Bundler's path tier rule is written twice in ruby_crawler, and store discovery ignores BUNDLE_DISABLE_SHARED_GEMS: "false" #1931

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: bug (duplicated rule that drifted). Register ID: A53.

Problem

Bundler's Settings#path tier rule (the first config tier that sets path, path.system or disable_shared_gems decides, and a falsy disable_shared_gems means system gems) is implemented twice in crawlers/ruby_crawler.rs, and the two copies disagree:

• Copy A: bundler_sets_explicit_path L1347-L1379,`` used by bundler_uses_system_gems. It treats `disable_shared_gems` set to a falsy value as "use system gems", as Bundler does.
• Copy B: bundler_path_tier L880-L907 plus config_path_tier L2410-L2423,````` used by store discovery. disable_shared_gems only makes a tier count. `system` is read from `BUNDLE_PATH__SYSTEM` alone:

  system: bundle_config_setting_including_empty(contents, "BUNDLE_PATH__SYSTEM")
      .is_some_and(|v| bundler_truthy(&v)),

• Partial copies of the same rule: the shadowed check (L519-L520),`````` global_path_config_unless_env_path_settings L2164-L2174,``````` and the same-file `path.system` drop in `parse_bundle_config_path_with` L2377-L2395.````````
• Two structs model the same concept: BundlerPathSettings and BundlerPathTier.

Executed in a scratch copy of the workspace at cbbbdb9. The project has a Gemfile, a leftover vendor/bundle store, and a .bundle/config containing BUNDLE_DISABLE_SHARED_GEMS: "false".

• bundler_sets_explicit_path returns false, meaning system gems.
• Discovery still returns the leftover vendor/bundle store with default_root_has_stores = true.
• So get_gem_paths drops the gem env homes, and apply targets a copy that Bundler does not load. This is the Gem crawler ignores Bundler's path.system: true when a leftover vendor/bundle exists, so agent apply patches the unused copy and vex attests not_affected while Bundler loads the unpatched system gem #915 shape, through this flag.

As a control, the same project with BUNDLE_PATH__SYSTEM: "true" returns [].

Proposed change

Replace the copies with one resolver over BundlerPathSettings that returns { explicit_path, system, deciding_tier }. Use it from discovery (bundler_path_tier), from shadowed, and from bundler_uses_system_gems. Then delete BundlerPathTier and config_path_tier, and fold global_path_config_unless_env_path_settings into the resolver.

Size

1 file (crawlers/ruby_crawler.rs), about −80/+40 production lines, plus one test.

Acceptance criteria

• A new unit test: disable_shared_gems: "false" with a leftover vendor/bundle yields no bundle store, and the gem env homes are kept.
• Existing path.system, BUNDLE_PATH and deployment tests pass unchanged.
• One tier resolver remains, and one settings struct.