Plugin update can leave installed_plugins.json pointing at the previous version after cache extraction

Summary

Observed at least once today: /plugin update extracted a new version into the cache directory (~/.claude/plugins/cache/<marketplace>/<plugin>/<new-version>/) but installed_plugins.json's installPath and version fields still referenced the previous version. A second /plugin update was required to flip the pointer.

Environment

• Claude Code version: 2.1.136
• Platform: macOS 24.6.0
• Plugin: cleos-connector@cleos-labs (custom marketplace, npm-style version bumps)

Observation

After a sequence of /plugin update invocations bumping cleos-connector from 2.0.1 → 2.0.5, I observed at one point:

~/.claude/plugins/cache/cleos-labs/cleos-connector/
├── 2.0.1/
├── 2.0.2/
└── 2.0.3/      ← extracted (most recent at the time)

~/.claude/plugins/installed_plugins.json
{
  "cleos-connector@cleos-labs": [{
    "installPath": ".../2.0.2",      ← still points at previous
    "version": "2.0.2",
    ...
  }]
}

After running /plugin update again with no source change, the pointer flipped to 2.0.3.

Expected

/plugin update is atomic from the user's perspective: either it fully completes (cache extracted AND install record updated) or it fails. No intermediate state where cache and install record disagree.

Actual

The cache extraction and installed_plugins.json update appear to be separate non-atomic operations. A failure or race between them leaves the system in a state where the manager reports "already at the latest version" (because installed.version matches published.version) while the cache contains a newer extracted directory that's never used.

Impact

• User runs /plugin update, sees success, but new code never loads
• Diagnosis requires inspecting both the cache directory and installed_plugins.json manually
• Workaround (run /plugin update again) is not discoverable

Reproduction reliability

Intermittent. Occurred at least once during ~5 update cycles today. Likely a race condition under load or specific marketplace timing.