
The first paying customer could not activate. The server accepted every
attempt; the key simply was not there after a reload, and the site asked him to
activate again.

### Fixed
- **A stored licence key could vanish on the next request.** When a site has no
  `AUTH_KEY` or `SECURE_AUTH_KEY`, encryption derives its key from a random
  value stored in an option. That write was never checked. If it does not
  persist — an object cache that drops it, a plugin that blocks the write — the
  next request generates another key, so anything encrypted with the first one
  decrypts to nothing. The licence key disappears, silently, and activation
  undoes itself. The fallback key is now read back after writing, and encryption
  reports itself unavailable rather than producing values nobody can read.
  (`class-encryption.php`)
- **Saving a secret now proves the round trip.** `save_option()` trusted
  `update_option()`, which answers false for an unchanged value and true for a
  write an object cache may not have kept. It reads the value back and compares
  before reporting success.
- **Activation no longer reports success when the key was not stored.** The
  result of saving the key was discarded, so the status was written as active
  while nothing had been persisted: the screen said activated, the next check
  had no key to send, and the site fell back to inactive. The user is told what
  went wrong, once, instead of watching it undo itself.
  (`class-license.php`)

### Notes
- Verified on real WordPress in Playground: encrypt, save, read back, twice in a
  row, all intact.

---

