fix(cache-clean): harden orphan sweep + surface remove failures (v3.2.21)

[kengio]

Summary

Closes the 3 verify-then-harden items reopened in the plugin-update-robustness design (the v3.2.16 cache sweeper).

• Item 1 (verified, no fix): confirmed clean_plugin_cache runs unconditionally on every real Claude onebrain plugin update (orchestrate.rs Step 8+9, if harness == Claude) — not gated on a version change; only --dry-run skips (it short-circuits the whole vault-sync). Added a clarifying comment.
• Item 2 (fix): discover_onebrain_cache_dirs globbed the cache only if dirs.is_empty(), so an orphan under an unregistered marketplace was missed whenever a registered marketplace also existed (the real 2.2.4 shape). Now always unions JSON-registered + glob-discovered dirs, then sort()+dedup().
• Item 3 (fix): remove_dir_all failures were silently swallowed. clean_plugin_cache now returns CacheCleanOutcome { removed, failed }, eprintln!s a vault-sync:-prefixed warning per failed path, and both callers (vault-sync progress + doctor --fix) surface the failure count.

Why dedup is load-bearing

With the always-union glob, a registered marketplace surfaces via both the JSON path and the glob. Without sort+dedup the same version dir would be enumerated twice → remove_dir_all runs twice → the 2nd hits NotFound → a phantom failed++. Reverting the dedup makes 3 tests fail (verified), so it's guarded.

Testing

• New: glob_catches_orphan_under_unregistered_marketplace (item 2), remove_failure_is_counted_and_surfaced_not_swallowed (#[cfg(unix)], chmod 0o500 parent, item 3).
• All 8 pre-existing cache_clean tests migrated to .removed/.failed.
• cargo test -p onebrain-fs → 564 passed · cargo test -p onebrain-cli → 589 passed · clippy clean · fmt clean.
• 3-round review (correctness / Rust-quality / adversarial) — all APPROVE; traversal defense + symlink skip confirmed intact; dedup verified airtight (byte-identical paths).

Patch bump (bugfix, no new command). Known out-of-scope follow-up: enumeration failure of an unreadable .../onebrain/ dir is still silent (the 2.2.4 bug was removal/shadowing, not unreadable-dir).

Plan: 01-projects/onebrain/cli/2026-05-30-cache-clean-hardening-plan.md (vault).

🤖 Generated with Claude Code