pm: honor NUB_CACHE_DIR for the engine cache, and report the env tier in nub config

crates/nub-cli/src/pm_engine/install_family.rs

@@ -93,9 +93,12 @@
 //!   store label from the embedder identity — upstreamable as multicall
 //!   correctness), tracked with the brand-toggle fork items.
 //! - `link`/`unlink -g` use the engine's global-links registry under
-//!   `<XDG_CACHE_HOME>/aube/global-links` (`global_links_dir()` derives from
-//!   the leaf-fixed `aube_store::dirs::cache_dir()` — literally the
-//!   `cacheDir` gap in `super::nub_setting_defaults`).
+//!   `<XDG_CACHE_HOME>/nub/pm/global-links`. `global_links_dir()` derives from
+//!   `aube_store::dirs::cache_dir()`, so it follows the identity's
+//!   `cache_namespace` but NOT a `cacheDir` override — relocating the cache
+//!   leaves the global-links registry behind. Same shape as #643 on the
+//!   `storeDir` axis: an override the settings-resolved consumers honor and a
+//!   platform-default consumer does not.
 //!   Printed paths name that directory truthfully; the rewrite preserves
 //!   on-disk names by design.
 //! - `dlx` propagates the child's exit code via `std::process::exit`

crates/nub-cli/src/pm_engine/mod.rs

@@ -536,16 +536,16 @@ pub fn dispatch_verb(
 /// this verb mid-lifecycle-script — and under nub, `current_exe()` IS
 /// nub — so cli.rs intercepts the spelling before clap and lands here.
 /// The printed path is data for the shim (it lands under nub's own cache
-/// root via the `set_cache_root` registration), so stdout is passed
-/// through; failures route through the brand rewrite like every other
-/// engine report.
+/// root, which the identity profile's `cache_namespace` carries), so stdout
+/// is passed through; failures route through the brand rewrite like every
+/// other engine report.
 pub(crate) fn run_node_gyp_bootstrap(args: &[String]) -> Result<i32> {
     let [project_dir] = args else {
         anyhow::bail!("usage: nub __node-gyp-bootstrap <project-dir>");
     };
     // Register nub's static identity FIRST so the bootstrap's cache lands under
-    // nub's namespace (`$XDG_CACHE/nub/pm/tools/node-gyp`, via the `set_cache_root`
-    // the identity carries) rather than aube's. This re-entry runs as a fresh
+    // nub's namespace (`$XDG_CACHE/nub/pm/tools/node-gyp`, via the identity's
+    // `cache_namespace`) rather than aube's. This re-entry runs as a fresh
     // child process spawned by the engine's lazy shim (`AUBE_NODE_GYP_EXE
     // __node-gyp-bootstrap <dir>`, where `current_exe()` is nub) before any other
     // preflight, so the namespace registration has to happen here.
@@ -2453,14 +2453,24 @@ fn read_file_head(path: &Path, max_bytes: usize) -> std::io::Result<String> {
 ///   `…/nub/store/v1`). Skipped when no home directory resolves — the
 ///   engine then falls back to its own default, which fails the same way
 ///   nub would.
-/// - `cacheDir` is still NOT set here — the engine cache moves through the
-///   `aube::set_cache_root` registration in [`engine_brand_preflight`]
-///   instead. The settings accessor (`resolved_cache_dir`) only consults
-///   the setting when `.npmrc` sets it *explicitly* (the embedder-defaults
-///   tier never reaches it, verified empirically 2026-06-09), and the
-///   non-settings consumers (git clone cache, node-gyp tool cache, primer,
-///   adaptive state) never read the setting at all; the process-global
-///   cache root covers every one of them.
+/// - `cacheDir` is still NOT set here, and does not need to be: the DEFAULT
+///   location comes from the identity profile's `cache_namespace`
+///   (`$XDG_CACHE/nub/pm`), which is where the engine's own
+///   `aube_store::dirs::cache_dir()` lands. The setting layers a user
+///   OVERRIDE on top of that default and resolves through the full chain —
+///   `NUB_CACHE_DIR` / `npm_config_cache_dir` / `.npmrc cache-dir` all reach
+///   `resolved_cache_dir`, embedder defaults included. (Both halves of this
+///   bullet used to say otherwise: an `.npmrc`-only presence gate in front of
+///   the accessor made every other source inert until it was dropped by the
+///   v1.35.0 engine sync (#621), and the host-branded `NUB_CACHE_DIR` reached
+///   only the resolver primer until #654. `nub_setting_defaults` is pinned by
+///   `pm_env_matrix::cache_dir_env_moves_the_pm_cache`.) The handful of
+///   non-settings consumers that deliberately stay on the platform default
+///   regardless — the OSV advisory mirror, the bootstrapped node-gyp, git
+///   clones, and the global-links registry behind `link -g` — are documented
+///   as such on the setting itself. This is the third copy of that list, after
+///   `settings.toml`'s `cacheDir` docs and the install docs page; nothing
+///   checks that they agree, so a consumer added to one belongs in all three.
 /// - `defaultTrust=true` — the gated default-trust floor (curated list ∧
 ///   registry-resolved ∧ OSV MAL-* gate active ∧ past the cooling window)
 ///   is ON under nub in both modes; upstream aube keeps it off. Precedence

crates/nub-cli/src/pm_engine/store_config_family.rs

@@ -14,11 +14,14 @@
 //! - `store path` prints the *resolved* store-version dir on stdout — under
 //!   nub's embedder defaults that is `$XDG_DATA_HOME/nub/store/v1` (data,
 //!   not a diagnostic; already nub-named via the `storeDir` default).
-//! - KNOWN GAP (inherited — see `super::nub_setting_defaults`): `cache`
-//!   operates on the engine's packument cache at `<XDG_CACHE_HOME>/aube/…`
-//!   because `cacheDir` can't ride the embedder-defaults tier at the pinned
-//!   API. Paths printed by `cache view --json` / `cache delete` are real
-//!   on-disk paths, which the rewrite policy deliberately preserves.
+//! - `cache` operates on the engine's packument cache under the RESOLVED
+//!   `cacheDir` — `<XDG_CACHE_HOME>/nub/pm/packuments-*` by default (the
+//!   identity's `cache_namespace`), or wherever `NUB_CACHE_DIR` /
+//!   `npm_config_cache_dir` / `.npmrc cache-dir` points it. That makes
+//!   `cache list` the cheapest read-side proof of which cache directory the
+//!   engine resolved, which is how `pm_env_matrix` pins it. Paths printed by
+//!   `cache view --json` / `cache delete` are real on-disk paths, which the
+//!   rewrite policy deliberately preserves.
 //! - `config` write routing is pnpm-VERSION-AWARE (decision 2026-06-20,
 //!   supersedes the earlier "npmrc-first" routing; **no `config.toml`, ever**).
 //!   The config home for non-layout SCALAR settings is pnpm-version-dependent —