ADR-013 Phase 2: import guard round-4 fix (init-less dir .py sibling)

shopdb/plugins/importguard.py

@@ -157,17 +157,19 @@ class PluginImportGuard(importlib.abc.MetaPathFinder):
             init = base / '__init__.py'
             if init.exists():
                 return self._source_spec(name, fullname, init, True, [str(base)])
-            # Regular package with no __init__.py: refuse a planted
-            # __init__.<ext>; otherwise treat as a namespace package (no body).
+            # Dir with no __init__.py: refuse a planted __init__.<ext>. Do NOT
+            # return yet - FileFinder loads a same-name sibling FILE over an
+            # init-less dir, so a foo.py next to foo/ must still be hash-gated
+            # (round 4). Fall through to the leaf resolution below.
             self._refuse_if_unverifiable_present(base, '__init__', name)
-            return None
 
+        # Leaf module (or a dir-with-no-__init__ that has a sibling .py): a .py
+        # here must match the signed hash; a planted non-source candidate is
+        # refused; only a genuinely-absent name defers to normal import.
+        # Invariant: return None only where FileFinder would also find nothing.
         source = base.with_suffix('.py')
         if source.exists():
             return self._source_spec(name, fullname, source, False, None)
-
-        # No .py for this name: refuse a planted .so / sourceless .pyc, else defer
-        # (a genuinely-absent module -> normal ModuleNotFoundError).
         self._refuse_if_unverifiable_present(base.parent, base.name, name)
         return None