRROR_PATH_FILTER"
+    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
     
     if [ -z "$NEW_FILES" ] && [ -z "$MODIFIED_FILES" ]; then
       echo "     ✅ No new or modified files to check."
@@ -2648,7 +2819,17 @@ else
           echo "❌ BLOCKED - Boy Scout Rule violations detected ($VIOLATION_COUNT)"
           exit 1
         fi
-        
+
+        # REQ-4 (#452): the auto-init rewrites a committed file, which used to
+        # surface as an unexplained dirty ` M .warnings-baseline.json` after
+        # every commit that touched a first-time-modified file. Stage it so the
+        # budget update travels with the commit that caused it; when the
+        # baseline is unchanged (the common case) this is a no-op.
+        if [ -n "$(git status --porcelain -- .warnings-baseline.json 2>/dev/null)" ]; then
+          git add .warnings-baseline.json 2>/dev/null || true
+          echo "     ℹ️  .warnings-baseline.json auto-updated and staged with this commit."
+        fi
+
         echo "     ✅ PASSED - Boy Scout Rule compliance."
         fi
       else
@@ -2691,9 +2872,73 @@ fi
 # ============================================================================
 # GATE 9: Build Integrity Check (TypeScript compilation + package + imports)
 # ============================================================================
+
+# Java build-integrity dispatch (#507 S5, DR-003). The old gate only knew
+# TypeScript: a Maven project got a permanent SKIP -- "not a TypeScript
+# project" -- which is exactly the silent-no-coverage path this sprint
+# removes. Verdict codes (mirror of the java.sh G1 contract):
+#   0=PASS 2=BLOCK(compile failed) 3=SKIP+WARN(reason printed)
+resolve_build_integrity_timeout() {
+  local file=".xp-gate/build-integrity-timeout" val=""
+  if [ -f "$file" ]; then
+    val=$(tr -d '[:space:]' < "$file")
+  fi
+  if [ -z "$val" ]; then
+    echo "180"
+    return 0
+  fi
+  case "$val" in
+    ''|*[!0-9]*|0)
+      echo "WARN - invalid $file value '${val}' (expected a positive integer), falling back to 180s" >&2
+      echo "180"
+      ;;
+    *) echo "$val" ;;
+  esac
+}
+
+run_java_build_integrity() {
+  local timeout_s build_bin
+  # Wrapper first: mvnw pins the project's own Maven version.
+  if [ -x "./mvnw" ]; then
+    build_bin="./mvnw"
+  elif command -v mvn >/dev/null 2>&1; then
+    build_bin="mvn"
+  else
+    echo "     ⚠️  Java changes staged but no Maven build tool found (mvnw/mvn)"
+    echo "     ⏭️  SKIPPED - Build integrity Java (no build tool)"
+    return 3
+  fi
+
+  timeout_s=$(resolve_build_integrity_timeout)
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$timeout_s" "$build_bin" -q -DskipTests compile 2>&1 | tail -20
+  else
+    "$build_bin" -q -DskipTests compile 2>&1 | tail -20
+  fi
+  local rc="${PIPESTATUS[0]}"
+  if [ "$rc" -eq 0 ]; then
+    echo "     ✅ Java build integrity verified (mvn -q -DskipTests compile)."
+    return 0
+  fi
+  if [ "$rc" -eq 124 ]; then
+    echo "     ⏱️  Java build timed out after ${timeout_s}s."
+    echo "     ⏭️  SKIPPED - Build integrity Java (timeout)"
+    return 3
+  fi
+  echo "     ❌ Java build failed (exit $rc)"
+  return 2
+}
+
 2>&1 echo ""
 2>&1 echo "→ Gate 9: Build integrity... "
 GATE_9_START=$(gate_start_ms)
+# Sub-status aggregation (#507 Delphi round-1 B-MAJOR-4): each half records
+# its own outcome; GATE_9_STATUS is aggregated after both. The previous
+# single-variable design made a Maven-only repo (TS half never runs, Java
+# half passes) record an ETERNAL SKIP -- a real compile verification that
+# never appeared as PASS, contradicting S5's own motivation.
+GATE_9_TS_STATUS="SKIP"
+GATE_9_JAVA_STATUS="SKIP"
 GATE_9_STATUS="SKIP"
 
 if [ -f "package.json" ] && [ -f "tsconfig.json" ]; then
@@ -2710,15 +2955,15 @@ if [ -f "package.json" ] && [ -f "tsconfig.json" ]; then
     CHANGED_FILES_CSV=$(echo "$CHANGED_FILES" | tr ' ' ',')
     GATE_9_OUTPUT=$(mktemp)
     if RUN_TSX_TIMEOUT=120s run_tsx "$GATE_9_SCRIPT" --changed-files "$CHANGED_FILES_CSV" --project-root "$PROJECT_ROOT" --timeout 115000 > "$GATE_9_OUTPUT" 2>&1; then
-      GATE_9_STATUS="PASS"
+      GATE_9_TS_STATUS="PASS"
       echo "     ✅ Build integrity check passed."
     else
       GATE_9_EXIT=$?
       if [ $GATE_9_EXIT -eq 124 ]; then
-        GATE_9_STATUS="SKIP"
+        GATE_9_TS_STATUS="SKIP"
         echo "     ⏱️  Build integrity check timed out (120s). SKIPPED."
       else
-        GATE_9_STATUS="BLOCK"
+        GATE_9_TS_STATUS="BLOCK"
         cat "$GATE_9_OUTPUT"
         echo ""
         echo "❌ BLOCKED - Gate 9: Build integrity check failed"
@@ -2737,6 +2982,52 @@ else
   echo "     ⏭️  SKIPPED - Build integrity (not a TypeScript project)"
 fi
 
+# Java dispatch (#507 S5): runs when .java files are staged, regardless of
+# whether the TypeScript half ran. Gradle-only repos SKIP+WARN (gradle
+# support is backlog; DR-003).
+if echo "$CHANGED_FILES" | grep -q '\.java$'; then
+  if [ -f "pom.xml" ]; then
+    JAVA_BI_EXIT=0
+    run_java_build_integrity || JAVA_BI_EXIT=$?
+    case "$JAVA_BI_EXIT" in
+      0)
+        GATE_9_JAVA_STATUS="PASS"
+        ;;
+      2)
+        GATE_9_JAVA_STATUS="BLOCK"
+        echo ""
+        echo "❌ BLOCKED - Gate 9: Java build integrity check failed"
+        echo "Fix the compile errors before committing."
+        exit 1
+        ;;
+      *)
+        GATE_9_JAVA_STATUS="SKIP"
+        echo "     ⏭️  SKIPPED - Build integrity Java (see reason above)"
+        ;;
+    esac
+  elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    echo "     ⚠️  Java changes staged but this is a Gradle project - build integrity for Gradle is not implemented yet"
+    echo "     ⏭️  SKIPPED - Build integrity Java (Gradle backlog, #507 DR-003)"
+  else
+    echo "     ℹ️  Java changes staged but no Maven/Gradle build file - skipping Java build integrity"
+  fi
+fi
+
+# Aggregate the two halves (#507 Delphi round-1 B-MAJOR-4): PASS when every
+# half that RAN passed (TS PASS + Java SKIP, or vice versa, both count),
+# SKIP only when NOTHING ran, BLOCK on any failure (normally unreachable --
+# failing halves exit 1 inline). This replaces the blind-review MINOR-1
+# single-variable guard: with explicit sub-statuses a Java PASS no longer
+# "resurrects" a TS SKIP -- each half keeps its own record and the gate
+# reflects the union of what was actually verified.
+GATE_9_STATUS="SKIP"
+if [ "$GATE_9_TS_STATUS" = "PASS" ] || [ "$GATE_9_JAVA_STATUS" = "PASS" ]; then
+  GATE_9_STATUS="PASS"
+fi
+if [ "$GATE_9_TS_STATUS" = "BLOCK" ] || [ "$GATE_9_JAVA_STATUS" = "BLOCK" ]; then
+  GATE_9_STATUS="BLOCK"
+fi
+
 GATE_9_END=$(gate_start_ms)
 GATE_9_DURATION_MS=$((GATE_9_END - GATE_9_START))
 GATE_9_DURATION=$((GATE_9_DURATION_MS / 1000))
@@ -2769,7 +3060,7 @@ fi
 # Validates sprint state consistency (delphi-review APPROVED before BUILD)
 # Uses sprint-gate.sh for standalone validation logic
 # ============================================================================
-GATE_11_START=$(date +%s)
+GATE_11_START=$(gate_start_ms)
 GATE_11_STATUS="PASS"
 
 # BEGIN SPRINT_GATE_SCRIPT RESOLUTION
@@ -2858,24 +3149,72 @@ generate_quality_report() {
   local BRANCH
   local PASSED_COUNT=0
   local TOTAL_GATES=12
+  local SKIP_COUNT=0
+  local WARN_COUNT=0
+  local NONPASS_COUNT=0
 
   COMMIT_HASH=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
   BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
   TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
+  # Scoring per #507 S3: SKIP removes a gate from the denominator (a missing
+  # tool must not drag the score down -- that was the "honest but punishing"
+  # old behavior), WARN stays in the denominator but never counts as passed,
+  # and FAIL/BLOCK count as non-passing items like before. NONPASS tracks
+  # non-passing gates INSIDE the effective denominator only -- a skipped gate
+  # is out of scope, not a failure.
+  local gate_status gate_default
   for gate in 1 2 3 4 5 6 7 8 9 10 11 12; do
     local status_var="GATE_${gate}_STATUS"
-    if [ "${!status_var}" = "PASS" ]; then
-      PASSED_COUNT=$((PASSED_COUNT + 1))
-    fi
+    # Default mirrors the JSON report rendering below EXACTLY (gates 1-11
+    # PASS, gate 12 WARN): a gate that never assigned a status is "not
+    # applicable" and must render and score identically. A previous scoring
+    # default of FAIL produced self-contradictory reports -- the gate showed
+    # PASS in JSON but scored as FAIL (#507 Delphi round-1 A-MAJOR-2).
+    if [ "$gate" -eq 12 ]; then gate_default="WARN"; else gate_default="PASS"; fi
+    gate_status="${!status_var:-$gate_default}"
+    case "$gate_status" in
+      PASS) PASSED_COUNT=$((PASSED_COUNT + 1)) ;;
+      SKIP) SKIP_COUNT=$((SKIP_COUNT + 1)) ;;
+      WARN) WARN_COUNT=$((WARN_COUNT + 1)); NONPASS_COUNT=$((NONPASS_COUNT + 1)) ;;
+      *) NONPASS_COUNT=$((NONPASS_COUNT + 1)) ;;
+    esac
   done
 
+  local EFFECTIVE_TOTAL=$((TOTAL_GATES - SKIP_COUNT))
+  local VERDICT="PASS"
+  if [ "$EFFECTIVE_TOTAL" -eq 0 ]; then
+    VERDICT="SKIP-ALL"   # every gate skipped: never report a fake 10/10
+  elif [ "$NONPASS_COUNT" -gt 0 ]; then
+    if [ "$((NONPASS_COUNT - WARN_COUNT))" -gt 0 ]; then
+      VERDICT="FAIL"     # at least one FAIL/BLOCK among the effective gates
+    else
+      VERDICT="WARN"     # all effective gates passed or warned; warns forbid PASS
+    fi
+  fi
+
   local SCORE=0
-  if command -v bc >/dev/null 2>&1; then
-    SCORE=$(echo "scale=1; ($PASSED_COUNT / $TOTAL_GATES) * 10" | bc)
+  if [ "$EFFECTIVE_TOTAL" -eq 0 ]; then
+    SCORE="N/A"
   else
-    SCORE=$(awk "BEGIN {printf \"%.1f\", ($PASSED_COUNT / $TOTAL_GATES) * 10}")
-  fi
+    # Single awk path (#507 Delphi round-1 B-MAJOR-2): bc's scale=1 truncates
+    # the DIVISION before multiplying (8/9 -> 0.8, *10 -> 8.0) while awk
+    # rounds the final result (8.9) -- the same commit scored differently on
+    # machines with and without bc. awk(1) is POSIX-guaranteed: one code path,
+    # one score.
+    SCORE=$(awk "BEGIN {printf \"%.1f\", ($PASSED_COUNT / $EFFECTIVE_TOTAL) * 10}")
+  fi
+  local EFFECTIVE_PASS_RATE="N/A"
+  if [ "$EFFECTIVE_TOTAL" -gt 0 ]; then
+    EFFECTIVE_PASS_RATE=$(awk "BEGIN {printf \"%.1f\", ($PASSED_COUNT / $EFFECTIVE_TOTAL) * 100}")
+  fi
+  # JSON bodies need a number or null -- a literal N/A breaks every consumer.
+  local SCORE_JSON="$SCORE"
+  [ "$SCORE_JSON" = "N/A" ] && SCORE_JSON="null"
+  # Same for the pass rate: numeric like `score`, not a quoted string --
+  # mixed types in one object broke consumers (#507 Delphi round-1 B-minor-6).
+  local EFFECTIVE_PASS_RATE_JSON="$EFFECTIVE_PASS_RATE"
+  [ "$EFFECTIVE_PASS_RATE_JSON" = "N/A" ] && EFFECTIVE_PASS_RATE_JSON="null"
 
   local BS_PASSED=0
   local BS_BLOCKED=0
@@ -2915,8 +3254,11 @@ generate_quality_report() {
   "overall": {
     "gatesPassed": $PASSED_COUNT,
     "gatesTotal": $TOTAL_GATES,
-    "score": $SCORE,
-    "verdict": "$([ "$PASSED_COUNT" -eq "$TOTAL_GATES" ] && echo "PASS" || echo "PARTIAL")"
+    "gatesSkipped": $SKIP_COUNT,
+    "gatesEffective": $EFFECTIVE_TOTAL,
+    "effectivePassRate": $EFFECTIVE_PASS_RATE_JSON,
+    "score": $SCORE_JSON,
+    "verdict": "$VERDICT"
   },
   "gates": {
     "gate1_static_analysis": {
@@ -3011,7 +3353,7 @@ ENDJSON
   GATES_JSON="${GATES_JSON}\"gate11\":{\"status\":\"${GATE_11_STATUS:-PASS}\",\"name\":\"Sprint Flow\"},"
   GATES_JSON="${GATES_JSON}\"gate12\":{\"status\":\"${GATE_12_STATUS:-WARN}\",\"name\":\"File Hygiene\"}}"
 
-  echo "{\"timestamp\":\"$TIMESTAMP\",\"commit\":\"$COMMIT_HASH\",\"branch\":\"$BRANCH\",\"score\":$SCORE,\"passed\":$PASSED_COUNT,\"total\":$TOTAL_GATES,\"gates\":$GATES_JSON,\"coverage\":\"$COV_PCT\",\"complexityWarnings\":${CC_WARNINGS:-0},\"principleWarnings\":${WARNING_COUNT:-0},\"boyScoutBlocked\":${BS_BLOCKED}}" >> "$HISTORY_FILE"
+  echo "{\"timestamp\":\"$TIMESTAMP\",\"commit\":\"$COMMIT_HASH\",\"branch\":\"$BRANCH\",\"score\":$SCORE_JSON,\"passed\":$PASSED_COUNT,\"total\":$TOTAL_GATES,\"effectiveTotal\":$EFFECTIVE_TOTAL,\"effectivePassRate\":$EFFECTIVE_PASS_RATE_JSON,\"skipCount\":$SKIP_COUNT,\"verdict\":\"$VERDICT\",\"gates\":$GATES_JSON,\"coverage\":\"$COV_PCT\",\"complexityWarnings\":${CC_WARNINGS:-0},\"principleWarnings\":${WARNING_COUNT:-0},\"boyScoutBlocked\":${BS_BLOCKED}}" >> "$HISTORY_FILE"
 
   # ── Console output ────────────────────────────────────────────────────────
   echo ""
@@ -3032,7 +3374,7 @@ ENDJSON
   printf "  %-45s %s\n" "Gate 11: Sprint Flow" "${GATE_11_STATUS:-PASS}"
   printf "  %-45s %s\n" "Gate 12: File Hygiene" "${GATE_12_STATUS:-WARN}"
   echo ""
-  echo "  Overall Score: $SCORE/10 | $PASSED_COUNT/$TOTAL_GATES gates passed"
+  echo "  Overall Score: $SCORE/10 | $PASSED_COUNT/$TOTAL_GATES gates passed (effective: $PASSED_COUNT/$EFFECTIVE_TOTAL, skipped: $SKIP_COUNT, verdict: $VERDICT)"
   echo "  Branch status: $REPORT_FILE"
   echo "  Run report: $PERSISTED_REPORT_FILE"
   echo "  History saved: $HISTORY_FILE"