memstack-skill-loader 4.15.0__tar.gz → 4.15.1__tar.gz

{memstack_skill_loader-4.15.0/src/memstack_skill_loader.egg-info → memstack_skill_loader-4.15.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memstack-skill-loader
-Version: 4.15.0
+Version: 4.15.1
 Summary: MCP server that vector-indexes MemStack Pro skills for on-demand loading
 Project-URL: Homepage, https://memstack.pro
 Project-URL: Documentation, https://memstack.pro/docs
@@ -72,7 +72,7 @@ activate_license(key="your-key", email="you@example.com")
 ```
 Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 44 Pro skills (86 free + 44 Pro = 130 total). Then type `list skills` to verify.
 
-> **The first start is slow, and that is normal.** On the very first run after installing or upgrading, the server builds the skill index before it answers anything. Expect roughly a minute, nearly all of it loading the embedding model rather than reading your skills. **The server will look unresponsive for that time.** Let it finish. Every later start reuses the index and is not affected.
+> **The first start is slow, and that is normal.** On the very first run after installing or upgrading, the server builds the skill index before it answers anything. Nearly all of that time is a one-time download of the ~90 MB embedding model, so it tracks your network speed rather than the size of your skill library: indexing 86 skills itself takes about a second. On a fast connection the whole first start is around half a minute; on a slow one it is longer. **The server will look unresponsive for that time.** Let it finish. Every later start reuses the cached model and index and is not affected.
 
 > To override the skills path, set `MEMSTACK_SKILLS_DIR=/path/to/your/memstack/skills`.
 
@@ -80,7 +80,7 @@ Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://
 
 ## Troubleshooting
 
-**Nothing responds after a fresh install, and it does not seem to be failing either (during Step 4):** the first start builds the skill index before the server answers anything, which takes roughly a minute. Most of that is loading the embedding model, not reading your skills. There is no progress output, so a working first start and a hung one look identical. Wait it out before changing anything. If it is still silent well past a couple of minutes, then treat it as the interpreter mismatch below. Later starts reuse the index and respond immediately.
+**Nothing responds after a fresh install, and it does not seem to be failing either (during Step 4):** the first start builds the skill index before the server answers anything. Most of that is a one-time ~90 MB embedding-model download, not reading your skills, so the wait depends on your connection: around half a minute on a fast one, longer on a slow one. There is no progress output, so a working first start and a hung one look identical. Wait it out before changing anything. If it is still silent well past a few minutes, then treat it as the interpreter mismatch below. Later starts reuse the cached model and index and respond immediately.
 
 **`error: externally-managed-environment` (during Step 2)** — pip refuses to install on a system-managed Python. Add `--break-system-packages` · (in terminal):
 ```bash
@@ -111,7 +111,7 @@ MCP server that vector-indexes all 130 MemStack™ skills so Claude Code can cal
 
 - **No Anthropic API key required:** skill search and indexing run locally and never leave your machine. Three small calls happen on their own at session start — license validation, a Pro-bundle version probe, and a PyPI update check — and every other outbound call is one you trigger ([Data and privacy](#data-and-privacy))
 - **Pro skills auto-detected:** once activated, the Pro skills directory is added to your sources automatically, with no `config.json` edit
-- **Auto-reindex on start:** skills stay current without manual rebuilds. Only startup ever rebuilds, never a search. The first start pays a one-time build of roughly a minute; after that a rebuild happens in the background while the existing index keeps serving, so later starts are not delayed
+- **Auto-reindex on start:** skills stay current without manual rebuilds. Only startup ever rebuilds, never a search. The first start pays a one-time build dominated by the embedding-model download (see [Quick Start](#quick-start-5-minutes)); after that a rebuild happens in the background while the existing index keeps serving, so later starts are not delayed
 - **Memory Engine:** an append-only, versioned fact store with query-time recall scoring — facts decay with age and decay more slowly the more they are recalled. Facts flow in from the diary's `## FACTS` block and are exposed to Claude through five `mem_*` tools (see [Available Tools](#available-tools))
 - **Living memory at session start:** the SessionStart hook injects a compact, token-budgeted digest of the project's top recall-scored facts into context. It fails open — a missing, empty, or unreachable store never blocks startup
 - **8-page localhost dashboard:** Overview, Skills Manager, Burn Report, Memory Browser (project-aware diary reader), Memory Inspector (read-only Memory Engine fact views), Agent Monitor, Referrals, and Settings
@@ -248,9 +248,15 @@ The `pattern` field controls how skills are discovered:
 
 ## Release Notes
 
+### 4.15.1 (August 2026)
+
+- **Fixed: activating a Pro license on a PyPI install downloaded the Pro skills and never indexed them.** The skills landed in `~/.memstack/pro-skills`, activation reported success, and the catalog still showed only the 86 free skills. Setting `MEMSTACK_PRO_LICENSE_KEY` was the only workaround. Both of the paths that decide whether to attach the Pro source now share one predicate.
+- **Activation now takes effect immediately.** The reindex that follows an activation rebuilds with the Pro skills included, and the confirmation reports the post-activation count, so a restart is no longer needed.
+- First-start timing in these docs was reworded: it is dominated by a one-time embedding-model download and therefore varies with network speed, rather than being the fixed "roughly a minute" previously quoted.
+
 ### 4.15.0 (August 2026)
 
-- The skill index moved to the canonical state root, so a relative `vector_db_path` no longer depends on which directory the server happened to start in. **The first start after installing or upgrading rebuilds the index once, which takes roughly a minute**, nearly all of it loading the embedding model. Later starts are unaffected.
+- The skill index moved to the canonical state root, so a relative `vector_db_path` no longer depends on which directory the server happened to start in. **The first start after installing or upgrading rebuilds the index once**, nearly all of that time being a one-time embedding-model download. Later starts are unaffected.
 - New index guard classifies the index as current, drift, stale, absent, or rebuilding, and reports that verdict at startup and in the dashboard. Only startup may rebuild on its own, so no search request ever blocks on one.
 - Agent Runner git policy rewritten as an argv-level classifier, replacing a substring match that could not tell `git status` from `git push`.
 

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1}/README.md

@@ -55,7 +55,7 @@ activate_license(key="your-key", email="you@example.com")
 ```
 Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 44 Pro skills (86 free + 44 Pro = 130 total). Then type `list skills` to verify.
 
-> **The first start is slow, and that is normal.** On the very first run after installing or upgrading, the server builds the skill index before it answers anything. Expect roughly a minute, nearly all of it loading the embedding model rather than reading your skills. **The server will look unresponsive for that time.** Let it finish. Every later start reuses the index and is not affected.
+> **The first start is slow, and that is normal.** On the very first run after installing or upgrading, the server builds the skill index before it answers anything. Nearly all of that time is a one-time download of the ~90 MB embedding model, so it tracks your network speed rather than the size of your skill library: indexing 86 skills itself takes about a second. On a fast connection the whole first start is around half a minute; on a slow one it is longer. **The server will look unresponsive for that time.** Let it finish. Every later start reuses the cached model and index and is not affected.
 
 > To override the skills path, set `MEMSTACK_SKILLS_DIR=/path/to/your/memstack/skills`.
 
@@ -63,7 +63,7 @@ Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://
 
 ## Troubleshooting
 
-**Nothing responds after a fresh install, and it does not seem to be failing either (during Step 4):** the first start builds the skill index before the server answers anything, which takes roughly a minute. Most of that is loading the embedding model, not reading your skills. There is no progress output, so a working first start and a hung one look identical. Wait it out before changing anything. If it is still silent well past a couple of minutes, then treat it as the interpreter mismatch below. Later starts reuse the index and respond immediately.
+**Nothing responds after a fresh install, and it does not seem to be failing either (during Step 4):** the first start builds the skill index before the server answers anything. Most of that is a one-time ~90 MB embedding-model download, not reading your skills, so the wait depends on your connection: around half a minute on a fast one, longer on a slow one. There is no progress output, so a working first start and a hung one look identical. Wait it out before changing anything. If it is still silent well past a few minutes, then treat it as the interpreter mismatch below. Later starts reuse the cached model and index and respond immediately.
 
 **`error: externally-managed-environment` (during Step 2)** — pip refuses to install on a system-managed Python. Add `--break-system-packages` · (in terminal):
 ```bash
@@ -94,7 +94,7 @@ MCP server that vector-indexes all 130 MemStack™ skills so Claude Code can cal
 
 - **No Anthropic API key required:** skill search and indexing run locally and never leave your machine. Three small calls happen on their own at session start — license validation, a Pro-bundle version probe, and a PyPI update check — and every other outbound call is one you trigger ([Data and privacy](#data-and-privacy))
 - **Pro skills auto-detected:** once activated, the Pro skills directory is added to your sources automatically, with no `config.json` edit
-- **Auto-reindex on start:** skills stay current without manual rebuilds. Only startup ever rebuilds, never a search. The first start pays a one-time build of roughly a minute; after that a rebuild happens in the background while the existing index keeps serving, so later starts are not delayed
+- **Auto-reindex on start:** skills stay current without manual rebuilds. Only startup ever rebuilds, never a search. The first start pays a one-time build dominated by the embedding-model download (see [Quick Start](#quick-start-5-minutes)); after that a rebuild happens in the background while the existing index keeps serving, so later starts are not delayed
 - **Memory Engine:** an append-only, versioned fact store with query-time recall scoring — facts decay with age and decay more slowly the more they are recalled. Facts flow in from the diary's `## FACTS` block and are exposed to Claude through five `mem_*` tools (see [Available Tools](#available-tools))
 - **Living memory at session start:** the SessionStart hook injects a compact, token-budgeted digest of the project's top recall-scored facts into context. It fails open — a missing, empty, or unreachable store never blocks startup
 - **8-page localhost dashboard:** Overview, Skills Manager, Burn Report, Memory Browser (project-aware diary reader), Memory Inspector (read-only Memory Engine fact views), Agent Monitor, Referrals, and Settings
@@ -231,9 +231,15 @@ The `pattern` field controls how skills are discovered:
 
 ## Release Notes
 
+### 4.15.1 (August 2026)
+
+- **Fixed: activating a Pro license on a PyPI install downloaded the Pro skills and never indexed them.** The skills landed in `~/.memstack/pro-skills`, activation reported success, and the catalog still showed only the 86 free skills. Setting `MEMSTACK_PRO_LICENSE_KEY` was the only workaround. Both of the paths that decide whether to attach the Pro source now share one predicate.
+- **Activation now takes effect immediately.** The reindex that follows an activation rebuilds with the Pro skills included, and the confirmation reports the post-activation count, so a restart is no longer needed.
+- First-start timing in these docs was reworded: it is dominated by a one-time embedding-model download and therefore varies with network speed, rather than being the fixed "roughly a minute" previously quoted.
+
 ### 4.15.0 (August 2026)
 
-- The skill index moved to the canonical state root, so a relative `vector_db_path` no longer depends on which directory the server happened to start in. **The first start after installing or upgrading rebuilds the index once, which takes roughly a minute**, nearly all of it loading the embedding model. Later starts are unaffected.
+- The skill index moved to the canonical state root, so a relative `vector_db_path` no longer depends on which directory the server happened to start in. **The first start after installing or upgrading rebuilds the index once**, nearly all of that time being a one-time embedding-model download. Later starts are unaffected.
 - New index guard classifies the index as current, drift, stale, absent, or rebuilding, and reports that verdict at startup and in the dashboard. Only startup may rebuild on its own, so no search request ever blocks on one.
 - Agent Runner git policy rewritten as an argv-level classifier, replacing a substring match that could not tell `git status` from `git push`.
 

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memstack-skill-loader"
-version = "4.15.0"
+version = "4.15.1"
 description = "MCP server that vector-indexes MemStack Pro skills for on-demand loading"
 readme = "README.md"
 requires-python = ">=3.10"

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1}/src/memstack_skill_loader/__init__.py

@@ -1,3 +1,3 @@
 """MemStack Skill Loader — MCP server for semantic skill search."""
 
-__version__ = "4.15.0"
+__version__ = "4.15.1"

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1}/src/memstack_skill_loader/config.py

@@ -126,6 +126,32 @@ def _auto_discover_skills() -> SkillSource | None:
     return None
 
 
+def _pro_license_present() -> bool:
+    """Return True if this installation has a Pro license on either supported path.
+
+    Both call sites in load_config must ask this question the same way. They did
+    not: the env-var-only form was written once, copied into the auto-discovery
+    branch, and then fixed in only one of the two copies (07676eb, 2026-05-20).
+    For the two and a half months after that, every PyPI install (which always
+    takes the auto-discovery branch, because a wheel has no config.json beside
+    the package) downloaded Pro skills on activation and never indexed them.
+    Keep this predicate the single source of truth so a third copy cannot drift.
+
+    The env var and license.json are both first-class: license.json is the
+    documented primary path (activate_license writes it), and the env var is the
+    documented alternative. This mirrors get_license_key() in license.py, which
+    has always resolved both.
+
+    Note this answers "is a license present", not "is it valid". Entitlement is
+    enforced at serve time against a live validate_license() call, so a stale
+    license.json here only affects what gets indexed, never what a caller is
+    allowed to read.
+    """
+    if os.environ.get("MEMSTACK_PRO_LICENSE_KEY"):
+        return True
+    return (Path.home() / ".memstack" / "license.json").exists()
+
+
 def load_config(config_path: Path | None = None) -> Config:
     """Load config from JSON file. Falls back to auto-discovery if not found."""
     if config_path is None:
@@ -138,7 +164,7 @@ def load_config(config_path: Path | None = None) -> Config:
             auto_reindex_on_start=True,
             config_source="auto-discovery",
         )
-        if os.environ.get("MEMSTACK_PRO_LICENSE_KEY"):
+        if _pro_license_present():
             config = config.with_pro_skills()
         return config
 
@@ -184,7 +210,7 @@ def load_config(config_path: Path | None = None) -> Config:
     )
 
     # Auto-detect pro-skills if license key is set (env var or license.json)
-    if os.environ.get("MEMSTACK_PRO_LICENSE_KEY") or (Path.home() / ".memstack" / "license.json").exists():
+    if _pro_license_present():
         config = config.with_pro_skills()
 
     return config

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1}/src/memstack_skill_loader/server.py

@@ -465,6 +465,25 @@ def _get_config():
     return _config
 
 
+def _reset_config():
+    """Drop the cached config, re-resolve it, and return the new one.
+
+    The config is resolved once per process, which is correct for everything
+    except activation: activate_license writes license.json and downloads the
+    Pro skills *after* startup has already decided whether this installation
+    has a Pro source. Without re-resolving, the reindex that follows an
+    activation rebuilds from the pre-activation source list and the customer is
+    told a pre-activation skill count, then has to restart to actually get what
+    they just paid for.
+
+    Callers must rebind their own local: _handle_tool binds ``config`` once at
+    entry, so mutating the global alone would not change what that frame sees.
+    """
+    global _config
+    _config = None
+    return _get_config()
+
+
 _INDEX_ABSENT = "absent"
 _INDEX_UNREADABLE = "unreadable"
 _INDEX_EMPTY = "empty"
@@ -1336,6 +1355,15 @@ async def _handle_tool(name: str, arguments: dict) -> list[TextContent]:
                         "Please try again or contact support@memstack.pro",
                         file=sys.stderr,
                     )
+                # save_license_key and the download above changed what
+                # load_config would answer, but this frame's `config` was
+                # resolved at startup, before either had happened. Re-resolve
+                # before indexing so the rebuild below picks up the Pro source
+                # and the total reported back is the post-activation one.
+                # Safe on the download-failure path too: with_pro_skills is
+                # gated on the directory existing, so a failed download simply
+                # yields the same config as before rather than a false count.
+                config = _reset_config()
                 from .indexer import build_index
                 await asyncio.to_thread(build_index, config)
                 reset_cache()

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1/src/memstack_skill_loader.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memstack-skill-loader
-Version: 4.15.0
+Version: 4.15.1
 Summary: MCP server that vector-indexes MemStack Pro skills for on-demand loading
 Project-URL: Homepage, https://memstack.pro
 Project-URL: Documentation, https://memstack.pro/docs
@@ -72,7 +72,7 @@ activate_license(key="your-key", email="you@example.com")
 ```
 Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 44 Pro skills (86 free + 44 Pro = 130 total). Then type `list skills` to verify.
 
-> **The first start is slow, and that is normal.** On the very first run after installing or upgrading, the server builds the skill index before it answers anything. Expect roughly a minute, nearly all of it loading the embedding model rather than reading your skills. **The server will look unresponsive for that time.** Let it finish. Every later start reuses the index and is not affected.
+> **The first start is slow, and that is normal.** On the very first run after installing or upgrading, the server builds the skill index before it answers anything. Nearly all of that time is a one-time download of the ~90 MB embedding model, so it tracks your network speed rather than the size of your skill library: indexing 86 skills itself takes about a second. On a fast connection the whole first start is around half a minute; on a slow one it is longer. **The server will look unresponsive for that time.** Let it finish. Every later start reuses the cached model and index and is not affected.
 
 > To override the skills path, set `MEMSTACK_SKILLS_DIR=/path/to/your/memstack/skills`.
 
@@ -80,7 +80,7 @@ Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://
 
 ## Troubleshooting
 
-**Nothing responds after a fresh install, and it does not seem to be failing either (during Step 4):** the first start builds the skill index before the server answers anything, which takes roughly a minute. Most of that is loading the embedding model, not reading your skills. There is no progress output, so a working first start and a hung one look identical. Wait it out before changing anything. If it is still silent well past a couple of minutes, then treat it as the interpreter mismatch below. Later starts reuse the index and respond immediately.
+**Nothing responds after a fresh install, and it does not seem to be failing either (during Step 4):** the first start builds the skill index before the server answers anything. Most of that is a one-time ~90 MB embedding-model download, not reading your skills, so the wait depends on your connection: around half a minute on a fast one, longer on a slow one. There is no progress output, so a working first start and a hung one look identical. Wait it out before changing anything. If it is still silent well past a few minutes, then treat it as the interpreter mismatch below. Later starts reuse the cached model and index and respond immediately.
 
 **`error: externally-managed-environment` (during Step 2)** — pip refuses to install on a system-managed Python. Add `--break-system-packages` · (in terminal):
 ```bash
@@ -111,7 +111,7 @@ MCP server that vector-indexes all 130 MemStack™ skills so Claude Code can cal
 
 - **No Anthropic API key required:** skill search and indexing run locally and never leave your machine. Three small calls happen on their own at session start — license validation, a Pro-bundle version probe, and a PyPI update check — and every other outbound call is one you trigger ([Data and privacy](#data-and-privacy))
 - **Pro skills auto-detected:** once activated, the Pro skills directory is added to your sources automatically, with no `config.json` edit
-- **Auto-reindex on start:** skills stay current without manual rebuilds. Only startup ever rebuilds, never a search. The first start pays a one-time build of roughly a minute; after that a rebuild happens in the background while the existing index keeps serving, so later starts are not delayed
+- **Auto-reindex on start:** skills stay current without manual rebuilds. Only startup ever rebuilds, never a search. The first start pays a one-time build dominated by the embedding-model download (see [Quick Start](#quick-start-5-minutes)); after that a rebuild happens in the background while the existing index keeps serving, so later starts are not delayed
 - **Memory Engine:** an append-only, versioned fact store with query-time recall scoring — facts decay with age and decay more slowly the more they are recalled. Facts flow in from the diary's `## FACTS` block and are exposed to Claude through five `mem_*` tools (see [Available Tools](#available-tools))
 - **Living memory at session start:** the SessionStart hook injects a compact, token-budgeted digest of the project's top recall-scored facts into context. It fails open — a missing, empty, or unreachable store never blocks startup
 - **8-page localhost dashboard:** Overview, Skills Manager, Burn Report, Memory Browser (project-aware diary reader), Memory Inspector (read-only Memory Engine fact views), Agent Monitor, Referrals, and Settings
@@ -248,9 +248,15 @@ The `pattern` field controls how skills are discovered:
 
 ## Release Notes
 
+### 4.15.1 (August 2026)
+
+- **Fixed: activating a Pro license on a PyPI install downloaded the Pro skills and never indexed them.** The skills landed in `~/.memstack/pro-skills`, activation reported success, and the catalog still showed only the 86 free skills. Setting `MEMSTACK_PRO_LICENSE_KEY` was the only workaround. Both of the paths that decide whether to attach the Pro source now share one predicate.
+- **Activation now takes effect immediately.** The reindex that follows an activation rebuilds with the Pro skills included, and the confirmation reports the post-activation count, so a restart is no longer needed.
+- First-start timing in these docs was reworded: it is dominated by a one-time embedding-model download and therefore varies with network speed, rather than being the fixed "roughly a minute" previously quoted.
+
 ### 4.15.0 (August 2026)
 
-- The skill index moved to the canonical state root, so a relative `vector_db_path` no longer depends on which directory the server happened to start in. **The first start after installing or upgrading rebuilds the index once, which takes roughly a minute**, nearly all of it loading the embedding model. Later starts are unaffected.
+- The skill index moved to the canonical state root, so a relative `vector_db_path` no longer depends on which directory the server happened to start in. **The first start after installing or upgrading rebuilds the index once**, nearly all of that time being a one-time embedding-model download. Later starts are unaffected.
 - New index guard classifies the index as current, drift, stale, absent, or rebuilding, and reports that verdict at startup and in the dashboard. Only startup may rebuild on its own, so no search request ever blocks on one.
 - Agent Runner git policy rewritten as an argv-level classifier, replacing a substring match that could not tell `git status` from `git push`.
 

{memstack_skill_loader-4.15.0 → memstack_skill_loader-4.15.1}/src/memstack_skill_loader.egg-info/SOURCES.txt

@@ -61,6 +61,7 @@ tests/test_memory_scoring.py
 tests/test_memory_tools.py
 tests/test_pro_compressor.py
 tests/test_pro_skills_update.py
+tests/test_pro_source_resolution.py
 tests/test_project_dir_canonical.py
 tests/test_search_memory.py
 tests/test_session_context.py

memstack_skill_loader-4.15.1/tests/test_pro_source_resolution.py

@@ -0,0 +1,227 @@
+"""Pro skill source resolution must be identical on both load_config branches.
+
+``load_config`` has two exits that each decide whether to attach the Pro skill
+source, and they must answer that question the same way:
+
+  * the **config.json** branch, taken by a dev checkout (a config.json sits
+    beside the package), and
+  * the **auto-discovery** branch, taken by every PyPI install (a wheel has no
+    config.json three levels up from the module).
+
+They drifted. The env-var-only form was written once, copied into the
+auto-discovery branch, and then fixed in only one of the two copies by 07676eb
+(2026-05-20, "startup checks license.json for Pro skills, not just env var").
+For the next two and a half months a paying customer on a PyPI install could run
+``activate_license``, watch the Pro skills download, and never see them indexed,
+because their branch still required an environment variable that the product
+documents as the *alternative* to the license file. 4.15.0 shipped that way.
+
+These tests pin the invariant rather than the implementation: whatever the
+answer is, **both branches must give it**. Every case is parametrised over both,
+so a future third copy of the gate cannot pass here while diverging in practice.
+
+Isolation: HOME/USERPROFILE are redirected to tmp_path and
+MEMSTACK_PRO_LICENSE_KEY is removed, so nothing reads the real ~/.memstack.
+"""
+
+import json
+
+import pytest
+
+from memstack_skill_loader.config import _pro_license_present, load_config
+
+PRO_LABEL = "MemStack Pro"
+
+
+# ── fixtures ──────────────────────────────────────────────────────────────────
+
+
+@pytest.fixture
+def fake_home(tmp_path, monkeypatch):
+    """Redirect Path.home() to tmp_path and guarantee no license env var.
+
+    Both HOME and USERPROFILE are set because Path.home() reads USERPROFILE on
+    Windows and HOME on POSIX; setting one only would make this test pass on one
+    platform and silently no-op on the other.
+    """
+    home = tmp_path / "home"
+    home.mkdir()
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setenv("USERPROFILE", str(home))
+    monkeypatch.delenv("MEMSTACK_PRO_LICENSE_KEY", raising=False)
+    monkeypatch.delenv("MEMSTACK_SKILLS_DIR", raising=False)
+    return home
+
+
+def _write_license(home):
+    """Create ~/.memstack/license.json the way save_license_key would."""
+    memstack = home / ".memstack"
+    memstack.mkdir(parents=True, exist_ok=True)
+    (memstack / "license.json").write_text(json.dumps({"license_key": "TEST-KEY"}))
+
+
+def _write_pro_skills(home):
+    """Create a downloaded ~/.memstack/pro-skills tree with its .complete marker.
+
+    The marker matters: Config.pro_skills_dir only prefers the customer
+    directory when .complete is present, and otherwise falls back to a bundled
+    directory beside the package, which exists in a dev checkout and would make
+    an assertion about *which* directory got attached meaningless.
+    """
+    pro = home / ".memstack" / "pro-skills" / "example-pro-skill"
+    pro.mkdir(parents=True, exist_ok=True)
+    (pro / "SKILL.md").write_text("---\nname: example-pro-skill\n---\nbody\n")
+    (home / ".memstack" / "pro-skills" / ".complete").write_text("")
+    return home / ".memstack" / "pro-skills"
+
+
+def _write_free_skills(home):
+    """Create the plugin-marketplace tree that _auto_discover_skills looks for."""
+    skills = (home / ".claude" / "plugins" / "marketplaces"
+              / "cwinvestments-memstack" / "skills" / "example-free-skill")
+    skills.mkdir(parents=True, exist_ok=True)
+    (skills / "SKILL.md").write_text("---\nname: example-free-skill\n---\nbody\n")
+    return skills.parent
+
+
+def _load(branch, tmp_path, home):
+    """Load config through the requested branch of load_config."""
+    if branch == "auto-discovery":
+        # A path that does not exist forces the auto-discovery exit, which is
+        # what a wheel install always gets.
+        return load_config(tmp_path / "no-such-config.json")
+
+    config_path = tmp_path / "config.json"
+    config_path.write_text(json.dumps({
+        "skill_sources": [{
+            "type": "local",
+            "path": str(_write_free_skills(home)),
+            "pattern": "**/SKILL.md",
+            "label": "MemStack",
+        }],
+    }))
+    return load_config(config_path)
+
+
+def _has_pro(config):
+    return any(s.label == PRO_LABEL for s in config.skill_sources)
+
+
+BRANCHES = ["auto-discovery", "config.json"]
+
+
+# ── 1. the regression: license.json alone must attach the Pro source ──────────
+
+
+@pytest.mark.parametrize("branch", BRANCHES)
+def test_license_json_alone_attaches_pro_source(branch, tmp_path, fake_home):
+    """A license file and no env var is the documented primary path.
+
+    This is the 4.15.0 bug. It passed on config.json and failed on
+    auto-discovery, which is the branch every paying PyPI customer takes.
+    """
+    _write_license(fake_home)
+    _write_free_skills(fake_home)
+    pro_dir = _write_pro_skills(fake_home)
+
+    config = _load(branch, tmp_path, fake_home)
+
+    assert _has_pro(config), (
+        f"{branch} branch did not attach the Pro source with license.json present "
+        f"and no MEMSTACK_PRO_LICENSE_KEY set"
+    )
+    attached = next(s for s in config.skill_sources if s.label == PRO_LABEL)
+    assert str(pro_dir) == attached.path, "attached the wrong pro-skills directory"
+
+
+# ── 2. the env var remains a first-class alternative ─────────────────────────
+
+
+@pytest.mark.parametrize("branch", BRANCHES)
+def test_env_var_alone_attaches_pro_source(branch, tmp_path, fake_home, monkeypatch):
+    """No license.json, env var set: the documented alternative for advanced users."""
+    monkeypatch.setenv("MEMSTACK_PRO_LICENSE_KEY", "TEST-KEY")
+    _write_free_skills(fake_home)
+    _write_pro_skills(fake_home)
+
+    config = _load(branch, tmp_path, fake_home)
+
+    assert not (fake_home / ".memstack" / "license.json").exists()
+    assert _has_pro(config), f"{branch} branch ignored MEMSTACK_PRO_LICENSE_KEY"
+
+
+# ── 3. no license of any kind must NOT attach it ─────────────────────────────
+
+
+@pytest.mark.parametrize("branch", BRANCHES)
+def test_no_license_does_not_attach_pro_source(branch, tmp_path, fake_home):
+    """Absent both signals, the Pro source stays off: the fix must not over-attach."""
+    _write_free_skills(fake_home)
+    _write_pro_skills(fake_home)
+
+    config = _load(branch, tmp_path, fake_home)
+
+    assert not _has_pro(config), (
+        f"{branch} branch attached the Pro source with no license present at all"
+    )
+
+
+# ── 4. the two branches must never disagree ──────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "with_license, with_env",
+    [(True, False), (False, True), (True, True), (False, False)],
+)
+def test_both_branches_always_agree(with_license, with_env, tmp_path, fake_home, monkeypatch):
+    """The invariant the drift violated, stated directly.
+
+    Whatever the gate decides, an installed wheel and a dev checkout must decide
+    it identically. This is the assertion that would have failed in May.
+    """
+    if with_license:
+        _write_license(fake_home)
+    if with_env:
+        monkeypatch.setenv("MEMSTACK_PRO_LICENSE_KEY", "TEST-KEY")
+    _write_free_skills(fake_home)
+    _write_pro_skills(fake_home)
+
+    auto = _has_pro(_load("auto-discovery", tmp_path, fake_home))
+    cfg = _has_pro(_load("config.json", tmp_path, fake_home))
+
+    assert auto == cfg, (
+        f"branches disagree with license={with_license} env={with_env}: "
+        f"auto-discovery={auto} config.json={cfg}"
+    )
+    assert auto is (with_license or with_env)
+
+
+# ── 5. the shared predicate itself ───────────────────────────────────────────
+
+
+def test_predicate_false_when_nothing_present(fake_home):
+    assert _pro_license_present() is False
+
+
+def test_predicate_true_on_license_json(fake_home):
+    _write_license(fake_home)
+    assert _pro_license_present() is True
+
+
+def test_predicate_true_on_env_var(fake_home, monkeypatch):
+    monkeypatch.setenv("MEMSTACK_PRO_LICENSE_KEY", "TEST-KEY")
+    assert _pro_license_present() is True
+
+
+def test_predicate_does_not_validate_the_license(fake_home):
+    """Presence, not validity: entitlement is enforced at serve time.
+
+    Pinned deliberately: a stale license.json still attaches the Pro source, and
+    that is safe only because find_skill/list_skills/get_skill each re-check the
+    live license tier before returning Pro content. If someone ever makes this
+    predicate validate, that is a design change, not a tidy-up.
+    """
+    memstack = fake_home / ".memstack"
+    memstack.mkdir(parents=True, exist_ok=True)
+    (memstack / "license.json").write_text("this is not even valid json")
+    assert _pro_license_present() is True