Licensing: a site_inactive site never borrows the network update package

[jakejackson1]

maybe_apply_network_package() only falls back to the network-shared package when this site's own package is empty:

if ( ! is_multisite() || ! is_object( $version_info ) || ! empty( $version_info->package ) ) {
    return $version_info;
}

An unentitled site doesn't always get an empty one. With no license at all the store returns package: "", but with a valid key whose domain was never activated (site_inactive) it returns a signed URL that 401s — "Your license has not been activated for this domain, please activate it first."

So on a Multisite with the plugin activated per-site, a site_inactive site takes the early return, never borrows the working package another site promoted, and the install fails. That's the case the fallback exists for, and the likelier one: the key tends to be entered on every site while the domain is activated on only some.

set_version_info_cache() already gates the promoting side on is_license_active(), and its comment notes the store "can return a package URL even when the license is inactive (that URL errors on access)". The consuming side just needs the same test:

if ( ! empty( $version_info->package ) && $this->is_license_active() ) {
    return $version_info;
}

Confidence: the code path is read directly from src/Helper/Licensing/EDD_SL_Plugin_Updater.php on development. The 401 was reproduced against a different EDD Software Licensing store, not gravitypdf.com — the error string is EDD SL's stock package_download response, so I'd expect it to match, but I haven't confirmed it against your store.

[jakejackson1]

Correcting the suggested fix above — patching the guard in maybe_apply_network_package() isn't deep enough. It repairs the network fallback, but the dead URL is still cached and still handed to WordPress on a single site, and on a network with nothing to borrow. Either way the update is offered and fails part-way through installing.

Better to drop it at the source, before the response is cached, so a URL known to be dead is never stored:

// in get_version_from_remote(), before set_version_info_cache()
if ( ! $this->is_license_active() ) {
    $response->package       = '';
    $response->download_link = '';
}

download_link matters too: plugins_api_filter() hands the object straight to WordPress, whose plugin-details modal installs from that field rather than from package.

With that in place maybe_apply_network_package() needs no change at all — its existing emptiness test becomes correct, since a package that survives to that point is one the site can actually use.