rigortype 0.2.8 → 0.3.0

data/lib/rigor/inference/void_tail_summary.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "void_origin"
+require_relative "../reflection"
+require_relative "../source/node_children"
+
+module Rigor
+  module Inference
+    # ADR-100 WD4 — the lazy per-`def` "void tail" summary that carries an author-declared `-> void`
+    # provenance ACROSS an intermediate method whose own signature declares nothing. The direct case
+    # (`x = logger.log(...)`, an RBS `-> void` resolved on the receiver's own class) is recorded at the
+    # call site by {MethodDispatcher::RbsDispatch}; this summary answers the transitive case
+    # (`def bar; foo; end; b = bar`) where the `void` reaches the use through `bar`'s body, so no rule
+    # reading `bar`'s signature can see it.
+    #
+    # `VoidTail(def_node) -> VoidOrigin | nil`: computed on demand at the first consult, memoised per
+    # `def_node` (identity-keyed), cycle-guarded (a def already on the current chain rejects), and
+    # **pure** — AST shape + RBS reflection ({Reflection.instance_method_definition} /
+    # {Reflection.singleton_method_definition}) + discovery-index lookups ({Scope#user_def_for} /
+    # {Scope#singleton_def_for}) only, never expression evaluation. Because it never evaluates, it can
+    # neither re-enter the dispatcher nor depend on evaluation order or the fork-pool's file
+    # partitioning — the eager record-at-body-evaluation table WD4 rejected failed exactly there.
+    #
+    # A `def` (resolved on `owner` / `kind`) is admitted iff all four hold:
+    #
+    #   1. its OWN resolved RBS signature for `(owner, name, kind)` is absent, or every overload
+    #      returns `untyped` (`RBS::Types::Bases::Any`). An author-declared concrete return — including
+    #      `-> void` itself, which the direct rule already serves at the call site — keeps it out, so
+    #      the direct rule and the summary are disjoint by construction (no double record).
+    #   2. its body is a plain statements body (no `rescue` / `else` / `ensure` on the `def` — those
+    #      shapes make `def_node.body` a `Prism::BeginNode`) containing NO `Prism::ReturnNode` anywhere:
+    #      a bare `return` yields `nil`, a non-void path, so the void tail must be the SOLE return path.
+    #      The walk is deliberately over-conservative — a `return` inside a nested block also
+    #      disqualifies.
+    #   3. its tail (last) expression is a `Prism::CallNode` with an implicit-`self` receiver (`nil`
+    #      receiver or a literal `self`).
+    #   4. that tail resolves on the SAME owner (exact class, no ancestor walk on the discovery side) to
+    #      either (a) an RBS definition whose EVERY overload returns `void` — the leaf, whose origin is
+    #      `VoidOrigin(owner, tail_name, kind)` — or (b) another discovered `def` of the same kind, which
+    #      recurses. Composition (`def baz; bar; end`) is the recursion, and the origin stays the leaf,
+    #      so the message still names the author's `-> void` method. The RBS-void-leaf branch is checked
+    #      FIRST because under ADR-93 auto-wire the leaf `def` is BOTH RBS-`void` and a discovered `def`;
+    #      recursing into its body would miss the leaf.
+    #
+    # Everything else — explicit-receiver tails, conditional / boolean / `begin` tails, unresolvable
+    # names, non-void concrete RBS — rejects.
+    #
+    # Each tail chain is a functional graph (every `def` has exactly one tail, hence at most one
+    # successor), so a `def`'s result is fully determined by its own forward chain and is independent of
+    # the entry point: a chain either reaches a void leaf (`VoidOrigin`), a non-admitted node (nil), or a
+    # cycle (nil). Memoising is therefore always sound, and the cycle guard only ever rejects a node that
+    # is still mid-computation on the current chain (never yet memoised).
+    class VoidTailSummary
+      # Run-scoped memo, the ADR-84 `return_memo_bucket` house pattern: a single retained slot on
+      # `Thread.current` keyed by the run-generation token's identity, so a re-run in one process (LSP,
+      # ADR-62 warm loop) lands in a fresh bucket and can neither serve stale entries nor accumulate
+      # them. Thread-local ⇒ each fork-pool worker (a separate process) and each Ractor-pool worker (its
+      # own Ractor-local `Thread.current`) builds its own bucket; the bucket hash is created and mutated
+      # inside the worker and never shared, so no frozen / shared object is mutated and no
+      # graceful-degradation branch is needed. `def_node` identity is stable per run (the ADR-85
+      # {DefNodeResolver} yields one node object per `(path, node_id)`), the same identity the ADR-84
+      # return memo relies on.
+      MEMO_KEY = :__rigor_void_tail_summary_memo__
+      private_constant :MEMO_KEY
+
+      def initialize(scope)
+        @scope = scope
+        @environment = scope.environment
+      end
+
+      # The recovered `-> void` origin for `def_node` (whose owner / kind the caller resolved through
+      # the discovery index), or nil when the `def` is not admitted. A fresh visited set per top-level
+      # consult; the memo persists across consults for the run. The memo is probed before the visited
+      # set is allocated so the common post-warmup hit path allocates nothing.
+      #
+      # @param def_node [Prism::DefNode]
+      # @param owner [String] the qualified receiver class the `def` belongs to.
+      # @param kind [Symbol] `:instance` or `:singleton`.
+      # @return [Inference::VoidOrigin, nil]
+      def origin_for(def_node, owner, kind)
+        return nil if def_node.nil?
+
+        memo = memo_bucket
+        return memo[def_node] if memo.key?(def_node)
+
+        walk(def_node, owner, kind, {}.compare_by_identity)
+      end
+
+      private
+
+      attr_reader :scope, :environment
+
+      # Memo + cycle-guarded computation. A def already on the current chain rejects WITHOUT memoising
+      # (it is mid-computation; its true result is memoised when its own frame completes).
+      def walk(def_node, owner, kind, visited)
+        return nil if def_node.nil?
+        return nil if visited.key?(def_node)
+
+        memo = memo_bucket
+        return memo[def_node] if memo.key?(def_node)
+
+        visited[def_node] = true
+        memo[def_node] = compute(def_node, owner, kind, visited)
+      end
+
+      def compute(def_node, owner, kind, visited)
+        return nil unless own_signature_admits?(owner, def_node.name, kind) # admission 1
+
+        tail = admissible_tail(def_node) # admissions 2 + 3
+        return nil if tail.nil?
+
+        resolve_tail(tail.name, owner, kind, visited) # admission 4
+      end
+
+      # Admission 1 — absent own signature, or every overload `untyped`. `untyped` is read as "no claim"
+      # per RBS's own semantics, so a hand-written `-> untyped` intermediate still admits: the provenance
+      # fact (this value was produced by an author-declared `-> void` return) remains true of it.
+      def own_signature_admits?(owner, method_name, kind)
+        definition = method_definition(owner, method_name, kind)
+        return true if definition.nil?
+
+        every_overload_return?(definition, RBS::Types::Bases::Any)
+      end
+
+      # Admissions 2 + 3 — the tail expression when the body is a plain statements body with no
+      # `ReturnNode` anywhere and the tail is an implicit-self call; nil (reject) otherwise.
+      def admissible_tail(def_node)
+        body = def_node.body
+        return nil if body.nil?
+        return nil if body.is_a?(Prism::BeginNode) # def-level rescue / else / ensure
+        return nil if contains_return?(body)
+
+        tail = tail_expression(body)
+        return nil unless tail.is_a?(Prism::CallNode)
+        return nil unless implicit_self_receiver?(tail.receiver)
+
+        tail
+      end
+
+      # A `Prism::StatementsNode` (the plain and endless-def shapes both parse to one) tails on its last
+      # statement; any other surviving shape is treated as the tail expression itself.
+      def tail_expression(body)
+        case body
+        when Prism::StatementsNode then body.body.last
+        else body
+        end
+      end
+
+      def implicit_self_receiver?(receiver)
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
+      # True when a `Prism::ReturnNode` appears anywhere in the subtree — nested blocks and defs
+      # included (over-conservative is correct: a method that can return anything other than the void
+      # tail must never enter the table).
+      def contains_return?(node)
+        return false unless node.is_a?(Prism::Node)
+        return true if node.is_a?(Prism::ReturnNode)
+
+        node.rigor_each_child { |child| return true if contains_return?(child) }
+        false
+      end
+
+      # Admission 4 — the void leaf (RBS every-overload `void`) wins over the discovered-def recursion,
+      # because under ADR-93 auto-wire the annotated leaf is both.
+      def resolve_tail(tail_name, owner, kind, visited)
+        definition = method_definition(owner, tail_name, kind)
+        if definition && every_overload_return?(definition, RBS::Types::Bases::Void)
+          return VoidOrigin.new(class_name: owner, method_name: tail_name, kind: kind)
+        end
+
+        next_def = discovered_def(owner, tail_name, kind)
+        return nil if next_def.nil?
+
+        walk(next_def, owner, kind, visited)
+      end
+
+      def method_definition(owner, method_name, kind)
+        if kind == :singleton
+          Reflection.singleton_method_definition(owner, method_name, environment: environment)
+        else
+          Reflection.instance_method_definition(owner, method_name, environment: environment)
+        end
+      end
+
+      def discovered_def(owner, method_name, kind)
+        if kind == :singleton
+          scope.singleton_def_for(owner, method_name)
+        else
+          scope.user_def_for(owner, method_name)
+        end
+      end
+
+      # True when the definition declares at least one overload and EVERY overload's return type is an
+      # instance of `base_klass` (`RBS::Types::Bases::Any` for admission 1, `...::Void` for the leaf).
+      # An `UntypedFunction` (`(?) -> T`) still responds to `return_type`, so it is handled the same way.
+      def every_overload_return?(definition, base_klass)
+        method_types = definition.method_types
+        return false if method_types.empty?
+
+        method_types.all? do |method_type|
+          fun = method_type.type
+          fun.respond_to?(:return_type) && fun.return_type.is_a?(base_klass)
+        end
+      end
+
+      def memo_bucket
+        generation = scope.run_generation || scope.discovered_def_nodes
+        slot = Thread.current[MEMO_KEY]
+        unless slot && slot[0].equal?(generation)
+          slot = [generation, {}.compare_by_identity]
+          Thread.current[MEMO_KEY] = slot
+        end
+        slot[1]
+      end
+    end
+  end
+end

data/lib/rigor/language_server/completion_provider.rb

@@ -8,6 +8,7 @@ require_relative "../environment"
 require_relative "../reflection"
 require_relative "../scope"
 require_relative "../source/node_locator"
+require_relative "../source/node_children"
 require_relative "../inference/scope_indexer"
 require_relative "../type/nominal"
 require_relative "../type/singleton"
@@ -187,7 +188,7 @@ module Rigor
              n.location.start_offset <= symbol_offset && symbol_offset <= n.location.end_offset
             result = n
           end
-          n.compact_child_nodes.each(&walk)
+          n.rigor_each_child(&walk)
         end
         walk.call(root)
         result

data/lib/rigor/language_server/document_symbol_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -67,7 +68,7 @@ module Rigor
         when Prism::DefNode
           block.call(def_symbol(node, in_namespace: in_namespace))
         else
-          node.compact_child_nodes.each do |child|
+          node.rigor_each_child do |child|
             each_decl(child, in_namespace: in_namespace, &block)
           end
         end

data/lib/rigor/language_server/folding_range_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -48,7 +49,7 @@ module Rigor
              Prism::BlockNode
           add_range(node, ranges)
         end
-        node.compact_child_nodes.each { |child| walk(child, ranges) }
+        node.rigor_each_child { |child| walk(child, ranges) }
       end
 
       def add_range(node, ranges)

data/lib/rigor/language_server/selection_range_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -48,7 +49,7 @@ module Rigor
         return chain unless node.location && offset_in?(node.location, offset)
 
         chain << node
-        node.compact_child_nodes.each { |child| ancestor_chain(child, offset, chain) }
+        node.rigor_each_child { |child| ancestor_chain(child, offset, chain) }
         chain
       end
 

data/lib/rigor/language_server/signature_help_provider.rb

@@ -8,6 +8,7 @@ require_relative "../environment"
 require_relative "../reflection"
 require_relative "../scope"
 require_relative "../source/node_locator"
+require_relative "../source/node_children"
 require_relative "../inference/scope_indexer"
 require_relative "../type/nominal"
 require_relative "../type/singleton"
@@ -99,7 +100,7 @@ module Rigor
           if n.is_a?(Prism::CallNode) && n.arguments && offset_in?(n.arguments.location, cursor_offset)
             result = n # Innermost-wins because we keep walking children.
           end
-          n.compact_child_nodes.each(&walk)
+          n.rigor_each_child(&walk)
         end
         walk.call(root)
         result

data/lib/rigor/plugin/base.rb

@@ -390,8 +390,8 @@ module Rigor
         # the fact slot.
         #
         # Renamed from `type_specifier` (ADR-80): the old name read as a parallel to `dynamic_return` (a
-        # type) when it actually returns facts. {.type_specifier} survives as a deprecating alias through
-        # 0.2.x and is removed in 0.3.0.
+        # type) when it actually returns facts. The old verb was a deprecating alias through 0.2.x and is
+        # gone in 0.3.0 — `narrowing_facts` is the only spelling.
         def narrowing_facts(methods:, &block)
           raise ArgumentError, "Plugin::Base.narrowing_facts requires a block body" if block.nil?
           unless methods.is_a?(Array) && !methods.empty? &&
@@ -401,30 +401,17 @@ module Rigor
                   "got #{methods.inspect}"
           end
 
-          @type_specifiers ||= []
-          @type_specifiers << { methods: methods.map(&:to_sym).freeze, block: block }.freeze
+          @narrowing_facts_rules ||= []
+          @narrowing_facts_rules << { methods: methods.map(&:to_sym).freeze, block: block }.freeze
           nil
         end
 
-        # DEPRECATED (ADR-80) — renamed to {.narrowing_facts}. This hook supplies post-return narrowing
-        # *facts*, not a type; the old name misleads by parallel with {.dynamic_return}. Retained as a
-        # warning-emitting alias through 0.2.x; REMOVED in 0.3.0. Migrate `type_specifier methods: …` →
-        # `narrowing_facts methods: …`.
-        def type_specifier(methods:, &)
-          unless @type_specifier_deprecation_warned
-            @type_specifier_deprecation_warned = true
-            warn("[rigor] Plugin::Base.type_specifier is deprecated (ADR-80) and will be " \
-                 "removed in Rigor 0.3.0; rename it to `narrowing_facts`. (#{name})")
-          end
-          narrowing_facts(methods:, &)
-        end
-
-        # Frozen snapshot of the declared type-specifier rules. Memoised for the same reason as
+        # Frozen snapshot of the declared narrowing-facts rules. Memoised for the same reason as
         # {dynamic_returns} — consulted per plugin per dispatch, over an array fixed at class-definition
         # time.
         # rubocop:disable Naming/MemoizedInstanceVariableName -- see dynamic_returns
-        def type_specifiers
-          @type_specifiers_snapshot ||= (@type_specifiers || []).dup.freeze
+        def narrowing_facts_rules
+          @narrowing_facts_rules_snapshot ||= (@narrowing_facts_rules || []).dup.freeze
         end
         # rubocop:enable Naming/MemoizedInstanceVariableName
       end
@@ -558,8 +545,8 @@ module Rigor
       # ADR-37 slice 2 — the post-return narrowing facts contributed by this plugin's {.narrowing_facts}
       # rules for a call. The engine calls this from `StatementEvaluator`; a rule fires only when
       # `call_node.name` is one of its declared `methods:`. Failures isolate to [].
-      def type_specifier_facts(call_node:, scope:)
-        rules = self.class.type_specifiers
+      def narrowing_facts_for(call_node:, scope:)
+        rules = self.class.narrowing_facts_rules
         return [] if rules.empty? || !call_node.respond_to?(:name)
 
         name = call_node.name

data/lib/rigor/plugin/inflector.rb

@@ -18,9 +18,12 @@ module Rigor
     # rules are ingested by *statically parsing* `config/initializers/inflections.rb` in a later slice, never
     # by executing it.)
     #
-    # **Absence is silence, never a guess.** When `ActiveSupport::Inflector` cannot be loaded (a
-    # misconfiguration — the consuming plugins declare it as a dependency, so it is present in practice), the
-    # inflection methods raise {Unavailable} rather than approximate. That raise propagates to the caller's
+    # **Absence is silence, never a guess.** ActiveSupport is resolved from Rigor's host gem environment
+    # first, then from the analyzed project's own bundler install tree ({Isolation.target_bundle_root},
+    # ADR-90) — a Rails project always carries its locked activesupport on disk, and that copy is the
+    # higher-fidelity source of inflection rules anyway. When neither resolves (a standalone install
+    # analyzing a project whose bundle is not installed), the inflection methods raise {Unavailable}
+    # rather than approximate. That raise propagates to the caller's
     # per-plugin rescue boundary, so the inflection-dependent check degrades to **no diagnostics** — reduced
     # coverage, never a wrong fact. A consumer that wants to fail cleanly up front can gate on {available?}
     # and emit a single load-error.
@@ -39,6 +42,12 @@ module Rigor
       FEATURE = "active_support/inflector"
       RECEIVER = "ActiveSupport::Inflector"
 
+      # The bundled plugins whose checks consume this helper (each README documents the dependency). Used
+      # by `rigor plugins` (ADR-90) to probe {available?} at activation time — so a standalone install
+      # where inflection silently degrades reports the degradation instead of an unqualified `[OK]`. When
+      # a new plugin adopts the helper, add its manifest id here.
+      CONSUMER_PLUGIN_IDS = %w[actionmailer actionpack activerecord factorybot rails-routes].freeze
+
       # Raised when `ActiveSupport::Inflector` is required for an inflection but cannot be loaded. Caught by
       # the per-plugin isolation boundary, so it surfaces as "this plugin produced no diagnostics" rather than
       # a wrong inflection.

data/lib/rigor/plugin/io_boundary.rb

@@ -97,8 +97,12 @@ module Rigor
       private
 
       def record_file_entry(path, contents)
+        # ADR-87 WD1 — the boundary descriptor is validation-only (it never keys a cache), so a plugin-read
+        # file rides the stat-then-digest `:stat` tier: a warm run stat-checks the (on a Rails monorepo,
+        # 30k+ file) plugin-read set instead of re-hashing it. The digest is taken from the in-memory content
+        # we just read; `FileEntry.stat` stats the same path to pack the tuple.
         digest = Digest::SHA256.hexdigest(contents)
-        entry = Cache::Descriptor::FileEntry.new(path: path, comparator: :digest, value: digest)
+        entry = Cache::Descriptor::FileEntry.stat(path: path, digest: digest)
         @mutex.synchronize { @file_entries[path] = entry }
       end
 

data/lib/rigor/plugin/isolation.rb

@@ -30,6 +30,65 @@ module Rigor
 
       module_function
 
+      # The analyzed project's resolved bundler install root (e.g. `<project>/vendor/bundle`), or nil.
+      # Set from the same `bundler.*` resolution that feeds bundle sig discovery (O4 / ADR-82 WD9) — by
+      # the runner's pre-passes BEFORE any plugin `#prepare` runs, by `Environment.for_project` (which
+      # also covers pool workers), and by `rigor plugins`' probe. When a target library cannot be
+      # required from Rigor's own gem
+      # environment (the standalone `gem install rigortype` case — activesupport is deliberately NOT a
+      # runtime dependency), {require_with_target_bundle} falls back to requiring it from this bundle:
+      # the analyzed Rails project always carries its own activesupport on disk, and loading the
+      # project's locked copy is the higher-fidelity source of inflection rules anyway (ADR-79).
+      def target_bundle_root
+        @target_bundle_root
+      end
+
+      def target_bundle_root=(root)
+        @target_bundle_root = root.nil? ? nil : File.expand_path(root.to_s)
+      end
+
+      # Requires `feature`, falling back to the analyzed project's bundler install tree. The fallback
+      # appends every bundle gem's `full_require_paths` (from its RubyGems-generated `specifications/`
+      # gemspec — the gem's own metadata, so nonstandard require paths like concurrent-ruby's
+      # `lib/concurrent-ruby` resolve correctly) to `$LOAD_PATH` and retries. `$LOAD_PATH` is appended,
+      # never prepended, and only on a failed require: Rigor's own activated gems keep precedence, and a
+      # host environment that carries the gem never consults the bundle. (`Gem.paths` augmentation was
+      # rejected — Bundler-locked processes silently ignore it.) Under the default `process` strategy the
+      # mutation happens inside the forked worker only; under `none`/Direct it lands in the main space,
+      # which is what that strategy means (documented tradeoff — the invoked library is trusted + pure).
+      def require_with_target_bundle(feature, bundle_root)
+        require feature
+      rescue ::LoadError
+        added = bundle_require_paths(bundle_root) - $LOAD_PATH
+        raise if added.empty?
+
+        $LOAD_PATH.concat(added)
+        require feature
+      end
+
+      # Every bundle gem's require paths, newest version per gem name. Loading a `specifications/*.gemspec`
+      # evaluates RubyGems-generated metadata of an installed third-party gem — the same trust level as
+      # requiring the gem, which is what the caller is about to do.
+      def bundle_require_paths(bundle_root)
+        bundle_gem_dirs(bundle_root).flat_map do |gem_home|
+          specs = Dir.glob(File.join(gem_home, "specifications", "*.gemspec"))
+                     .filter_map { |file| Gem::Specification.load(file) }
+          specs.group_by(&:name)
+               .flat_map { |_, versions| versions.max_by(&:version).full_require_paths }
+        end
+      end
+
+      # The RubyGems-shaped directories under a bundler install root: bundler nests them as
+      # `<root>/ruby/<ruby-version>/`; a `BUNDLE_PATH` may also point directly at such a directory. Only
+      # directories that actually carry a `specifications/` index are returned.
+      def bundle_gem_dirs(bundle_root)
+        return [] if bundle_root.nil? || bundle_root.to_s.empty?
+
+        root = bundle_root.to_s
+        (Dir.glob(File.join(root, "ruby", "*")) + [root])
+          .select { |dir| File.directory?(File.join(dir, "specifications")) }
+      end
+
       # The default strategy. `process` (a crash-contained forked worker) is the default: it isolates the
       # target library's monkey-patches + crashes from Rigor with no in-process contamination, and forks a
       # single persistent worker (not one per call). It falls back to `none` where fork is unavailable (see
@@ -68,10 +127,15 @@ module Rigor
       module Direct
         module_function
 
+        # NOTE: rescue classes are `::`-qualified throughout this file: `Rigor::Plugin::LoadError` (the
+        # plugin-loading error) shadows the global `LoadError` in this lexical scope once plugin machinery
+        # is loaded, so a bare `rescue LoadError` matches the WRONG class — the real `::LoadError` (a
+        # ScriptError, not a StandardError) then escapes, kills the worker, and surfaces as an opaque
+        # EOFError instead of the clean decline (the standalone-install regression of 2026-07-16).
         def call(feature:, receiver:, method:, args:)
-          require feature
+          Isolation.require_with_target_bundle(feature, Isolation.target_bundle_root)
           Object.const_get(receiver).public_send(method, *args)
-        rescue LoadError, NameError => e
+        rescue ::LoadError, ::NameError => e
           raise Unavailable, "#{receiver} could not be loaded (#{e.class}: #{e.message})"
         end
       end
@@ -109,13 +173,13 @@ module Rigor
         def call(feature:, receiver:, method:, args:)
           raise Unavailable, "process isolation unavailable: fork is not supported" unless available?
 
-          status, value = exchange([feature, receiver, method, args])
+          status, value = exchange([feature, receiver, method, args, Isolation.target_bundle_root])
           raise Unavailable, "process isolation worker error: #{value}" if status == :error
 
           value
         rescue Unavailable
           raise
-        rescue StandardError => e
+        rescue ::StandardError => e
           # A dead worker surfaces as EOFError (Marshal.load) or Errno::EPIPE (Marshal.dump) — both
           # StandardError. The crash is contained: the parent resets the worker (respawn next call) and
           # declines.
@@ -123,7 +187,9 @@ module Rigor
           raise Unavailable, "process isolation worker failed (#{e.class})"
         end
 
-        # Sends one request to the persistent worker and reads its reply.
+        # Sends one request to the persistent worker and reads its reply. The request carries the
+        # target-bundle root so the fallback require (see {Isolation.require_with_target_bundle}) happens
+        # inside the worker — the parent's gem environment is never touched.
         def exchange(request)
           w = worker
           Marshal.dump(request, w[:req])
@@ -152,22 +218,26 @@ module Rigor
           end
         end
 
-        # The child loop: read a `[feature, receiver, method, args]` request, require + call, and write
-        # `[:ok, result]` or `[:error, message]`. EOF (parent gone) ends the loop.
+        # The child loop: read a `[feature, receiver, method, args, bundle_root]` request, require + call,
+        # and write `[:ok, result]` or `[:error, message]`. EOF (parent gone) ends the loop.
+        #
+        # The rescue is `::`-qualified (see {Direct.call}) and covers `::ScriptError` so a failed require
+        # (`::LoadError` is a ScriptError) replies with the clean `[:error, …]` decline instead of
+        # silently killing the worker — the parent would otherwise see only an opaque EOFError.
         def run_worker_loop(req_r, res_w)
           loop do
-            feature, receiver, method, args = Marshal.load(req_r) # rubocop:disable Security/MarshalLoad -- parent input
+            feature, receiver, method, args, bundle_root = Marshal.load(req_r) # rubocop:disable Security/MarshalLoad -- parent input
             reply =
               begin
-                require feature
+                Isolation.require_with_target_bundle(feature, bundle_root)
                 [:ok, Object.const_get(receiver).public_send(method, *args)]
-              rescue StandardError, LoadError => e
+              rescue ::StandardError, ::ScriptError => e
                 [:error, "#{e.class}: #{e.message}"]
               end
             Marshal.dump(reply, res_w)
             res_w.flush
           end
-        rescue EOFError
+        rescue ::EOFError
           # parent closed the request pipe — exit quietly
         ensure
           exit!(0)

data/lib/rigor/plugin/load_error.rb

@@ -11,6 +11,14 @@ module Rigor
     class LoadError < StandardError
       attr_reader :plugin_ref, :cause_class, :reason
 
+      # #194 slice 1 — the file `require` resolved the plugin gem to, when the require SUCCEEDED but the
+      # later configuration / instantiation step then failed. The loader stamps it in a rescue after a
+      # successful require (a require that failed outright never resolves a file and leaves this nil), so a
+      # config/init failure names the exact plugin copy it loaded from — the engine↔plugin version skew that
+      # made #194 a multi-round diagnosis. Consumed by the `plugin_loader.load-error` diagnostic message and
+      # the `rigor plugins` load-error row.
+      attr_accessor :resolved_path
+
       # ADR-9 slice 5 introduces two new reason codes alongside the implicit "load failure" used for require /
       # configuration / init failures:
       #
@@ -19,11 +27,12 @@ module Rigor
       #   - `:dependency-cycle` — the consumes graph forms a cycle.
       #
       # Older callers omit `reason:` and the field defaults to nil (the legacy "load failure" envelope).
-      def initialize(message, plugin_ref:, cause: nil, reason: nil)
+      def initialize(message, plugin_ref:, cause: nil, reason: nil, resolved_path: nil)
         super(message)
         @plugin_ref = plugin_ref
         @cause_class = cause&.class
         @reason = reason&.to_sym
+        @resolved_path = resolved_path
       end
     end
   end