Two plugin delivery paths diverge in memstack

I needed to understand why a hook change in plugin 3.7.0 wasn't reaching customers.

Two independent update channels

Memstack ships code through two completely separate paths. Free skills and hooks ship via the marketplace clone at ~/.claude/plugins/marketplaces/<name>/, then install to a versioned cache at ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/ keyed on the plugin.json version string. Pro skills ship via a bundle probe that hashes only the bytes in adminstack/src/data/pro-skills/. The two paths share no version signal.

The original bug report claimed the hook wouldn't ship because the bundle version hash reads SKILL.md files. I traced computeBundleVersion and confirmed it reads only the Pro skills directory, so it never sees the free repo at all.

The loader sees a different copy than Claude Code

The MCP loader indexes skills from the marketplace clone (it's candidate 1 in config.py:92-98). Claude Code loads hooks and namespaced skills from the versioned cache. Two copies, two different update commands. They can diverge.

No automatic delivery for hooks

Nothing in memstack notifies customers of a plugin update. Third-party marketplace auto-update is off by default per Anthropic docs. Hooks and free skills have no push mechanism to a passive customer.

I wrote docs/DELIVERY.md to document both paths side by side with version levers, customer impact table, and six identified gaps. It shipped in commit add1007. I narrowed ARCHITECTURE_DISTRIBUTION.md in the loader repo to Pro bundle internals only and added a scope banner.

Client-side tier enforcement

While mapping the Pro bundle path I found that authenticateLicenseKey selects tier but never checks it. It verifies only is_active and expires_at. Tier enforcement lives entirely in the loader client. I documented this in adminstack/docs/pro-bundle-authz.md but haven't committed it yet because the repro instructions reference a staging environment that doesn't exist.