@@ -240,6 +240,8 @@ jobs:
         os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 50
+    env:
+      VEXCTL_VERSION: v0.3.0
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -264,6 +266,7 @@ jobs:
         run: cargo build --workspace
 
       - name: Install Go (for vexctl)
+        id: go
         # The `vex` subcommand emits OpenVEX documents; tests/e2e_vex.rs
         # validates the output with vexctl when it's on PATH. vexctl is
         # a Go binary distributed via `go install`. Setting up Go here
@@ -279,6 +282,19 @@ jobs:
           go-version: '1.24'
           cache: false
 
+      - name: Restore vexctl (macOS)
+        # The macOS compile below took a median 110s (max 168s) of every
+        # macOS `test` job and is the step's only network flake source
+        # (sum.golang.org resets). Its output depends only on the vexctl
+        # version, the Go toolchain and the runner, so it is cached under
+        # exactly those. Saved from main only, like the cargo cache.
+        id: vexctl-cache
+        if: runner.os == 'macOS'
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ${{ runner.temp }}/vexctl-bin
+          key: vexctl-${{ env.VEXCTL_VERSION }}-go${{ steps.go.outputs.go-version }}-${{ runner.os }}-${{ runner.arch }}
+
       - name: Install vexctl
         # Linux / Windows: the v0.3.0 release binary, checked against the
         # sha256 pinned here (from the release's vexctl_checksums.txt).
@@ -292,25 +308,26 @@ jobs:
         # sum.golang.org checksum tiles, and transient INTERNAL_ERROR
         # stream resets there have failed this step on otherwise-green
         # runs. The backoff rides out short resets; a persistent outage
-        # still fails loudly on the last attempt.
+        # still fails loudly on the last attempt. A binary restored by the
+        # step above skips the compile.
         #
         # Either way the binary's directory goes on PATH so
         # `Command::new("vexctl")` in the tests resolves.
         shell: bash
         env:
-          VEXCTL_VERSION: v0.3.0
           VEXCTL_SHA256_LINUX_AMD64: cd7f8b57d20642166ed4eb3dd1fd849bbb30bbd7c5b9f5b0316b6003b57ceaba
           VEXCTL_SHA256_WINDOWS_AMD64: 346fb3104b656fe1a407cbae88ea29a636b36f4569ec58a5a8dadca7343993ed
+          CACHE_HIT: ${{ steps.vexctl-cache.outputs.cache-hit }}
         run: |
           set -euo pipefail
+          dir="$RUNNER_TEMP/vexctl-bin"
+          mkdir -p "$dir"
           case "$RUNNER_OS" in
             Linux) asset=vexctl-linux-amd64 bin=vexctl sha="$VEXCTL_SHA256_LINUX_AMD64" ;;
             Windows) asset=vexctl-windows-amd64.exe bin=vexctl.exe sha="$VEXCTL_SHA256_WINDOWS_AMD64" ;;
             *) asset='' ;;
           esac
           if [ -n "$asset" ]; then
-            dir="$RUNNER_TEMP/vexctl-bin"
-            mkdir -p "$dir"
             curl -fsSL --retry 5 --retry-all-errors -o "$dir/$bin" \
               "https://github.com/openvex/vexctl/releases/download/$VEXCTL_VERSION/$asset"
             echo "$sha  $dir/$bin" | sha256sum -c -
@@ -319,18 +336,31 @@ jobs:
             echo "$dir" >> "$GITHUB_PATH"
             exit 0
           fi
-          for attempt in 1 2 3 4 5; do
-            if go install "github.com/openvex/vexctl@$VEXCTL_VERSION"; then
-              break
-            fi
-            if [ "$attempt" = 5 ]; then
-              echo "::error::go install vexctl failed on all 5 attempts"
-              exit 1
-            fi
-            echo "::warning::go install vexctl attempt $attempt failed; retrying"
-            sleep $((attempt * 20))
-          done
-          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+          if [ "$CACHE_HIT" != true ]; then
+            for attempt in 1 2 3 4 5; do
+              if GOBIN="$dir" go install "github.com/openvex/vexctl@$VEXCTL_VERSION"; then
+                break
+              fi
+              if [ "$attempt" = 5 ]; then
+                echo "::error::go install vexctl failed on all 5 attempts"
+                exit 1
+              fi
+              echo "::warning::go install vexctl attempt $attempt failed; retrying"
+              sleep $((attempt * 20))
+            done
+          fi
+          "$dir/vexctl" version
+          echo "$dir" >> "$GITHUB_PATH"
+
+      - name: Save vexctl (macOS)
+        if: >-
+          runner.os == 'macOS'
+          && github.ref == 'refs/heads/main'
+          && steps.vexctl-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ${{ runner.temp }}/vexctl-bin
+          key: ${{ steps.vexctl-cache.outputs.cache-primary-key }}
 
       - name: Run tests
         # Default features only: `--all-features` would also RUN the
 
@@ -192,12 +192,14 @@ struct StaleInstallOutcome {
 /// behind silently reinstates the stale bytes) — while a SHARED gem-env
 /// home affects every project on the machine, so that flavor prefers moving
 /// the project to a local bundle path and only conditionally names the
-/// shared files.
+/// shared files. `project_local` is the caller's call: under the project
+/// root, or under the project's own `.bundle/config` path even when that
+/// path sits outside the tree (#709).
 fn gem_stale_install_warning(
     purl: &str,
     gem_dir: &Path,
     leaf: &str,
-    cwd: &Path,
+    project_local: bool,
     project_cache_gem: Option<&Path>,
 ) -> serde_json::Value {
     let home = gem_dir
@@ -215,7 +217,7 @@ fn gem_stale_install_warning(
         paths.push(extra.display().to_string());
     }
     let list = paths.join(", ");
-    let detail = if gem_dir.starts_with(cwd) {
+    let detail = if project_local {
         format!(
             "{purl} was switched to its hosted patch, but a stale \
              UNPATCHED install is already materialized at {} — `bundle install` \
@@ -293,7 +295,9 @@ async fn installed_stale_positive_evidence(
 /// * Discovery is [`socket_patch_core::crawlers::RubyCrawler`] — the same
 ///   installed-gem APIs `apply` uses, honoring `--global`/`--global-prefix`
 ///   exactly like scan's own discovery; layouts the crawler grows into are
-///   covered automatically.
+///   covered automatically. A `.bundle/config` path the containment guard
+///   refuses as a write root is still READ here
+///   (`verification_only_gem_paths`): bundler installs into it.
 /// * Records are found BY UUID (the fetch key, stable across purl
 ///   spellings): this run's fetched records first, then the redirect
 ///   ledger's persisted ones — a re-scan whose `/patches/view` fetch failed
@@ -364,7 +368,17 @@ async fn gem_stale_install_warnings(
         global,
         global_prefix,
     };
-    let gem_paths = crawler.get_gem_paths(&options).await.unwrap_or_default();
+    let mut gem_paths = crawler.get_gem_paths(&options).await.unwrap_or_default();
+    // A `.bundle/config` path outside the project is refused as a write
+    // root, yet bundler installs into and loads from it: read it too, or a
+    // stale materialization there never warns (#709). It is this project's
+    // own bundle path, so it takes the project-local remedy.
+    let config_stores = crawler.verification_only_gem_paths(&options).await;
+    for gems_dir in &config_stores {
+        if !gem_paths.contains(gems_dir) {
+            gem_paths.push(gems_dir.clone());
+        }
+    }
     // Every candidate's installed dir in every gem home, one blocking pass
     // (and at most one listing) per home — the per-candidate lookups the
     // loop below consumes, in the same (candidate, home) order.
@@ -419,8 +433,10 @@ async fn gem_stale_install_warnings(
         if j.patched || !j.positive {
             continue;
         }
+        let project_local =
+            dir.starts_with(cwd) || config_stores.iter().any(|store| dir.starts_with(store));
         let mut folded_cache: Option<std::path::PathBuf> = None;
-        if dir.starts_with(cwd) {
+        if project_local {
             let project_cache = app_cache.join(format!("{}.gem", j.leaf));
             if project_cache.is_file() {
                 let proven_patched = match (
@@ -446,7 +462,7 @@ async fn gem_stale_install_warnings(
             &j.purl,
             dir,
             &j.leaf,
-            cwd,
+            project_local,
             folded_cache.as_deref(),
         ));
         out.stale_purls.insert(j.purl.clone());
@@ -3291,7 +3307,13 @@ mod tests {
         let cwd = PathBuf::from("proj");
         let home = gem_home(&cwd);
         let gem_dir = home.join("gems").join(GEM_LEAF);
-        let w = gem_stale_install_warning(GEM_PURL, &gem_dir, GEM_LEAF, &cwd, None);
+        let w = gem_stale_install_warning(
+            GEM_PURL,
+            &gem_dir,
+            GEM_LEAF,
+            gem_dir.starts_with(&cwd),
+            None,
+        );
         let detail = detail_of(&w);
         assert!(detail.contains(GEM_PURL), "{detail}");
         assert!(detail.contains(&gem_dir.display().to_string()), "{detail}");
@@ -3326,7 +3348,13 @@ mod tests {
         let cwd = PathBuf::from("proj");
         let home = PathBuf::from("shared-gem-home").join("ruby").join("3.3.0");
         let gem_dir = home.join("gems").join(GEM_LEAF);
-        let w = gem_stale_install_warning(GEM_PURL, &gem_dir, GEM_LEAF, &cwd, None);
+        let w = gem_stale_install_warning(
+            GEM_PURL,
+            &gem_dir,
+            GEM_LEAF,
+            gem_dir.starts_with(&cwd),
+            None,
+        );
         let detail = detail_of(&w);
         assert!(detail.contains("shared gem home"), "{detail}");
         assert!(
@@ -3356,7 +3384,13 @@ mod tests {
             .join("vendor")
             .join("cache")
             .join(format!("{GEM_LEAF}.gem"));
-        let w = gem_stale_install_warning(GEM_PURL, &gem_dir, GEM_LEAF, &cwd, Some(&committed));
+        let w = gem_stale_install_warning(
+            GEM_PURL,
+            &gem_dir,
+            GEM_LEAF,
+            gem_dir.starts_with(&cwd),
+            Some(&committed),
+        );
         let detail = detail_of(&w);
         assert!(
             detail.contains(&committed.display().to_string()),
@@ -3484,6 +3518,57 @@ mod tests {
         assert!(out.warnings.is_empty());
     }
 
+    /// #709: a `.bundle/config` `path` outside the project is refused as an
+    /// install (write) root, but bundler still installs into and loads
+    /// from it — so the probe must read it, or a stale materialization
+    /// there never warns and the purl stays in the same-run `--vex`
+    /// `assume_applied` set.
+    #[tokio::test]
+    async fn gem_stale_probe_reads_refused_out_of_tree_config_path() {
+        let proj = tempfile::tempdir().unwrap();
+        let outside = tempfile::tempdir().unwrap();
+        std::fs::write(proj.path().join("Gemfile"), b"gem \"stale-unit\"\n").unwrap();
+        std::fs::create_dir_all(proj.path().join(".bundle")).unwrap();
+        std::fs::write(
+            proj.path().join(".bundle").join("config"),
+            format!("---\nBUNDLE_PATH: \"{}\"\n", outside.path().display()),
+        )
+        .unwrap();
+        // Bundler's scoped layout under the configured root.
+        let gem_dir = outside
+            .path()
+            .join("ruby")
+            .join("3.3.0")
+            .join("gems")
+            .join(GEM_LEAF);
+        std::fs::create_dir_all(gem_dir.join("lib")).unwrap();
+        std::fs::write(gem_dir.join("lib").join("stale_unit.rb"), GEM_UPSTREAM).unwrap();
+
+        let out = probe(proj.path(), &one_confirmed(), &one_record()).await;
+        assert_eq!(out.warnings.len(), 1, "{:?}", out.warnings);
+        let detail = detail_of(&out.warnings[0]);
+        assert!(detail.contains(&gem_dir.display().to_string()), "{detail}");
+        // The project's own bundle path, not a machine-wide gem home: the
+        // verified delete-list remedy, not the shared-home caveat.
+        assert!(detail.contains("Remove the stale"), "{detail}");
+        assert!(!detail.contains("shared gem home"), "{detail}");
+        assert_eq!(
+            out.stale_purls,
+            std::collections::BTreeSet::from([GEM_PURL.to_string()])
+        );
+        // Read-only: the refused root is never written.
+        assert_eq!(
+            std::fs::read(gem_dir.join("lib").join("stale_unit.rb")).unwrap(),
+            GEM_UPSTREAM
+        );
+
+        // A patched materialization there stays quiet.
+        std::fs::write(gem_dir.join("lib").join("stale_unit.rb"), GEM_PATCHED).unwrap();
+        let out = probe(proj.path(), &one_confirmed(), &one_record()).await;
+        assert!(out.warnings.is_empty(), "{:?}", out.warnings);
+        assert!(out.stale_purls.is_empty());
+    }
+
     /// FALSE-POSITIVE hardening: an install whose record file is MISSING
     /// (or unreadable — same NotFound class) is not positive evidence, so
     /// the probe stays quiet instead of prescribing deletion on a tree it
 
@@ -610,6 +610,11 @@ pub(crate) fn npm_paths_by_identity_in(
 /// [`find_packages_for_rollback_reusing`]. Only the root discovery is
 /// reused: each root is still searched by `find_by_purls`, so copy choice
 /// and order are unchanged. A snapshot taken with other options is ignored.
+///
+/// Read-only by contract (its one caller is `vex`), so it also searches the
+/// gem stores under a refused out-of-tree `.bundle/config` path
+/// (`RubyCrawler::verification_only_gem_paths`), which the write paths never
+/// see.
 pub async fn find_manifest_package_copies_reusing(
     purls: &[String],
     common: &GlobalArgs,
@@ -635,6 +640,22 @@ pub async fn find_manifest_package_copies_reusing(
             *paths = with_store_peer_variant_copies(std::mem::take(paths)).await;
         }
     }
+    // Verification also READS a `.bundle/config` bundle path the crawler
+    // refused as a write root (it resolves outside the project): bundler
+    // installs into and loads from it, so a copy there must verify too —
+    // skipping it would leave an unpatched gem looking "not installed",
+    // which the hosted lockfile basis then attests (#709).
+    if let Some(gem_purls) = partitioned.get(&Ecosystem::Gem) {
+        let stores = RubyCrawler
+            .verification_only_gem_paths(&crawler_options)
+            .await;
+        let bases = dedup_qualified_purls(gem_purls);
+        for store in &stores {
+            if let Ok(found) = RubyCrawler.find_by_purls(store, &bases).await {
+                merge_qualified(&mut copies, gem_purls, found);
+            }
+        }
+    }
     copies
 }
 
 
@@ -20,3 +20,4 @@ mod in_process_gem_multicopy;
 mod in_process_npm_multicopy;
 mod in_process_variant_apply_failure;
 mod lockfile_only_skip;
+mod pnpm_global_virtual_store;