rigortype 0.2.8 → 0.3.0

data/lib/rigor/ci_detector.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Rigor
+  # Runtime CI-environment detection (ADR-51 WD7), modelled on `OndraM/ci-detector` (the library PHPStan uses). Reads
+  # the well-known environment variables a CI provider sets and returns the matching {Platform}, classifying it into a
+  # **tier** that decides how `rigor check` surfaces diagnostics there:
+  #
+  #   :native_stdout   — Rigor has a native format that renders purely from
+  #                      stdout, so it is auto-emitted on top of the human
+  #                      output (GitHub Actions → `github`, TeamCity →
+  #                      `teamcity`). These are the first-class platforms.
+  #   :native_artifact — Rigor has a native format but it needs a CI-wired
+  #                      report artifact, not stdout (GitLab CI → `gitlab`).
+  #                      First-class, but Rigor only *hints* the format.
+  #   :reviewdog       — no native Rigor format; second-class, routed through
+  #                      reviewdog (`checkstyle`/`sarif`) or `junit`. Hint
+  #                      only.
+  #
+  # Lives outside the CLI namespace because it is a pure function of the environment hash with no CLI dependency, and
+  # non-CLI consumers exist: {Configuration#cache_validation_strict?} resolves the `auto` cache-validation default
+  # through it (a fresh CI checkout regenerates every stat tuple, so ADR-87's stat tier cannot work there).
+  # Detection is fully testable; callers pass `ENV`.
+  # `RIGOR_CI_DETECT=0` (or `false`/`no`) disables it globally — the seam the spec suite uses for determinism.
+  module CiDetector
+    Platform = Struct.new(:id, :name, :format, :tier, keyword_init: true) do
+      def native_stdout? = tier == :native_stdout
+      def native_artifact? = tier == :native_artifact
+      def reviewdog? = tier == :reviewdog
+    end
+
+    # The detection table, ordered most-specific first so the generic `CI=true` catch-all is last (a provider that
+    # also sets `CI` is still recognised by its own variable). `match` is `:truthy` (value in 1/true/yes/on),
+    # `:present` (variable set non-empty), or `:equals`.
+    PROVIDERS = [
+      { id: "github-actions", name: "GitHub Actions", format: "github", tier: :native_stdout,
+        var: "GITHUB_ACTIONS", match: :truthy },
+      { id: "gitlab", name: "GitLab CI", format: "gitlab", tier: :native_artifact,
+        var: "GITLAB_CI", match: :truthy },
+      { id: "teamcity", name: "TeamCity", format: "teamcity", tier: :native_stdout,
+        var: "TEAMCITY_VERSION", match: :present },
+      { id: "circleci", name: "CircleCI", format: nil, tier: :reviewdog,
+        var: "CIRCLECI", match: :truthy },
+      { id: "jenkins", name: "Jenkins", format: nil, tier: :reviewdog,
+        var: "JENKINS_URL", match: :present },
+      { id: "travis", name: "Travis CI", format: nil, tier: :reviewdog,
+        var: "TRAVIS", match: :truthy },
+      { id: "appveyor", name: "AppVeyor", format: nil, tier: :reviewdog,
+        var: "APPVEYOR", match: :truthy },
+      { id: "azure-pipelines", name: "Azure Pipelines", format: nil, tier: :reviewdog,
+        var: "TF_BUILD", match: :present },
+      { id: "bitbucket", name: "Bitbucket Pipelines", format: nil, tier: :reviewdog,
+        var: "BITBUCKET_BUILD_NUMBER", match: :present },
+      { id: "buildkite", name: "Buildkite", format: nil, tier: :reviewdog,
+        var: "BUILDKITE", match: :truthy },
+      { id: "drone", name: "Drone CI", format: nil, tier: :reviewdog,
+        var: "DRONE", match: :truthy },
+      { id: "semaphore", name: "Semaphore", format: nil, tier: :reviewdog,
+        var: "SEMAPHORE", match: :truthy },
+      { id: "codeship", name: "Codeship", format: nil, tier: :reviewdog,
+        var: "CI_NAME", match: :equals, value: "codeship" },
+      { id: "ci", name: "CI", format: nil, tier: :reviewdog,
+        var: "CI", match: :truthy }
+    ].freeze
+
+    module_function
+
+    # Returns the detected {Platform}, or nil when no CI is recognised or detection is disabled via `RIGOR_CI_DETECT`.
+    def detect(env = ENV)
+      return nil if disabled?(env)
+
+      row = PROVIDERS.find { |provider| matches?(env, provider) }
+      return nil if row.nil?
+
+      Platform.new(id: row[:id], name: row[:name], format: row[:format], tier: row[:tier])
+    end
+
+    def disabled?(env)
+      %w[0 false no off].include?(env["RIGOR_CI_DETECT"].to_s.strip.downcase)
+    end
+
+    def matches?(env, provider)
+      value = env[provider[:var]].to_s.strip
+      case provider[:match]
+      when :truthy then %w[1 true yes on].include?(value.downcase)
+      when :present then !value.empty?
+      when :equals then value.downcase == provider[:value]
+      end
+    end
+  end
+end

data/lib/rigor/cli/annotate_command.rb

@@ -9,11 +9,13 @@ require_relative "../configuration"
 require_relative "options"
 require_relative "../environment"
 require_relative "../scope"
+require_relative "../source/node_children"
 require_relative "../inference/def_return_typer"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/statement_evaluator"
 require_relative "prism_colorizer"
 require_relative "command"
+require_relative "probe_environment"
 
 module Rigor
   class CLI
@@ -105,7 +107,7 @@ module Rigor
         # bindings, so a loop-body line annotates the joined widened type (`Integer`) rather than a stale
         # first-iterations constant (`1 | 2`).
         scope_index = Inference::ScopeIndexer.index(
-          parse_result.value, default_scope: base_scope(configuration),
+          parse_result.value, default_scope: base_scope(configuration, file),
                               converged_loop_recording: true
         )
         line_types = LineTypeCollector.new(scope_index).collect(parse_result.value)
@@ -128,12 +130,12 @@ module Rigor
         @out.puts(JSON.generate({ "annotations" => annotations }))
       end
 
-      def base_scope(configuration)
+      # The plugin-aware environment for the annotated file, so a `#=> <type>` matches what `rigor check`
+      # infers on that line — including types synthesized from the file's own inline RBS annotations (the file
+      # is threaded as the synthesizer's `source_files:`; see {ProbeEnvironment}).
+      def base_scope(configuration, file)
         Scope.empty(
-          environment: Environment.for_project(
-            libraries: configuration.libraries,
-            signature_paths: configuration.signature_paths
-          )
+          environment: ProbeEnvironment.build(configuration: configuration, source_files: [file])
         )
       end
 
@@ -247,14 +249,18 @@ module Rigor
             block.call(stmt)
           end
         else
-          node.compact_child_nodes.each { |child| each_statement(child, &block) }
+          node.rigor_each_child { |child| each_statement(child, &block) }
         end
       end
 
       # For a line no statement closes (the `if` / block header lines), fall back to the widest expression ending there.
+      # A hash-pair node (`1 => 2,` inside a multi-line literal / keyword-argument list) is not an expression — typing
+      # it only echoes the `Dynamic[top]` fallback — so those interior lines stay bare and the literal's type appears
+      # once, on the line the enclosing statement closes.
       def fill_uncovered_lines(program, by_line)
         widest_per_line(program).each do |line, node|
           next if by_line.key?(line)
+          next if node.is_a?(Prism::AssocNode) || node.is_a?(Prism::AssocSplatNode)
 
           type = node.is_a?(Prism::BlockParametersNode) ? block_params_type(node) : type_of(node)
           by_line[line] = type unless type.nil?
@@ -298,7 +304,7 @@ module Rigor
         return if node.nil?
 
         block.call(node)
-        node.compact_child_nodes.each { |child| walk(child, &block) }
+        node.rigor_each_child { |child| walk(child, &block) }
       end
 
       # Types the node through the flow evaluator (not the bare expression typer) under its recorded entry scope, so
@@ -331,7 +337,7 @@ module Rigor
         return if node.nil?
 
         block.call(node) if node.is_a?(Prism::DefNode)
-        node.compact_child_nodes.each { |child| each_def_node(child, &block) }
+        node.rigor_each_child { |child| each_def_node(child, &block) }
       end
     end
   end

data/lib/rigor/cli/baseline_command.rb

@@ -87,8 +87,11 @@ module Rigor
           "match-mode: #{options.fetch(:match_mode)})"
         )
         if configuration.baseline_path.nil?
+          # Name the config file that actually governs this project (`.rigor.dist.yml` when no local override
+          # exists), so the hint points at the file the user must edit.
+          config_name = options.fetch(:config) || Configuration.discover || ".rigor.yml"
           @err.puts(
-            "rigor: note — `.rigor.yml` does not declare `baseline:`; " \
+            "rigor: note — `#{config_name}` does not declare `baseline:`; " \
             "add `baseline: #{path}` to activate the suppression."
           )
         end

data/lib/rigor/cli/check_command.rb

@@ -8,12 +8,17 @@ require_relative "../configuration"
 require_relative "../config_audit"
 require_relative "../analysis/result"
 require_relative "../analysis/rule_catalog"
-require_relative "coverage_scan"
+# The baseline filter runs on EVERY exit path — including the ADR-87 WD4 cache-HIT fast path, which skips
+# `load_check_dependencies` — so it must be a load-time require. It pulls only YAML, never the engine.
+require_relative "../analysis/baseline"
+require_relative "../runtime/jit"
 require_relative "command"
 require_relative "options"
 require_relative "diagnostic_formats"
-require_relative "ci_detector"
-require_relative "check_runner_factory"
+require_relative "../ci_detector"
+# ADR-87 WD4 — `coverage_scan` and `check_runner_factory` both pull the inference engine, so they are required
+# lazily (in `compute_coverage` / `build_check_runner`) rather than at load time: an ordinary check whose
+# result the run-cache probe serves must reach the hit verdict without `rigor/inference` in $LOADED_FEATURES.
 
 module Rigor
   class CLI
@@ -29,18 +34,34 @@ module Rigor
     # concerns that are clearer read together than split across micro-classes.
     class CheckCommand < Command # rubocop:disable Metrics/ClassLength
       # @return [Integer] CLI exit status.
-      def run # rubocop:disable Metrics/AbcSize
-        load_check_dependencies
+      def run # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        # Arm deferred YJIT enablement before any analysis work: the deadline
+        # thread only fires once a run outlasts the amortization window, so a
+        # short check finishes before it ever pays JIT compile cost while a
+        # long run JITs its dominant tail (Runtime::Jit).
+        Runtime::Jit.enable_after(Runtime::Jit.deadline_seconds)
+        # ADR-87 WD4 — parse options + resolve config WITHOUT the inference engine, so the run-cache hit probe
+        # can run first. The heavy engine (`load_check_dependencies`) loads only on a miss / non-cacheable run.
         options = parse_check_options
         buffer = Options.resolve_buffer_binding(options, err: @err)
         return CLI::EXIT_USAGE if buffer == :usage_error
 
         configuration = load_check_configuration(options)
         configuration = apply_bleeding_edge_override(configuration, options)
+        conflict = parameter_inference_incremental_conflict(configuration, options)
+        return conflict unless conflict.nil?
+
         config_warnings = warn_unresolved_config(configuration)
         cache_root = configuration.cache_path
         handle_clear_cache(cache_root) if options.fetch(:clear_cache)
 
+        # ADR-87 WD4 — try to serve the whole run from the ADR-45 cache before booting the engine. A hit boots
+        # only CLI + config + cache + digest code (no `rigor/inference`), skipping the plugin prepass + env
+        # build entirely.
+        probed = try_run_cache_hit(configuration, options, buffer, cache_root)
+        return finalize_cache_hit(probed, configuration, options, config_warnings) unless probed.nil?
+
+        load_check_dependencies
         special = dispatch_special_check_mode(configuration, options, cache_root)
         return special unless special.nil?
 
@@ -66,23 +87,113 @@ module Rigor
 
       private
 
+      # ADR-87 WD4 — attempt the boot-slimming run-cache hit. Returns the cached {Analysis::Result} (severity
+      # profile applied, no stats — matching a cache-served `Runner#run`) on a hit, or nil to fall through to
+      # the full engine path. Only an ordinary sequential check whose result IS cache-served the same way is
+      # eligible; every other mode (below) declines so the full path handles it unchanged.
+      def try_run_cache_hit(configuration, options, buffer, cache_root)
+        return nil unless run_cache_hit_eligible?(configuration, options, buffer)
+
+        require_relative "../analysis/run_cache_probe"
+        Analysis::RunCacheProbe.new(
+          configuration: configuration, cache_root: cache_root, explain: options.fetch(:explain)
+        ).serve(@argv.empty? ? configuration.paths : @argv)
+      end
+
+      # The probe is eligible only for a run the ADR-45 result cache actually serves: a writable cache (not
+      # `--no-cache`), no editor buffer, sequential (pool runs are not result-cacheable), and no mode needing
+      # the engine (`--coverage` / `--incremental` / `--verify-incremental`) or the runner's own reporting
+      # (`--cache-stats`, the `RIGOR_*_TRACE` dev probes). A wrongly-permitted run still MISSES (the entry was
+      # never written its way) and falls through — the gate is an optimisation, never a soundness boundary.
+      def run_cache_hit_eligible?(configuration, options, buffer)
+        buffer.nil? &&
+          !options.fetch(:no_cache) && !options.fetch(:coverage) && !options.fetch(:cache_stats) &&
+          !options.fetch(:incremental) && !options.fetch(:verify_incremental) &&
+          !pool_workers_configured?(options, configuration) &&
+          ENV["RIGOR_BUDGET_TRACE"].to_s.empty? && ENV["RIGOR_HEAP_TRACE"].to_s.empty?
+      end
+
+      # Any signal that per-file analysis would run in a worker pool (CLI `--workers`, the env override, or the
+      # config default). Deliberately over-declines (a false positive only forgoes the fast lane); mirrors
+      # {CheckRunnerFactory.resolve_workers} without requiring it (that pulls in the engine).
+      def pool_workers_configured?(options, configuration)
+        cli = options[:workers]
+        return Integer(cli).positive? if cli
+
+        env = ENV.fetch("RIGOR_RACTOR_WORKERS", nil)
+        return Integer(env).positive? if env && !env.empty?
+
+        configuration.parallel_workers.positive?
+      rescue ArgumentError
+        false
+      end
+
+      # ADR-87 WD4 — the engine-free tail for a cache-served hit: baseline filter + output + exit code,
+      # mirroring the full path's tail but without stats (a hit collected none), trace appendices (they read
+      # engine counters), or eviction (deferred to the next miss). `raw_result` is pre-baseline so the strict
+      # gate reads the same diagnostics the full path would.
+      def finalize_cache_hit(raw_result, configuration, options, config_warnings)
+        result = apply_baseline_filter(raw_result, configuration, options)
+        write_result(result, options.fetch(:format), config_warnings: config_warnings)
+        emit_ci_detected_output(result, options)
+
+        exit_code = result.success? ? 0 : 1
+        exit_code = 1 if baseline_strict_violation?(raw_result.diagnostics, configuration, options)
+        exit_code
+      end
+
+      # ADR-67 WD6c — `parameter_inference:` and the ADR-46 incremental modes are mutually exclusive in slice 1.
+      # The parameter table introduces cross-file edges (a caller's argument types drive a callee's body
+      # diagnostics) that the per-file dependency recorder does not yet carry, so a cached file whose parameter
+      # seeds changed would serve a stale result. Refuse with a message naming the ADR-46 gap rather than
+      # silently producing unsound incremental diagnostics; the edge wiring is the named follow-up. Returns the
+      # usage exit code on a conflict, or nil to proceed. `--verify-incremental` (the acceptance gate that runs
+      # incremental analysis) is caught here too.
+      def parameter_inference_incremental_conflict(configuration, options)
+        return nil unless configuration.parameter_inference
+        return nil unless options.fetch(:incremental) || options.fetch(:verify_incremental)
+
+        flag = options.fetch(:incremental) ? "--incremental" : "--verify-incremental"
+        @err.puts("rigor: parameter_inference: cannot combine with #{flag} — the call-site parameter table " \
+                  "introduces cross-file caller→callee edges the ADR-46 incremental dependency graph does not " \
+                  "yet record, so a cached file could serve a stale diagnostic. Run a full check (drop " \
+                  "#{flag}), or disable parameter_inference: for this run.")
+        CLI::EXIT_USAGE
+      end
+
       # ADR-46 — the two incremental-analysis check modes both fully handle the run and return an exit code (so `run`
       # short-circuits); returns nil for an ordinary check.
       def dispatch_special_check_mode(configuration, options, cache_root)
-        return run_verify_incremental(configuration) if options.fetch(:verify_incremental)
+        return run_verify_incremental(configuration, options, cache_root) if options.fetch(:verify_incremental)
         return run_incremental_check(configuration, options, cache_root) if options.fetch(:incremental)
 
         nil
       end
 
+      # ADR-85 WD1 — the persistent cache the incremental session threads into each internal Runner so plugin
+      # `#prepare` producers (the ADR-9/#74/ADR-60 WD3 record-and-validate caches) and the RBS environment serve
+      # from disk across processes / rechecks rather than recomputing every invocation. Honors `--no-cache` (nil
+      # = no store), mirroring {CheckRunnerFactory}. The whole-run ADR-45 result cache stays inert on these runs
+      # — `Runner#run_result_cacheable?` excludes `record_dependencies` / `analyze_only`.
+      def incremental_cache_store(configuration, options, cache_root)
+        return nil if options.fetch(:no_cache)
+
+        Cache::Store.new(root: cache_root, max_bytes: configuration.cache_max_bytes)
+      end
+
       # ADR-46 — the incremental-analysis acceptance gate. Runs a baseline analysis (recording cross-file dependencies),
       # then re-analyzes a representative subset of files and serves the rest from the per-file cache (the body tier),
       # and asserts the merged diagnostics are byte-identical to a full `--no-cache` analysis. A mismatch means the
       # incremental machinery would serve a stale — manufactured — diagnostic, the soundness failure this gate exists to
       # catch. Prints a one-line PASS (exit 0) or the differing diagnostics (exit 1).
-      def run_verify_incremental(configuration)
+      def run_verify_incremental(configuration, options, cache_root)
         paths = @argv.empty? ? nil : @argv
-        session = Analysis::IncrementalSession.new(configuration: configuration, paths: paths)
+        # ADR-85 WD1 — thread the store so the gate also asserts the cache-served producer path stays
+        # byte-identical to the uncached full run (`verify_full_diagnostics` builds a nil-store runner).
+        session = Analysis::IncrementalSession.new(
+          configuration: configuration, paths: paths,
+          cache_store: incremental_cache_store(configuration, options, cache_root)
+        )
         session.baseline
         analyzed = session.analyzed_files
 
@@ -101,18 +212,30 @@ module Rigor
       # updated snapshot for the next invocation. Diagnostics are identical to a full run (the `--verify-incremental`
       # gate enforces this); the win is skipping per-file inference for unchanged files.
       def run_incremental_check(configuration, options, cache_root)
+        require_relative "check_runner_factory"
         paths = @argv.empty? ? nil : @argv
-        probe = Analysis::Runner.new(configuration: configuration, cache_store: nil)
-        files = paths ? probe.analysis_file_set(paths) : probe.analysis_file_set
         fingerprint = Cache::IncrementalSnapshot.fingerprint(
           configuration: configuration, roots: paths || configuration.paths
         )
         snapshot = Cache::IncrementalSnapshot.new(root: cache_root)
-        session = Analysis::IncrementalSession.new(configuration: configuration, paths: paths)
+        store = incremental_cache_store(configuration, options, cache_root)
+        session = Analysis::IncrementalSession.new(
+          configuration: configuration, paths: paths,
+          cache_store: store,
+          # ADR-46 — thread the same worker-count precedence the standard `check` path uses
+          # (CLI `--workers` > `RIGOR_RACTOR_WORKERS` > `parallel.workers:` > 0) so the recheck's closure
+          # re-analysis parallelises; the fork pool marshals dependency records back so the graph is sound.
+          workers: CheckRunnerFactory.resolve_workers(options, configuration)
+        )
 
         diagnostics, warm = session.run_incremental(snapshot: snapshot, fingerprint: fingerprint)
+        # The banner's file count comes from the session's analyzed set (cold analyses all; a warm recheck's
+        # `@analyzed` advances to the current file set), so a dedicated probe Runner + `Dir.glob` is no longer
+        # built just to size the banner (recon §3 — the analysis tree was expanded three times per recheck).
         @err.puts("rigor: --incremental #{warm ? 'warm — reused cached diagnostics' : 'cold — full analysis'} " \
-                  "(#{files.size} files)")
+                  "(#{session.analyzed_files.size} files)")
+        emit_incremental_fact_surface_notes(session)
+        write_incremental_cache_stats(session, cache_root, store) if options.fetch(:cache_stats)
 
         result = apply_baseline_filter(Analysis::Result.new(diagnostics: diagnostics, stats: nil), configuration,
                                        options)
@@ -120,6 +243,40 @@ module Rigor
         result.success? ? 0 : 1
       end
 
+      # ADR-88 WD1 — a one-line stderr note when the plugin fact surface (an ADR-9 fact, an ADR-60 producer
+      # value, or an `incremental_state_fingerprint` hook) forced a full run: either it CHANGED since the
+      # snapshot (a Sorbet sig edit, a schema change) or a contributing plugin declares NO fingerprint surface
+      # (opaque — a full run every invocation). Both are the sound direction; the note explains why a recheck
+      # was not warm.
+      def emit_incremental_fact_surface_notes(session)
+        opaque = session.opaque_plugin_ids
+        unless opaque.empty?
+          @err.puts("rigor: --incremental plugin#{'s' unless opaque.size == 1} #{opaque.sort.join(', ')} " \
+                    "contribute call-site types with no incremental fingerprint surface; the snapshot cannot " \
+                    "be reused (full analysis every run).")
+        end
+        return unless session.fact_surface_invalidated? && opaque.empty?
+
+        @err.puts("rigor: --incremental plugin fact surface changed since the snapshot; ran a full analysis.")
+      end
+
+      # ADR-88 WD1 — `--incremental --cache-stats` surfaces the on-disk cache inventory (as a plain `check`
+      # does) plus the fact-surface status line, so an operator can see whether a full run was fact-surface
+      # driven. The plain `check` cache-stats path is bypassed by the incremental short-circuit, so it is
+      # emitted here.
+      def write_incremental_cache_stats(session, cache_root, store)
+        write_cache_stats(cache_root, store)
+        status =
+          if !session.opaque_plugin_ids.empty?
+            "opaque (#{session.opaque_plugin_ids.sort.join(', ')})"
+          elsif session.fact_surface_invalidated?
+            "changed — snapshot invalidated"
+          else
+            "unchanged"
+          end
+        @out.puts("  plugin fact surface: #{status}")
+      end
+
       def verify_full_diagnostics(configuration, paths)
         runner = Analysis::Runner.new(configuration: configuration, cache_store: nil)
         (paths ? runner.run(paths) : runner.run).diagnostics
@@ -227,6 +384,7 @@ module Rigor
       end
 
       def build_check_runner(configuration:, options:, buffer:, cache_root:)
+        require_relative "check_runner_factory"
         CheckRunnerFactory.build(
           configuration: configuration, options: options,
           buffer: buffer, cache_root: cache_root
@@ -391,7 +549,10 @@ module Rigor
       end
 
       def inject_treat_all_as_inline_rbs(entries)
-        filtered = entries.reject { |entry| rigor_rbs_inline_entry?(entry) }
+        # Single-homed with the WD2 auto-wire gate (`Configuration.rbs_inline_plugin_entry?`) so the flag and
+        # the default agree on what "already listed" means; a pre-existing entry is removed so this one's
+        # `require_magic_comment: false` wins unconditionally.
+        filtered = entries.reject { |entry| Configuration.rbs_inline_plugin_entry?(entry) }
         filtered + [{
           "gem" => "rigor-rbs-inline",
           "id" => "rbs-inline",
@@ -399,18 +560,6 @@ module Rigor
         }]
       end
 
-      def rigor_rbs_inline_entry?(entry)
-        case entry
-        when String
-          entry == "rigor-rbs-inline"
-        when Hash
-          string_keyed = entry.to_h { |k, v| [k.to_s, v] }
-          string_keyed["gem"] == "rigor-rbs-inline" || string_keyed["id"] == "rbs-inline"
-        else
-          false
-        end
-      end
-
       def handle_clear_cache(cache_root)
         if File.directory?(cache_root)
           FileUtils.rm_rf(cache_root)
@@ -451,6 +600,42 @@ module Rigor
         @err.puts("  recursion-fixpoint-cap hits: #{counts[Inference::BudgetTrace::RECURSION_FIXPOINT_CAP]}")
         @err.puts("  block-writeback-cap hits:  #{counts[Inference::BudgetTrace::BLOCK_WRITEBACK_CAP]}")
         write_budget_distributions
+        write_memo_profile(counts)
+      end
+
+      # Dumps the ADR-57 return-memo profile (WD0). Entries / hit rate / body evals / the non-store split, then
+      # the top signatures by body-eval count with their distinct-memo-key counts — the evidence for choosing
+      # between a finalization-aware taint gate and memo-key normalization. `--workers 0` for exact counts.
+      def write_memo_profile(counts)
+        bt = Inference::BudgetTrace
+        hits = counts[bt::MEMO_HITS]
+        misses = counts[bt::MEMO_MISSES]
+        consults = hits + misses
+        rate = consults.positive? ? format("%.1f%%", 100.0 * hits / consults) : "n/a"
+        @err.puts("")
+        @err.puts("Return-memo profile (RIGOR_BUDGET_TRACE; --workers 0 for an exact count)")
+        @err.puts("  infer entries:   #{counts[bt::MEMO_ENTRIES]}")
+        @err.puts("  memo consults:   #{consults}  (hits #{hits} / misses #{misses}; hit rate #{rate})")
+        @err.puts("  body evals:      #{counts[bt::MEMO_BODY_EVALS]}")
+        @err.puts("  non-stored:      on-stack #{counts[bt::MEMO_REFUSE_ON_STACK]}  " \
+                  "unroll-in-flight #{counts[bt::MEMO_REFUSE_UNROLL]}  " \
+                  "consult-tainted #{counts[bt::MEMO_REFUSE_CONSULT_TAINTED]}  " \
+                  "transient-tainted #{counts[bt::MEMO_REFUSE_TRANSIENT]}")
+        write_memo_signature_table
+      end
+
+      # Top 15 signatures by body-eval (compute) count, each with its distinct-memo-key count — a signature
+      # whose distinct-key count dwarfs its evals is arg-granularity thrash (the key-normalization candidate).
+      def write_memo_signature_table
+        bt = Inference::BudgetTrace
+        evals = bt.distribution(bt::MEMO_BODY_EVAL_BY_SIGNATURE)
+        return if evals.empty?
+
+        keys = bt.distribution(bt::MEMO_DISTINCT_KEY_BY_SIGNATURE)
+        @err.puts("  top signatures by body-eval count (evals / distinct-keys / signature):")
+        evals.sort_by { |sig, n| [-n, sig] }.first(15).each do |sig, n|
+          @err.puts("    #{n.to_s.rjust(8)}  #{keys.fetch(sig, 0).to_s.rjust(6)}  #{sig}")
+        end
       end
 
       # Dumps the read-only size distributions (ADR-41 Slice 2a). These observe how large unions actually get, with no
@@ -488,7 +673,6 @@ module Rigor
       def load_check_dependencies
         require_relative "../analysis/runner"
         require_relative "../analysis/buffer_binding"
-        require_relative "../analysis/baseline"
         require_relative "../cache/store"
         start_heap_trace_if_requested
       end
@@ -625,6 +809,7 @@ module Rigor
       def compute_coverage(runner, configuration, options)
         return nil unless options.fetch(:coverage)
 
+        require_relative "coverage_scan"
         files = @argv.empty? ? runner.analysis_file_set : runner.analysis_file_set(@argv)
         CoverageScan.precision_report(files: files, configuration: configuration)
       end
@@ -682,7 +867,7 @@ module Rigor
         return unless options.fetch(:ci_detect)
         return unless options.fetch(:format) == "text"
 
-        platform = CLI::CiDetector.detect
+        platform = CiDetector.detect
         return if platform.nil?
 
         if platform.native_stdout?