rigortype 0.2.9 → 0.3.0

data/lib/rigor/cli/doctor_command.rb

@@ -34,6 +34,8 @@ module Rigor
       CHECK_PLUGINS = "plugins"
       CHECK_BASELINE = "baseline"
       CHECK_RAILS = "rails_plugins"
+      CHECK_GEMFILE = "gemfile_install"
+      CHECK_PLUGIN_SKEW = "plugin_skew"
 
       RAILS_LOCK_MARKERS = %w[railties actionpack activerecord actioncable].freeze
       RAILS_PLUGIN_MARKERS = %w[
@@ -63,8 +65,9 @@ module Rigor
         # 3. RBS environment check.
         findings.concat(check_rbs_environment(result))
 
-        # 4. Plugin load check.
-        findings.concat(check_plugins(configuration))
+        # 4. Plugin load check + 8. installation-skew check share one loaded registry.
+        registry = load_plugin_registry(configuration)
+        findings.concat(check_plugins(registry))
 
         # 5. Baseline drift check.
         findings.concat(check_baseline(configuration, result))
@@ -72,6 +75,12 @@ module Rigor
         # 6. Rails locked but no Rails plugins.
         findings.concat(check_rails_plugins(configuration))
 
+        # 7. Rigor itself resolved as a project dependency.
+        findings.concat(check_gemfile_install)
+
+        # 8. A bundled plugin loaded from a different rigortype installation than the engine (#194 slice 3).
+        findings.concat(check_plugin_skew(registry))
+
         report(findings, options.fetch(:format))
         findings.any? { |f| f[:status] == :fail } ? 1 : 0
       rescue OptionParser::InvalidArgument => e
@@ -122,37 +131,67 @@ module Rigor
         stats = result.stats
         return [] unless stats
 
+        quarantined = quarantined_signature_diagnostics(result)
         if stats.rbs_classes_total.zero?
-          [
-            {
-              check: CHECK_RBS,
-              status: :fail,
-              message: "RBS environment is empty (#{stats.rbs_classes_total} classes available)",
-              hint: "The RBS environment failed to build or loaded no signatures. " \
-                    "Check `signature_paths:` for duplicate declarations, or run " \
-                    "`rbs collection install` for gem signatures."
-            }
-          ]
+          [empty_rbs_env_finding(stats)]
+        elsif quarantined.any?
+          [degraded_rbs_env_finding(stats, quarantined)]
         else
-          [
-            {
-              check: CHECK_RBS,
-              status: :pass,
-              message: "RBS environment healthy (#{stats.rbs_classes_total} classes available)",
-              hint: nil
-            }
-          ]
+          [healthy_rbs_env_finding(stats)]
         end
       end
 
-      def check_plugins(configuration)
+      def empty_rbs_env_finding(stats)
+        {
+          check: CHECK_RBS,
+          status: :fail,
+          message: "RBS environment is empty (#{stats.rbs_classes_total} classes available)",
+          hint: "The RBS environment failed to build or loaded no signatures. " \
+                "Check `signature_paths:` for duplicate declarations, or run " \
+                "`rbs collection install` for gem signatures."
+        }
+      end
+
+      # The env is non-empty precisely BECAUSE the broken file was quarantined, so the class count alone reads
+      # as healthy — this is the case doctor used to pass. Classify the diagnostic the run already produced
+      # (ADR-77: route existing evidence) rather than re-probing the sig tree.
+      def degraded_rbs_env_finding(stats, quarantined)
+        {
+          check: CHECK_RBS,
+          status: :warn,
+          message: "RBS environment degraded — #{quarantined.size} `signature_paths:` file(s) " \
+                   "skipped, #{stats.rbs_classes_total} classes available",
+          hint: "An unparseable `.rbs` is skipped so the rest of the env survives, which makes the " \
+                "run quieter, not cleaner: the types it declares are gone. Run `rbs validate` on your " \
+                "`sig/` set and fix the parse error. To make this fail the build, opt into the " \
+                "`reject-unparseable-signatures` bleeding-edge feature."
+        }
+      end
+
+      def healthy_rbs_env_finding(stats)
+        {
+          check: CHECK_RBS,
+          status: :pass,
+          message: "RBS environment healthy (#{stats.rbs_classes_total} classes available)",
+          hint: nil
+        }
+      end
+
+      def quarantined_signature_diagnostics(result)
+        result.diagnostics.select { |diagnostic| diagnostic.rule == "rbs.coverage.quarantined-signature" }
+      end
+
+      def load_plugin_registry(configuration)
         services = Plugin::Services.new(
           reflection: Reflection,
           type: Type::Combinator,
           configuration: configuration,
           cache_store: nil
         )
-        registry = Plugin::Loader.load(configuration: configuration, services: services)
+        Plugin::Loader.load(configuration: configuration, services: services)
+      end
+
+      def check_plugins(registry)
         errors = registry.load_errors
         return [] if errors.empty?
 
@@ -166,6 +205,52 @@ module Rigor
         ]
       end
 
+      # WD5 (#194 slice 3) — a bundled plugin should load from the engine's own `plugins/` tree; slice 2
+      # anchors it there. This guards the residual anchoring cannot see: a bundled plugin whose resolved file
+      # sits OUTSIDE the engine tree — the fallback-require path, or a genuinely mixed installation where a
+      # foreign copy was already loaded. That is the #194 skew, which ran the engine with a load-bearing
+      # false-positive gate silently missing. Only plugins the engine bundles are checked; a third-party /
+      # project-bundle plugin is not the engine's to vouch for and is never flagged, and a nil resolved path
+      # (an injected requirer, an in-process no-op load) carries no provenance and is skipped.
+      def check_plugin_skew(registry)
+        registry.resolved_gem_paths.filter_map do |gem_name, resolved_path|
+          next if resolved_path.nil?
+          next unless Plugin::Loader.bundled_plugin_path(gem_name)
+          next if inside_engine_tree?(resolved_path)
+
+          plugin_skew_finding(gem_name, resolved_path)
+        end
+      end
+
+      def plugin_skew_finding(gem_name, resolved_path)
+        {
+          check: CHECK_PLUGIN_SKEW,
+          status: :warn,
+          message: "Plugin #{gem_name} loaded from a different rigortype installation than the engine " \
+                   "(loaded from #{resolved_path}; engine at #{Plugin::Loader::ENGINE_ROOT})",
+          hint: "The engine and its bundled plugins are versioned together, so a copy resolved from another " \
+                "installation can run the engine with a mismatched plugin (the cause of wrong diagnostics in " \
+                "#194). Ensure a single `rigortype` is on the load path — remove any separately-installed " \
+                "`rigortype` gem that shadows this checkout, or reinstall so the engine and its `plugins/` " \
+                "tree come from one place."
+        }
+      end
+
+      # True when `resolved_path` lives inside the engine's own tree. Both sides are resolved through
+      # `File.realpath` first so a symlinked gem home / checkout (e.g. macOS `/var` → `/private/var`) does not
+      # read as foreign; a vanished file degrades to `File.expand_path` rather than raising.
+      def inside_engine_tree?(resolved_path)
+        engine = real_or_expanded(Plugin::Loader::ENGINE_ROOT)
+        target = real_or_expanded(resolved_path)
+        target == engine || target.start_with?("#{engine}#{File::SEPARATOR}")
+      end
+
+      def real_or_expanded(path)
+        File.realpath(path)
+      rescue StandardError
+        File.expand_path(path)
+      end
+
       def check_baseline(configuration, result)
         path = configuration.baseline_path
         return [] if path.nil? || !File.exist?(path)
@@ -238,6 +323,52 @@ module Rigor
         false
       end
 
+      # Rigor is a tool, not a library (ADR-27): resolving it as one of the project's own dependencies pins the
+      # application to Rigor's Ruby and drags Rigor's dependency graph into the app's resolution. The gem carries
+      # guardrails against arriving here, but they only fire during install and at boot — a project that already
+      # made the mistake never sees them again, so doctor names the state.
+      def check_gemfile_install
+        lock = File.join(Dir.pwd, "Gemfile.lock")
+        return [] unless File.file?(lock)
+        return [] unless rubygems_sourced_rigortype?(lock)
+
+        [
+          {
+            check: CHECK_GEMFILE,
+            status: :fail,
+            message: "Rigor is resolved as a dependency of this project (`rigortype` under GEM in Gemfile.lock)",
+            hint: "Remove `rigortype` from the Gemfile and install Rigor on its own — see " \
+                  "https://github.com/rigortype/rigor/blob/master/docs/install.md. To keep the version " \
+                  "pinned, use `mise use --pin gem:rigortype`, or an isolated `BUNDLE_GEMFILE` holding only " \
+                  "Rigor (the CI chapter's pattern), which leaves your application's resolution untouched."
+          }
+        ]
+      end
+
+      # True only when `rigortype` resolves from a GEM remote — i.e. an ordinary `gem "rigortype"` in the app's
+      # Gemfile, the case worth reporting.
+      #
+      # The source is load-bearing, not decoration: Rigor's own repo, every fork of it, and any project vendoring
+      # Rigor for development all carry `rigortype` in Gemfile.lock too — under PATH (`remote: .`, from the
+      # `gemspec` directive) or GIT. Matching the name alone would fail this check on Rigor itself. Reading the
+      # lock by section also keeps a CHECKSUMS entry and a *dependency* line nested under another gem (six-space
+      # indent) from counting as a resolution.
+      def rubygems_sourced_rigortype?(path)
+        section = nil
+        in_specs = false
+
+        File.foreach(path) do |line|
+          case line
+          when /\A(\S.*?)\s*\z/ then (section = Regexp.last_match(1)) && (in_specs = false)
+          when /\A  specs:\s*\z/ then in_specs = true
+          when /\A    rigortype \(/ then return true if section == "GEM" && in_specs
+          end
+        end
+        false
+      rescue StandardError
+        false
+      end
+
       # ------------------------------------------------------------------
       # Reporting
       # ------------------------------------------------------------------
@@ -272,7 +403,9 @@ module Rigor
         if failures.empty? && warnings.empty?
           @out.puts("rigor doctor: all checks passed — no setup problems detected.")
         else
-          @out.puts("rigor doctor: #{failures.size} issue(s) found")
+          # Count warnings too: a warn-only run (a degraded RBS env, a malformed baseline) used to headline
+          # "0 issue(s) found" above the very finding it was reporting.
+          @out.puts("rigor doctor: #{summary_counts(failures, warnings)}")
           failures.each { |f| print_finding(f) }
           warnings.each { |f| print_finding(f) } unless warnings.empty?
         end
@@ -280,6 +413,13 @@ module Rigor
         passes.each { |f| print_finding(f) } unless passes.empty?
       end
 
+      def summary_counts(failures, warnings)
+        parts = []
+        parts << "#{failures.size} issue(s)" unless failures.empty?
+        parts << "#{warnings.size} warning(s)" unless warnings.empty?
+        "#{parts.join(', ')} found"
+      end
+
       def print_finding(finding)
         label = case finding[:status]
                 when :fail then "[FAIL]"

data/lib/rigor/cli/lsp_command.rb

@@ -2,6 +2,7 @@
 
 require_relative "command"
 require_relative "options"
+require_relative "../runtime/jit"
 
 require "optionparser"
 
@@ -25,6 +26,10 @@ module Rigor
           return CLI::EXIT_USAGE
         end
 
+        # A long-lived server always outlasts the JIT compile cost, so enable
+        # YJIT at boot rather than on the analysis deadline (Runtime::Jit).
+        Runtime::Jit.enable_now
+
         require_relative "../language_server"
         require_relative "../configuration"
         require "language_server-protocol"

data/lib/rigor/cli/mcp_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "command"
+require_relative "../runtime/jit"
 
 require "optionparser"
 
@@ -27,6 +28,10 @@ module Rigor
           return CLI::EXIT_USAGE
         end
 
+        # A long-lived server always outlasts the JIT compile cost, so enable
+        # YJIT at boot rather than on the analysis deadline (Runtime::Jit).
+        Runtime::Jit.enable_now
+
         require_relative "../mcp"
         require_relative "../version"
 

data/lib/rigor/cli/plugins_command.rb

@@ -7,6 +7,8 @@ require_relative "options"
 require_relative "../plugin"
 require_relative "../plugin/loader"
 require_relative "../plugin/services"
+require_relative "../plugin/inflector"
+require_relative "../environment/bundle_sig_discovery"
 require_relative "../reflection"
 require_relative "../type/combinator"
 require_relative "plugins_renderer"
@@ -67,7 +69,8 @@ module Rigor
         configuration = Configuration.load(options.fetch(:config))
         rows = build_rows(configuration)
 
-        renderer = PluginsRenderer.new(rows: rows, configuration_path: config_path)
+        renderer = PluginsRenderer.new(rows: rows, configuration_path: config_path,
+                                       inflection: inflection_note(configuration, rows))
         @out.puts(render(renderer, options))
 
         any_load_errors = rows.any? { |row| row.fetch(:status) == :load_error }
@@ -129,6 +132,25 @@ module Rigor
         rows + orphan_errors
       end
 
+      # ADR-90 — activation-time visibility for inflection degradation. When a loaded plugin consumes
+      # `Plugin::Inflector` (ADR-39), probe whether the real `ActiveSupport::Inflector` is actually
+      # reachable — through Rigor's own gem environment or the analyzed project's bundle — so a standalone
+      # install where every inflection-dependent check would silently produce no diagnostics says so here
+      # instead of reporting an unqualified `[OK]`. Returns nil when no consumer is loaded (a non-Rails
+      # project never sees the probe).
+      def inflection_note(configuration, rows)
+        loaded_ids = rows.filter_map { |row| row[:id] if row[:status] == :loaded }
+        required_by = loaded_ids & Plugin::Inflector::CONSUMER_PLUGIN_IDS
+        return nil if required_by.empty?
+
+        Plugin::Isolation.target_bundle_root ||= Environment::BundleSigDiscovery.resolve_bundle_path(
+          bundle_path: configuration.bundler_bundle_path,
+          project_root: Dir.pwd,
+          auto_detect: configuration.bundler_auto_detect
+        )&.to_s
+        { required_by: required_by, available: Plugin::Inflector.available? }
+      end
+
       def build_services(configuration)
         Plugin::Services.new(
           reflection: Reflection,
@@ -148,7 +170,10 @@ module Rigor
         end
 
         if plugin
-          loaded_row(plugin, gem_name, config)
+          # #194 slice 1 — a loaded plugin's resolved file rides on the registry keyed by gem name (the
+          # frozen plugin instance can't carry it). nil when the gem's entry-file basename differs from its
+          # name, or the resolver couldn't pin it.
+          loaded_row(plugin, gem_name, config, registry.resolved_gem_paths[gem_name])
         else
           # Find the load error whose plugin_ref names this entry (the ref is set by Loader to the gem name on require
           # failures and to the manifest id on later failures).
@@ -168,9 +193,10 @@ module Rigor
         [derived_id, gem_name].include?(plugin.manifest.id)
       end
 
-      def loaded_row(plugin, gem_name, config)
+      def loaded_row(plugin, gem_name, config, resolved_path)
         manifest = plugin.manifest
         identity_fields(gem_name, manifest, config)
+          .merge(path: resolved_path)
           .merge(extension_fields(plugin, manifest))
           .merge(narrow_protocol_fields(plugin))
           .merge(load_error: nil)
@@ -185,7 +211,7 @@ module Rigor
         {
           node_rule_types: klass.node_rules.map { |r| r[:node_type].name }.uniq,
           dynamic_return_receivers: klass.dynamic_returns.flat_map { |r| r[:receivers] }.uniq,
-          type_specifier_methods: klass.type_specifiers.flat_map { |r| r[:methods] }.map(&:to_s).uniq
+          narrowing_facts_methods: klass.narrowing_facts_rules.flat_map { |r| r[:methods] }.map(&:to_s).uniq
         }
       end
 
@@ -230,6 +256,9 @@ module Rigor
           id: entry_id,
           version: nil,
           description: nil,
+          # #194 slice 1 — set only when the require SUCCEEDED but a later step failed (the loader stamps the
+          # file on the error); a require that failed outright has no resolvable file, so this stays nil.
+          path: error&.resolved_path,
           config: config,
           signature_paths: [],
           open_receivers: [],
@@ -246,7 +275,7 @@ module Rigor
           source_rbs_synthesizer: false,
           node_rule_types: [],
           dynamic_return_receivers: [],
-          type_specifier_methods: [],
+          narrowing_facts_methods: [],
           load_error: error&.message || "plugin did not register or could not be matched to a registered class"
         }
       end
@@ -310,6 +339,7 @@ module Rigor
             id: nil,
             version: nil,
             description: nil,
+            path: error.resolved_path,
             config: {},
             signature_paths: [],
             open_receivers: [], owns_receivers: [], produces: [], consumes: [],
@@ -317,7 +347,7 @@ module Rigor
             type_node_resolvers: 0,
             hkt_registrations: 0, hkt_definitions: 0,
             protocol_contracts: 0, source_rbs_synthesizer: false,
-            node_rule_types: [], dynamic_return_receivers: [], type_specifier_methods: [],
+            node_rule_types: [], dynamic_return_receivers: [], narrowing_facts_methods: [],
             load_error: error.message
           }
         end

data/lib/rigor/cli/plugins_renderer.rb

@@ -10,9 +10,12 @@ module Rigor
     # The two formats carry the same content; JSON is meant for tooling (SKILLs, CI, editor integrations) while text is
     # for interactive inspection. Rows are printed in the order the loader resolved them.
     class PluginsRenderer # rubocop:disable Metrics/ClassLength
-      def initialize(rows:, configuration_path:)
+      # `inflection:` (ADR-90) is nil, or `{required_by: [ids], available: Boolean}` — the activation-time
+      # `Plugin::Inflector` probe result when a loaded plugin consumes the shared inflection helper.
+      def initialize(rows:, configuration_path:, inflection: nil)
         @rows = rows
         @configuration_path = configuration_path
+        @inflection = inflection
       end
 
       def text
@@ -25,17 +28,23 @@ module Rigor
         end
         lines << ""
         lines << footer
+        lines.concat(inflection_warning_lines)
         lines.join("\n")
       end
 
       def json
-        JSON.pretty_generate(
-          {
-            "configuration" => @configuration_path,
-            "plugins" => @rows.map { |row| row_json(row) },
-            "summary" => summary
+        payload = {
+          "configuration" => @configuration_path,
+          "plugins" => @rows.map { |row| row_json(row) },
+          "summary" => summary
+        }
+        unless @inflection.nil?
+          payload["inflection"] = {
+            "required_by" => @inflection.fetch(:required_by),
+            "available" => @inflection.fetch(:available)
           }
-        )
+        end
+        JSON.pretty_generate(payload)
       end
 
       # ADR-37 § "Machine-readable capability catalogue" — the focused per-plugin extension-protocol dump. Only loaded
@@ -84,7 +93,7 @@ module Rigor
         [
           ["node_rule", row[:node_rule_types]],
           ["dynamic_return receivers", row[:dynamic_return_receivers]],
-          ["type_specifier methods", row[:type_specifier_methods]],
+          ["narrowing_facts methods", row[:narrowing_facts_methods]],
           ["produces", row[:produces]],
           ["consumes", row[:consumes]]
         ].filter_map { |label, values| "#{label}: #{values.join(', ')}" if values.any? }
@@ -97,7 +106,7 @@ module Rigor
           "version" => row[:version],
           "node_rule_types" => row[:node_rule_types],
           "dynamic_return_receivers" => row[:dynamic_return_receivers],
-          "type_specifier_methods" => row[:type_specifier_methods],
+          "narrowing_facts_methods" => row[:narrowing_facts_methods],
           "produces" => row[:produces],
           "consumes" => row[:consumes]
         }
@@ -122,6 +131,22 @@ module Rigor
         end
       end
 
+      # ADR-90 — the text-view degradation warning. Printed only when the probe ran (an Inflector-consuming
+      # plugin is loaded) AND inflection is unavailable; the healthy case stays quiet.
+      def inflection_warning_lines
+        return [] if @inflection.nil? || @inflection.fetch(:available)
+
+        [
+          "",
+          "WARNING: ActiveSupport::Inflector is not loadable — inflection-dependent checks of " \
+          "#{@inflection.fetch(:required_by).join(', ')} will silently produce no diagnostics.",
+          "         Rigor found activesupport neither in its own gem environment nor in the project's " \
+          "bundler install tree.",
+          "         Fix: run `bundle install` in the analyzed project (Rigor reads vendor/bundle or " \
+          ".bundle/config), or install activesupport into Rigor's gem environment."
+        ]
+      end
+
       def row_lines(row)
         marker = row[:status] == :loaded ? "OK " : "ERR"
         head = if row[:status] == :loaded
@@ -131,6 +156,10 @@ module Rigor
                end
         lines = [head]
         lines << "        #{row[:description]}" if row[:description]
+        # #194 slice 1 — the file the plugin gem loaded from, so an engine↔plugin version skew (a stale
+        # installed `rigortype` shadowing a checkout's bundled plugin) is a glance, not a bisect. Shown for
+        # loaded rows and for a require-succeeded-then-failed error row; omitted when unresolvable.
+        lines << "        path: #{row[:path]}" if row[:path]
 
         if row[:status] == :load_error
           lines << "        load error: #{row[:load_error]}"
@@ -170,8 +199,8 @@ module Rigor
         if row[:dynamic_return_receivers].any?
           lines << "        dynamic_return receivers: #{row[:dynamic_return_receivers].join(', ')}"
         end
-        if row[:type_specifier_methods].any?
-          lines << "        type_specifier methods: #{row[:type_specifier_methods].join(', ')}"
+        if row[:narrowing_facts_methods].any?
+          lines << "        narrowing_facts methods: #{row[:narrowing_facts_methods].join(', ')}"
         end
         lines
       end
@@ -213,6 +242,9 @@ module Rigor
           "id" => row[:id],
           "version" => row[:version],
           "description" => row[:description],
+          # #194 slice 1 — additive per-row provenance; null when the resolver could not pin the file (a
+          # require failure, or an entry-file basename differing from the gem name).
+          "path" => row[:path],
           "config" => row[:config],
           "signature_paths" => row[:signature_paths].map do |sp|
             { "path" => sp[:path], "exists" => sp[:exists], "rbs_files" => sp[:rbs_files] }
@@ -231,7 +263,7 @@ module Rigor
           "source_rbs_synthesizer" => row[:source_rbs_synthesizer],
           "node_rule_types" => row[:node_rule_types],
           "dynamic_return_receivers" => row[:dynamic_return_receivers],
-          "type_specifier_methods" => row[:type_specifier_methods],
+          "narrowing_facts_methods" => row[:narrowing_facts_methods],
           "load_error" => row[:load_error]
         }
       end

data/lib/rigor/cli/probe_environment.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require_relative "../environment"
+require_relative "../plugin"
+require_relative "../plugin/loader"
+require_relative "../plugin/services"
+require_relative "../reflection"
+require_relative "../type/combinator"
+
+module Rigor
+  class CLI
+    # Shared construction of the analysis-observing environment for the single-shot probe commands
+    # (`type-of`, `type-scan`, `trace`, `annotate`). Each of these answers "what does the engine infer here?"
+    # for a hand-picked file or position, so the environment they type against MUST match the one `rigor check`
+    # analyses with — otherwise a probe reports a type the real run never computes.
+    #
+    # The gap this closes: the probes historically built their environment with
+    # `Environment.for_project(libraries:, signature_paths:)` only — no plugin registry, no `source_files:`. The
+    # `source_rbs_synthesizer` plugin hook (ADR-32 / ADR-93's auto-wired `rigor-rbs-inline`) therefore never
+    # ran there, so a class whose only signature comes from an inline `#: () -> void` annotation typed as
+    # `Dynamic[top]` under a probe while `check` resolved it through the synthesized RBS. That divergence
+    # misattributed a dispatch tier during the #162 transitive-void design pass (see the 2026-07-19 addendum in
+    # docs/adr/100-static-diagnostic-family-and-void-origins.md).
+    #
+    # This threads the two things that were missing — the plugin registry built by the plugin loader, and the
+    # `source_files:` the synthesizers run over — matching `rigor check`'s `Environment.for_project` call
+    # (built in `Analysis::Runner::PoolCoordinator#build_runner_environment`). A probe legitimately simplifies
+    # relative to check: no synthesis-failure reporter (a probe has no diagnostic pipeline) and no synthesis
+    # cache store (a single-position probe recomputes cheaply). Plugin loading itself matches check — same
+    # `.rigor.yml` `plugins:` config, same ADR-93 auto-wire (already applied by `Configuration.load`), same
+    # `enabled:` / `require_magic_comment` semantics via `Plugin::Loader.load`.
+    #
+    # Fail-soft is the invariant: a project with no plugins, an unresolvable plugin gem, or any error during the
+    # plugin-aware build degrades to the bare environment the probes used before — never a crash. `Plugin::Loader`
+    # already isolates per-entry load failures onto the registry; the `rescue` here is the belt-and-suspenders
+    # around anything the loader or the plugin-aware env build itself might raise.
+    module ProbeEnvironment
+      module_function
+
+      # Builds the plugin-aware {Rigor::Environment} a probe types against.
+      #
+      # @param configuration [Rigor::Configuration] the loaded project configuration (already carries the
+      #   ADR-93 auto-wired `rigor-rbs-inline` entry when the library is resolvable).
+      # @param source_files [Array<String>] the file(s) the probe inspects. Threaded so each loaded plugin's
+      #   `source_rbs_synthesizer` runs over them at env-build time; an empty list contributes no synthesized RBS.
+      # @return [Rigor::Environment]
+      def build(configuration:, source_files:)
+        Environment.for_project(
+          libraries: configuration.libraries,
+          signature_paths: configuration.signature_paths,
+          plugin_registry: load_plugin_registry(configuration),
+          source_files: source_files
+        )
+      rescue StandardError
+        bare(configuration)
+      end
+
+      # Loads the project's configured plugins the same way the plugin-inspection commands (`rigor plugins`,
+      # `rigor doctor`) do: a `Plugin::Services` with no cache store (the probe recomputes) driving
+      # `Plugin::Loader.load`. Returns `nil` — so `Environment.for_project` skips the plugin tier entirely —
+      # when the project declares no plugins.
+      def load_plugin_registry(configuration)
+        return nil if configuration.plugins.empty?
+
+        services = Plugin::Services.new(
+          reflection: Reflection,
+          type: Type::Combinator,
+          configuration: configuration,
+          cache_store: nil
+        )
+        Plugin::Loader.load(configuration: configuration, services: services)
+      end
+
+      # The pre-fix environment: RBS + project signatures only, no plugin tier and no synthesized RBS. The
+      # fail-soft floor — a probe on a project with broken or absent plugin setup lands here and behaves exactly
+      # as it did before this parity fix.
+      def bare(configuration)
+        Environment.for_project(
+          libraries: configuration.libraries,
+          signature_paths: configuration.signature_paths
+        )
+      end
+    end
+  end
+end