diff --git a/.changepacks/changepack_log_skills_fetch_first.json b/.changepacks/changepack_log_skills_fetch_first.json
new file mode 100644
index 0000000..933a8b1
--- /dev/null
+++ b/.changepacks/changepack_log_skills_fetch_first.json
@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "crates/devup-mcp/Cargo.toml": "Minor"
+  },
+  "note": "devup_skills install now prefers each embedded skill's current upstream documents and falls back to the copy in the binary when fetching fails. A bare machine is the reason skill delivery exists, and is also where a download is least likely to work, so freshness cannot become an installation prerequisite. The CLI already had an ETag-aware fetcher; it now accepts a URL so the MCP installer can derive each document's address from its manifest repository and path instead of accidentally fetching devup-ui for every skill. The CLI still installs devup-ui to its existing HOME targets. MCP writes stay project-local and use the server's existing OutputPolicy and one OutputTransaction. A four-second budget covers the entire install's fetch work, rather than multiplying a timeout by the number of skills. One failed document falls back to the whole embedded skill, so an updated entry is not paired with old references. Network errors, HTTP errors and missing ETags report an embedded source and the fallback reason without warnings; a 404 additionally warns that the manifest path may have moved. Fetched files cannot claim the vendored commit: their entry note and response reuse sourceUrl, etag, fetchedAt and sha256 provenance, with the digest describing upstream bytes before annotation. The note stays after frontmatter so the installed skill still loads. Own skills still come only from the binary, and external skills are never fetched, written or installed by a shell command. DEVUP_MCP_SKILLS_OFFLINE is read once and bypasses the HTTP client. MCP integration tests set it in child processes before startup, while injected upstreams exercise fetched and failure paths without opening a socket. Status, resource reads and self-check cannot enter the fetch path.",
+  "date": "2026-09-14T13:26:37.677275+00:00"
+}
diff --git a/README.md b/README.md
index 12e310a..cfee845 100644
--- a/README.md
+++ b/README.md
@@ -215,7 +215,7 @@ devup-mcp가 돌려주는 TSX는 **devup-ui 코드**입니다. devup-mcp만 깔
 
 | 스킬 | 출처 | devup-mcp가 하는 일 |
 |---|---|---|
-| `devup-ui` · `vespera` · `vespertide` | dev-five-git (우리 것) | **바이너리에 내장.** `{"action":"install"}`이 네트워크 없이 스킬 디렉터리에 씁니다 |
+| `devup-ui` · `vespera` · `vespertide` | dev-five-git (우리 것) | **바이너리에 내장.** `{"action":"install"}`이 upstream 최신 문서를 우선 가져오고, 실패하면 내장본을 스킬 디렉터리에 씁니다 |
 | `vercel-react-best-practices` · `vercel-react-view-transitions` | vercel-labs/agent-skills | **내장하지 않음.** 설치 명령 `npx skills add vercel-labs/agent-skills`를 넘길 뿐, 실행하지 않습니다 |
 
 vercel 것을 내장하지 않는 이유는 두 가지입니다. **`vercel-labs/agent-skills`에는 LICENSE 파일이 없어** 재배포할 권리가 없고, 그 스킬들은 단일 파일이 아니라 `SKILL.md` + `AGENTS.md` + 규칙 파일 수십 개(합쳐 ~350 KB)라서 애초에 던져줄 물건이 아니라 설치할 물건입니다.
@@ -224,6 +224,12 @@ vercel 것을 내장하지 않는 이유는 두 가지입니다. **`vercel-labs/
 
 설치 위치는 프로젝트 안입니다 — 이미 있는 것을 우선해 `.claude/skills`, `.opencode/skill`, `.agents/skills` 순으로 고릅니다. 프로젝트 루트는 devup-mcp가 쓸 수 있는 유일한 곳이라 새 권한이 필요 없고, 스킬이 저장소를 따라다닙니다. 이미 깔려 있으면 다시 쓰지 않습니다.
 
+설치 응답의 `installed[].source`는 `fetched` 또는 `embedded`이며, 내장본을 썼다면 `reason`도 반환합니다. 가져오기는 manifest의 저장소와 문서 경로에서 만든 `https://raw.githubusercontent.com/REPO/HEAD/PATH`를 사용하며, 호출 전체의 네트워크 대기는 최대 4초입니다. 네트워크 오류, HTTP 오류, ETag 누락은 내장본으로 돌아가고, 404는 upstream 경로가 바뀌었을 수 있으므로 `warnings`에도 알립니다. 여러 문서 중 하나라도 실패하면 그 스킬 전체를 내장본으로 설치합니다.
+
+`DEVUP_MCP_SKILLS_OFFLINE=1`로 서버를 시작하면 가져오기를 생략합니다. 이 설정은 프로세스에서 한 번 읽으며 `0`, `false`, 빈 값은 가져오기를 허용합니다. `own` 스킬은 항상 바이너리에서, `external` 스킬은 여전히 설치 명령 안내만 합니다. `--self-check`와 스킬 resource 읽기, `status`는 가져오기를 실행하지 않습니다. 별도 CLI인 `--install-skills`의 devup-ui/HOME 설치 계약은 그대로입니다.
+
+가져온 문서의 주석은 고정 커밋을 주장하지 않고 URL, 가져온 시각(Unix seconds), ETag, 주석 추가 전 SHA-256을 기록합니다. 응답의 `installed[].documents[].provenance`도 같은 정보를 담습니다. 내장본을 설치하거나 resource로 읽을 때는 기존 커밋 정보를 유지합니다.
+
 내장본은 각 레포의 `SKILL.md`를 그대로 복사한 것이고, 응답과 설치된 파일 모두 **어느 커밋인지와 최신본 URL**을 함께 답니다. 사본은 낡습니다 — 그게 내장의 정직한 비용이고, `node scripts/refresh-skills.mjs`가 그걸 갱신하는 방법입니다(`--check`는 쓰지 않고 드리프트만 보고). 주석은 YAML frontmatter **뒤에** 들어갑니다. `---`는 0번째 바이트에 있어야 로더가 읽습니다.
 
 설치하지 않고 읽기만 하려면 `devup://skill/devup-ui` 리소스도 있습니다. 다만 그건 fallback입니다 — 설치해야 로더가 알아서 꺼내 줍니다.
diff --git a/crates/devup-mcp/src/server/mod.rs b/crates/devup-mcp/src/server/mod.rs
index a575cdd..425cb05 100644
--- a/crates/devup-mcp/src/server/mod.rs
+++ b/crates/devup-mcp/src/server/mod.rs
@@ -913,7 +913,7 @@ impl DevupServer {
         description = "Report which agent skills the code devup-mcp emits depends on and whether this workspace has them, then install the ones devup-mcp carries (action: status | install). \
                        The TSX devup_figma_export returns is devup-ui code, and an agent that has never seen devup-ui does not know its components are compile-time placeholders, that $token means devup.json, or that a style prop takes a responsive array - it guesses, and this server cannot see the guesses. \
                        Call status before writing or editing that code. Anything reported missing is a gap you can close in one step. \
-                       install writes the vendored SKILL.md for devup-ui, vespera and vespertide into the workspace skill root (.claude/skills, .opencode/skill or .agents/skills - an existing one is preferred), with no network. Load them afterwards the way your runtime loads a project skill; an installed skill keeps applying to later sessions, which reading a document once does not. \
+                       install fetches current documents for embedded skills, falling back to the binary on failure, and writes own skills from the binary into the workspace skill root (.claude/skills, .opencode/skill or .agents/skills - an existing one is preferred), reporting source and any fallback reason (DEVUP_MCP_SKILLS_OFFLINE=1 disables fetching). Load them afterwards the way your runtime loads a project skill; an installed skill keeps applying to later sessions, which reading a document once does not. \
                        External skills are reported, never written: devup-mcp hands over its publisher's install command and does not run it.",
         output_schema = permissive_object_output_schema()
     )]
@@ -926,8 +926,9 @@ impl DevupServer {
                 self.output_policy.primary_root(),
             ))),
             "install" => {
-                let outcome =
-                    skills::install(&self.output_policy, &input.names).map_err(to_mcp_error)?;
+                let outcome = skills::install(&self.output_policy, &input.names)
+                    .await
+                    .map_err(to_mcp_error)?;
                 // The state after the write, from the same reader `status`
                 // uses. An install that reports what it meant to do rather than
                 // what is now on disk is the report that cannot be trusted.
diff --git a/crates/devup-mcp/src/server/skills.rs b/crates/devup-mcp/src/server/skills.rs
index 2ea09c9..42c3a9f 100644
--- a/crates/devup-mcp/src/server/skills.rs
+++ b/crates/devup-mcp/src/server/skills.rs
@@ -20,7 +20,8 @@
 //!
 //! `embedded` skills are DevFive's own but live in another repository -
 //! devup-ui, vespera, vespertide. Their canonical `SKILL.md` is vendored into
-//! the binary, so installing them needs no network. That matters because the
+//! the binary as an offline fallback; install prefers current upstream documents.
+//! The fallback matters because the
 //! situation this exists for, a bare machine, is the one in which a download is
 //! least likely to work. A vendored copy can fall behind its repository, so
 //! each one pins the commit it copied and `scripts/refresh-skills.mjs` is how
@@ -47,8 +48,47 @@
 use std::path::{Path, PathBuf};
 use std::sync::LazyLock;
 
+use crate::skills::{RawGithubSkillUpstream, SkillFetchError, SkillProvenance, SkillUpstream};
 use serde::Deserialize;
 
+const FETCH_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(4);
+const OFFLINE_ENV: &str = "DEVUP_MCP_SKILLS_OFFLINE";
+
+// Read once per process. Client construction and fetching happen only on an
+// explicit install, never while constructing a server or running self-check.
+static OFFLINE: LazyLock<bool> = LazyLock::new(|| {
+    std::env::var(OFFLINE_ENV).is_ok_and(|value| {
+        !matches!(
+            value.trim().to_ascii_lowercase().as_str(),
+            "" | "0" | "false"
+        )
+    })
+});
+
+struct InstallUpstream;
+
+#[async_trait::async_trait]
+impl SkillUpstream for InstallUpstream {
+    async fn fetch(
+        &self,
+        source_url: &str,
+    ) -> Result<crate::skills::FetchedSkill, SkillFetchError> {
+        if *OFFLINE {
+            return Err(SkillFetchError::Network(format!(
+                "{OFFLINE_ENV} disables fetching"
+            )));
+        }
+        static UPSTREAM: LazyLock<Result<RawGithubSkillUpstream, String>> = LazyLock::new(|| {
+            RawGithubSkillUpstream::with_timeout(FETCH_TIMEOUT).map_err(|error| error.to_string())
+        });
+        UPSTREAM
+            .as_ref()
+            .map_err(|error| SkillFetchError::Network(error.clone()))?
+            .fetch(source_url)
+            .await
+    }
+}
+
 pub const MIME_TYPE: &str = "text/markdown";
 
 /// The registry. Parsed rather than duplicated into consts so that refreshing a
@@ -336,7 +376,84 @@ pub fn installed_paths(project: &Path, name: &str) -> Vec<PathBuf> {
         .collect()
 }
 
+struct FetchedDocuments {
+    documents: Vec<(&'static str, String)>,
+    provenance: Vec<serde_json::Value>,
+}
+
 impl Skill {
+    /// The manifest's path is either the entry file or the skill directory.
+    /// References live beside that entry, even for nested upstream skills.
+    fn upstream_url(&self, relative: &str) -> String {
+        let path = self.record.path.trim_end_matches('/');
+        let directory = if path == ENTRY_DOCUMENT {
+            ""
+        } else {
+            path.strip_suffix("/SKILL.md").unwrap_or(path)
+        };
+        let document = if directory.is_empty() {
+            relative.to_owned()
+        } else {
+            format!("{directory}/{relative}")
+        };
+        format!(
+            "https://raw.githubusercontent.com/{}/HEAD/{document}",
+            self.record.repo
+        )
+    }
+
+    /// Resolve the complete set before staging any of it. One failed reference
+    /// must not leave a new entry document next to old embedded references.
+    async fn fetch_documents(
+        &self,
+        upstream: &dyn SkillUpstream,
+        deadline: tokio::time::Instant,
+    ) -> Result<FetchedDocuments, (String, SkillFetchError)> {
+        let mut documents = Vec::new();
+        let mut provenance = Vec::new();
+        for (relative, _) in self.texts.expect("only carried skills can be fetched") {
+            let url = self.upstream_url(relative);
+            let timeout_error = || {
+                SkillFetchError::Network(
+                    "the four-second skill install fetch budget elapsed".to_owned(),
+                )
+            };
+            if tokio::time::Instant::now() >= deadline {
+                return Err((url, timeout_error()));
+            }
+            let fetched = tokio::time::timeout_at(deadline, upstream.fetch(&url))
+                .await
+                .unwrap_or_else(|_| Err(timeout_error()))
+                .map_err(|error| (url.clone(), error))?;
+            let text = std::str::from_utf8(&fetched.contents).map_err(|error| {
+                (
+                    url.clone(),
+                    SkillFetchError::Network(format!("upstream document is not UTF-8: {error}")),
+                )
+            })?;
+            let record = SkillProvenance {
+                source_url: url,
+                etag: fetched.etag,
+                fetched_at: std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .unwrap_or_default()
+                    .as_secs(),
+                sha256: crate::skills::sha256(&fetched.contents),
+            };
+            let contents = if *relative == ENTRY_DOCUMENT {
+                self.annotated_with(text, Some(&record))
+            } else {
+                text.to_owned()
+            };
+            documents.push((*relative, contents));
+            provenance.push(serde_json::json!({"path": relative, "provenance": record}));
+        }
+        Ok(FetchedDocuments {
+            documents,
+            provenance,
+        })
+    }
+
     /// The provenance a reader needs alongside the text: which revision this
     /// is, and where the current one lives. Carried in the body rather than
     /// returned beside it, because the installed file outlives this response
@@ -390,7 +507,11 @@ impl Skill {
 
     /// The document with its provenance note placed after any frontmatter.
     fn annotated(&self, text: &str) -> String {
-        let note = self.provenance_note();
+        self.annotated_with(text, None)
+    }
+
+    fn annotated_with(&self, text: &str, fetched: Option<&SkillProvenance>) -> String {
+        let note = self.provenance_note(fetched);
         match frontmatter_end(text) {
             Some(end) => format!("{}\n{note}\n{}", &text[..end], &text[end..]),
             None => format!("{note}\n\n{text}"),
@@ -403,8 +524,18 @@ impl Skill {
     /// An `own` skill gets a different note, not a filled-in version of the
     /// vendored one: it has no upstream commit, and printing "at unknown" would
     /// read as a lost revision rather than as one that never existed.
-    fn provenance_note(&self) -> String {
+    fn provenance_note(&self, fetched: Option<&SkillProvenance>) -> String {
         let r = &self.record;
+        if let Some(p) = fetched {
+            return format!(
+                "<!-- Fetched from {} at {} (Unix seconds).\n     ETag: {}\n     SHA-256 of upstream bytes before annotation: {}\n     Why this matters here: {} -->",
+                p.source_url,
+                p.fetched_at,
+                p.etag.replace("--", "&#45;&#45;"),
+                p.sha256,
+                r.used_for,
+            );
+        }
         if r.origin == Origin::Own {
             return format!(
                 "<!-- Authored in {repo}, at {path}.\n     \
@@ -471,8 +602,7 @@ impl Skill {
                     "action": "devup_skills",
                     "arguments": {"action": "install", "names": [self.record.name]},
                     "writesTo": writes,
-                    "how": "Call devup_skills with action \"install\". The documents are inside this \
-                            binary, so it needs no network. Then load it the way your runtime loads \
+                    "how": "Call devup_skills with action \"install\". Embedded skills prefer current upstream documents with offline fallback; own skills use the binary. Then load it the way your runtime loads \
                             a project skill.",
                     "rootChoice": if roots.is_empty() {
                         format!("No skill root exists yet, so {} is created.", SKILL_ROOTS[0])
@@ -576,9 +706,7 @@ pub fn report(project: &Path) -> serde_json::Value {
                 missing ones, then let your own skill loader surface them - an installed skill \
                 keeps applying for every later session, which is the thing reading a document \
                 once does not do.",
-        "boundary": "devup-mcp installs only what it carries. It does not download anything and \
-                     does not run any install command; for an external skill the command is \
-                     yours to run.",
+        "boundary": "devup-mcp installs only carried skills: embedded skills prefer current upstream documents with offline fallback, and own skills use the binary. External skills are never fetched or written; their install command is yours to run.",
     })
 }
 
@@ -596,9 +724,17 @@ pub fn report(project: &Path) -> serde_json::Value {
 ///
 /// [`OutputPolicy`]: super::output::OutputPolicy
 /// [`OutputTransaction`]: super::output::OutputTransaction
-pub fn install(
+pub async fn install(
     policy: &super::output::OutputPolicy,
     requested: &[String],
+) -> Result<serde_json::Value, devup_mcp_figma::DevupError> {
+    install_with(policy, requested, &InstallUpstream).await
+}
+
+async fn install_with(
+    policy: &super::output::OutputPolicy,
+    requested: &[String],
+    upstream: &dyn SkillUpstream,
 ) -> Result<serde_json::Value, devup_mcp_figma::DevupError> {
     use devup_mcp_figma::{DevupError, ErrorCode};
 
@@ -639,6 +775,9 @@ pub fn install(
     let mut transaction = super::output::OutputTransaction::new();
     let mut written = Vec::new();
     let mut already = Vec::new();
+    let mut warnings = Vec::new();
+    // One budget for the call, not four seconds multiplied by the registry.
+    let deadline = tokio::time::Instant::now() + FETCH_TIMEOUT;
     for skill in wanted
         .iter()
         .filter(|skill| skill.record.origin.is_carried())
@@ -648,9 +787,32 @@ pub fn install(
             already.push(name.clone());
             continue;
         }
-        let documents = skill
+        let mut documents = skill
             .installable_documents()
             .expect("a carried skill always has documents");
+        let mut source = "embedded";
+        let mut reason = Some("authored in this repository; no upstream".to_owned());
+        let mut provenance = Vec::new();
+        if skill.record.origin == Origin::Embedded {
+            match skill.fetch_documents(upstream, deadline).await {
+                Ok(fetched) => {
+                    documents = fetched.documents;
+                    provenance = fetched.provenance;
+                    source = "fetched";
+                    reason = None;
+                }
+                Err((url, error)) => {
+                    reason = Some(format!("{url}: {error}"));
+                    if error == SkillFetchError::NotFound {
+                        warnings.push(serde_json::json!({
+                            "name": name,
+                            "sourceUrl": url,
+                            "message": "Upstream returned 404; the document may have moved. Check the skill manifest. The complete embedded copy was installed.",
+                        }));
+                    }
+                }
+            }
+        }
         let mut paths = Vec::with_capacity(documents.len());
         for (relative, contents) in documents {
             let target =
@@ -662,7 +824,7 @@ pub fn install(
                 contents.as_bytes(),
             )?;
         }
-        written.push(serde_json::json!({"name": name, "paths": paths}));
+        written.push(serde_json::json!({"name": name, "paths": paths, "source": source, "reason": reason, "documents": provenance}));
     }
     transaction.commit()?;
 
@@ -670,6 +832,7 @@ pub fn install(
         "installed": written,
         "alreadyPresent": already,
         "notInstallable": external,
+        "warnings": warnings,
         "root": root.display().to_string(),
         "nextAction": if written.is_empty() && external.is_empty() {
             serde_json::Value::Null
@@ -680,16 +843,35 @@ pub fn install(
                         devup_skills again to confirm the state changed.",
             })
         },
-        "boundary": "Only the documents devup-mcp carries were written. Nothing was downloaded \
-                     and no install command was executed.",
+        "boundary": "Only carried skills were written, using current upstream documents where available or the embedded copy. External skills were not fetched or written, and no install command was executed.",
     }))
 }
 
+#[cfg(test)]
+#[path = "skills/fetch_tests.rs"]
+mod fetch_tests;
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use sha2::{Digest, Sha256};
 
+    #[tokio::test]
+    async fn an_own_install_reports_the_binary_as_its_source() {
+        let project = scratch("own-source");
+        let policy = super::super::output::OutputPolicy::from_roots(vec![project.clone()]).unwrap();
+        let report = install(&policy, &["devfive-frontend".to_owned()])
+            .await
+            .unwrap();
+        assert_eq!(report["installed"][0]["source"], "embedded");
+        assert_eq!(
+            report["installed"][0]["reason"],
+            "authored in this repository; no upstream"
+        );
+        drop(policy);
+        std::fs::remove_dir_all(project).unwrap();
+    }
+
     fn scratch(label: &str) -> PathBuf {
         let path =
             std::env::temp_dir().join(format!("devup-skills-{label}-{}", std::process::id()));
diff --git a/crates/devup-mcp/src/server/skills/fetch_tests.rs b/crates/devup-mcp/src/server/skills/fetch_tests.rs
new file mode 100644
index 0000000..b55cb5c
--- /dev/null
+++ b/crates/devup-mcp/src/server/skills/fetch_tests.rs
@@ -0,0 +1,258 @@
+use super::*;
+use crate::skills::{FetchedSkill, SkillFetchError, SkillUpstream};
+use async_trait::async_trait;
+use std::sync::Mutex;
+
+struct FakeUpstream {
+    result: Result<FetchedSkill, SkillFetchError>,
+    urls: Mutex<Vec<String>>,
+}
+
+impl FakeUpstream {
+    fn new(result: Result<FetchedSkill, SkillFetchError>) -> Self {
+        Self {
+            result,
+            urls: Mutex::new(Vec::new()),
+        }
+    }
+}
+
+#[async_trait]
+impl SkillUpstream for FakeUpstream {
+    async fn fetch(&self, url: &str) -> Result<FetchedSkill, SkillFetchError> {
+        self.urls.lock().unwrap().push(url.to_owned());
+        self.result.clone()
+    }
+}
+
+fn policy(label: &str) -> (PathBuf, super::super::output::OutputPolicy) {
+    let project = std::env::temp_dir().join(format!(
+        "devup-fetch-{label}-{}-{}",
+        std::process::id(),
+        rand::random::<u64>()
+    ));
+    std::fs::create_dir_all(&project).unwrap();
+    let policy = super::super::output::OutputPolicy::from_roots(vec![project.clone()]).unwrap();
+    (project, policy)
+}
+
+#[tokio::test]
+async fn fetched_documents_report_their_real_provenance_and_manifest_url() {
+    let (project, policy) = policy("fetched");
+    let text = "---\nname: latest\n---\n# Current upstream rules\n";
+    let upstream = FakeUpstream::new(Ok(FetchedSkill {
+        contents: text.as_bytes().to_vec(),
+        etag: "\"latest\"".to_owned(),
+    }));
+    let result = install_with(&policy, &["vespera".to_owned()], &upstream)
+        .await
+        .unwrap();
+    let written = &result["installed"][0];
+    assert_eq!(written["source"], "fetched");
+    assert!(written["reason"].is_null());
+    assert!(result["warnings"].as_array().unwrap().is_empty());
+    let url = "https://raw.githubusercontent.com/dev-five-git/vespera/HEAD/SKILL.md";
+    assert_eq!(*upstream.urls.lock().unwrap(), vec![url]);
+    let provenance = &written["documents"][0]["provenance"];
+    assert_eq!(provenance["sourceUrl"], url);
+    assert_eq!(provenance["etag"], "\"latest\"");
+    assert!(provenance["fetchedAt"].as_u64().unwrap() > 0);
+    assert_eq!(provenance["sha256"], crate::skills::sha256(text.as_bytes()));
+    let body = std::fs::read_to_string(written["paths"][0].as_str().unwrap()).unwrap();
+    assert!(body.starts_with("---\nname: latest\n---\n"));
+    assert!(body.contains(&format!("Fetched from {url}")));
+    assert!(body.contains(provenance["sha256"].as_str().unwrap()));
+    assert!(body.contains(&provenance["fetchedAt"].to_string()));
+    assert!(!body.contains("Vendored from"));
+    assert!(body.ends_with("# Current upstream rules\n"));
+    let again = install_with(&policy, &["vespera".to_owned()], &upstream)
+        .await
+        .unwrap();
+    assert_eq!(again["alreadyPresent"][0], "vespera");
+    assert_eq!(upstream.urls.lock().unwrap().len(), 1);
+    drop(policy);
+    std::fs::remove_dir_all(project).unwrap();
+}
+
+#[tokio::test]
+async fn every_fetch_failure_installs_embedded_but_only_404_warns() {
+    for error in [
+        SkillFetchError::Network("offline".to_owned()),
+        SkillFetchError::HttpStatus(503),
+        SkillFetchError::MissingEtag,
+        SkillFetchError::NotFound,
+    ] {
+        let (project, policy) = policy("fallback");
+        let upstream = FakeUpstream::new(Err(error.clone()));
+        let result = install_with(&policy, &["devup-ui".to_owned()], &upstream)
+            .await
+            .unwrap();
+        let written = &result["installed"][0];
+        assert_eq!(written["source"], "embedded");
+        assert!(
+            written["reason"]
+                .as_str()
+                .unwrap()
+                .contains(&error.to_string())
+        );
+        let warnings = result["warnings"].as_array().unwrap();
+        assert_eq!(
+            warnings.len(),
+            usize::from(error == SkillFetchError::NotFound)
+        );
+        if error == SkillFetchError::NotFound {
+            assert!(
+                warnings[0]["message"]
+                    .as_str()
+                    .unwrap()
+                    .contains("manifest")
+            );
+            assert_eq!(warnings[0]["name"], "devup-ui");
+            assert!(
+                warnings[0]["sourceUrl"]
+                    .as_str()
+                    .unwrap()
+                    .ends_with("/devup-ui/HEAD/SKILL.md")
+            );
+        }
+        assert_eq!(
+            std::fs::read_to_string(written["paths"][0].as_str().unwrap()).unwrap(),
+            find_by_name("devup-ui").unwrap().document().unwrap()
+        );
+        drop(policy);
+        std::fs::remove_dir_all(project).unwrap();
+    }
+}
+
+#[tokio::test]
+async fn own_external_and_unknown_skills_never_fetch() {
+    let (project, policy) = policy("origins");
+    let upstream = FakeUpstream::new(Err(SkillFetchError::NotFound));
+    let result = install_with(
+        &policy,
+        &[
+            "devfive-frontend".to_owned(),
+            "vercel-react-best-practices".to_owned(),
+        ],
+        &upstream,
+    )
+    .await
+    .unwrap();
+    assert_eq!(result["installed"][0]["source"], "embedded");
+    assert_eq!(result["installed"][0]["paths"].as_array().unwrap().len(), 5);
+    assert_eq!(
+        result["notInstallable"][0]["name"],
+        "vercel-react-best-practices"
+    );
+    assert!(result["warnings"].as_array().unwrap().is_empty());
+    assert!(
+        install_with(&policy, &["unknown".to_owned()], &upstream)
+            .await
+            .is_err()
+    );
+    assert!(upstream.urls.lock().unwrap().is_empty());
+    drop(policy);
+    std::fs::remove_dir_all(project).unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn the_entire_install_has_one_four_second_fetch_budget() {
+    struct Stalled;
+    #[async_trait]
+    impl SkillUpstream for Stalled {
+        async fn fetch(&self, _: &str) -> Result<FetchedSkill, SkillFetchError> {
+            std::future::pending().await
+        }
+    }
+    let (project, policy) = policy("timeout");
+    let start = tokio::time::Instant::now();
+    let result = install_with(&policy, &[], &Stalled).await.unwrap();
+    assert_eq!(start.elapsed(), std::time::Duration::from_secs(4));
+    for written in result["installed"].as_array().unwrap() {
+        assert_eq!(written["source"], "embedded");
+    }
+    assert!(result["warnings"].as_array().unwrap().is_empty());
+    drop(policy);
+    std::fs::remove_dir_all(project).unwrap();
+}
+
+#[tokio::test]
+async fn nested_upstream_documents_are_fetched_whole_and_references_stay_byte_exact() {
+    let mut record = find_by_name("devup-ui").unwrap().record.clone();
+    record.path = "skills/example/SKILL.md".to_owned();
+    let skill = Skill {
+        record,
+        uri: "test".to_owned(),
+        resource_name: "test".to_owned(),
+        texts: Some(&[
+            ("SKILL.md", "# old entry"),
+            ("references/rules.md", "old rules"),
+        ]),
+    };
+    let upstream = FakeUpstream::new(Ok(FetchedSkill {
+        contents: b"# current\n".to_vec(),
+        etag: "current".to_owned(),
+    }));
+    let result = skill
+        .fetch_documents(&upstream, tokio::time::Instant::now() + FETCH_TIMEOUT)
+        .await
+        .unwrap();
+    assert_eq!(result.documents.len(), 2);
+    assert!(result.documents[0].1.contains("Fetched from"));
+    assert_eq!(result.documents[1].1, "# current\n");
+    assert_eq!(
+        *upstream.urls.lock().unwrap(),
+        vec![
+            "https://raw.githubusercontent.com/dev-five-git/devup-ui/HEAD/skills/example/SKILL.md",
+            "https://raw.githubusercontent.com/dev-five-git/devup-ui/HEAD/skills/example/references/rules.md",
+        ]
+    );
+
+    struct MissingReference;
+    #[async_trait]
+    impl SkillUpstream for MissingReference {
+        async fn fetch(&self, url: &str) -> Result<FetchedSkill, SkillFetchError> {
+            if url.ends_with("SKILL.md") {
+                Ok(FetchedSkill {
+                    contents: b"# new entry".to_vec(),
+                    etag: "new".to_owned(),
+                })
+            } else {
+                Err(SkillFetchError::NotFound)
+            }
+        }
+    }
+    // The caller receives an error, never a partial set to mix with the binary.
+    let failure = skill
+        .fetch_documents(
+            &MissingReference,
+            tokio::time::Instant::now() + FETCH_TIMEOUT,
+        )
+        .await
+        .err()
+        .unwrap();
+    assert!(failure.0.ends_with("/references/rules.md"));
+    assert_eq!(failure.1, SkillFetchError::NotFound);
+}
+
+#[tokio::test]
+async fn a_failed_write_does_not_commit_any_skill() {
+    let (project, policy) = policy("atomic");
+    let blocked = project.join(".claude/skills/devfive-frontend/references");
+    std::fs::create_dir_all(blocked.parent().unwrap()).unwrap();
+    std::fs::write(&blocked, "not a directory").unwrap();
+    let upstream = FakeUpstream::new(Ok(FetchedSkill {
+        contents: b"# fetched".to_vec(),
+        etag: "new".to_owned(),
+    }));
+    assert!(install_with(&policy, &[], &upstream).await.is_err());
+    assert!(!project.join(".claude/skills/devup-ui/SKILL.md").exists());
+    assert!(
+        !project
+            .join(".claude/skills/devfive-frontend/SKILL.md")
+            .exists()
+    );
+    assert_eq!(std::fs::read_to_string(blocked).unwrap(), "not a directory");
+    drop(policy);
+    std::fs::remove_dir_all(project).unwrap();
+}
diff --git a/crates/devup-mcp/src/skills/mod.rs b/crates/devup-mcp/src/skills/mod.rs
index 2ced9f6..09de9f1 100644
--- a/crates/devup-mcp/src/skills/mod.rs
+++ b/crates/devup-mcp/src/skills/mod.rs
@@ -38,11 +38,11 @@ pub struct TargetReport {
 
 #[derive(Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct SkillProvenance {
-    source_url: String,
-    etag: String,
-    fetched_at: u64,
-    sha256: String,
+pub(crate) struct SkillProvenance {
+    pub(crate) source_url: String,
+    pub(crate) etag: String,
+    pub(crate) fetched_at: u64,
+    pub(crate) sha256: String,
 }
 
 pub async fn install(config: &SkillCommandConfig) -> anyhow::Result<SkillReport> {
@@ -58,7 +58,7 @@ pub async fn install(config: &SkillCommandConfig) -> anyhow::Result<SkillReport>
         );
     }
     let upstream = RawGithubSkillUpstream::new()?;
-    let fetched = upstream.fetch().await?;
+    let fetched = upstream.fetch(SKILL_SOURCE_URL).await?;
     if config.skill_dirs.is_empty() {
         for target in &targets {
             if !target.is_dir() {
@@ -92,7 +92,7 @@ pub async fn install_with(
     targets: &[PathBuf],
     fetched_at: u64,
 ) -> anyhow::Result<SkillReport> {
-    let fetched = upstream.fetch().await?;
+    let fetched = upstream.fetch(SKILL_SOURCE_URL).await?;
     install_fetched(fetched, targets, fetched_at)
 }
 
@@ -149,7 +149,7 @@ pub async fn check_with(
     upstream: &dyn SkillUpstream,
     targets: &[PathBuf],
 ) -> anyhow::Result<SkillReport> {
-    let fetched = upstream.fetch().await?;
+    let fetched = upstream.fetch(SKILL_SOURCE_URL).await?;
     let upstream_hash = sha256(&fetched.contents);
     let targets = targets
         .iter()
@@ -217,7 +217,7 @@ fn target_report(path: &Path, status: &'static str) -> TargetReport {
     }
 }
 
-fn sha256(contents: &[u8]) -> String {
+pub(crate) fn sha256(contents: &[u8]) -> String {
     Sha256::digest(contents)
         .iter()
         .map(|byte| format!("{byte:02x}"))
diff --git a/crates/devup-mcp/src/skills/upstream.rs b/crates/devup-mcp/src/skills/upstream.rs
index 1df4080..e216e45 100644
--- a/crates/devup-mcp/src/skills/upstream.rs
+++ b/crates/devup-mcp/src/skills/upstream.rs
@@ -7,6 +7,7 @@ use anyhow::Context;
 use async_trait::async_trait;
 use reqwest::header::ETAG;
 
+/// The CLI default; MCP URLs come from each manifest record.
 pub const SKILL_SOURCE_URL: &str =
     "https://raw.githubusercontent.com/dev-five-git/devup-ui/refs/heads/main/SKILL.md";
 
@@ -29,19 +30,19 @@ impl Display for SkillFetchError {
         match self {
             Self::Network(message) => write!(
                 formatter,
-                "network failure while fetching {SKILL_SOURCE_URL}: {message}. Check connectivity and retry."
+                "network failure while fetching skill: {message}. Check connectivity and retry."
             ),
             Self::NotFound => write!(
                 formatter,
-                "GitHub returned 404 for {SKILL_SOURCE_URL}. Verify that the public main-branch SKILL.md still exists."
+                "GitHub returned 404 for the skill document. Verify that the upstream path still exists."
             ),
             Self::HttpStatus(status) => write!(
                 formatter,
-                "GitHub returned HTTP {status} for {SKILL_SOURCE_URL}. Retry later or verify GitHub availability."
+                "GitHub returned HTTP {status} for the skill document. Retry later or verify GitHub availability."
             ),
             Self::MissingEtag => write!(
                 formatter,
-                "GitHub returned {SKILL_SOURCE_URL} without an ETag, so its provenance cannot be verified."
+                "GitHub returned the skill document without an ETag, so its provenance cannot be verified."
             ),
         }
     }
@@ -51,7 +52,7 @@ impl std::error::Error for SkillFetchError {}
 
 #[async_trait]
 pub trait SkillUpstream: Send + Sync {
-    async fn fetch(&self) -> Result<FetchedSkill, SkillFetchError>;
+    async fn fetch(&self, source_url: &str) -> Result<FetchedSkill, SkillFetchError>;
 }
 
 pub struct RawGithubSkillUpstream {
@@ -60,8 +61,12 @@ pub struct RawGithubSkillUpstream {
 
 impl RawGithubSkillUpstream {
     pub fn new() -> anyhow::Result<Self> {
+        Self::with_timeout(Duration::from_secs(30))
+    }
+
+    pub(crate) fn with_timeout(timeout: Duration) -> anyhow::Result<Self> {
         let client = reqwest::Client::builder()
-            .timeout(Duration::from_secs(30))
+            .timeout(timeout)
             .user_agent(concat!("devup-mcp/", env!("CARGO_PKG_VERSION")))
             .build()
             .context("Could not create the HTTPS client for skill delivery.")?;
@@ -71,10 +76,10 @@ impl RawGithubSkillUpstream {
 
 #[async_trait]
 impl SkillUpstream for RawGithubSkillUpstream {
-    async fn fetch(&self) -> Result<FetchedSkill, SkillFetchError> {
+    async fn fetch(&self, source_url: &str) -> Result<FetchedSkill, SkillFetchError> {
         let response = self
             .client
-            .get(SKILL_SOURCE_URL)
+            .get(source_url)
             .send()
             .await
             .map_err(|error| SkillFetchError::Network(error.to_string()))?;
diff --git a/crates/devup-mcp/tests/skills.rs b/crates/devup-mcp/tests/skills.rs
index 7d2d10f..d0f15bf 100644
--- a/crates/devup-mcp/tests/skills.rs
+++ b/crates/devup-mcp/tests/skills.rs
@@ -31,7 +31,8 @@ struct FakeUpstream(Result<FetchedSkill, SkillFetchError>);
 
 #[async_trait]
 impl SkillUpstream for FakeUpstream {
-    async fn fetch(&self) -> Result<FetchedSkill, SkillFetchError> {
+    async fn fetch(&self, source_url: &str) -> Result<FetchedSkill, SkillFetchError> {
+        assert_eq!(source_url, devup_mcp::skills::SKILL_SOURCE_URL);
         self.0.clone()
     }
 }
diff --git a/crates/devup-mcp/tests/skills_install.rs b/crates/devup-mcp/tests/skills_install.rs
index 9e074c6..7a4ca20 100644
--- a/crates/devup-mcp/tests/skills_install.rs
+++ b/crates/devup-mcp/tests/skills_install.rs
@@ -6,43 +6,28 @@
 //! carries, and these tests hold that report to the disk it claims to describe.
 
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
+use std::process::Stdio;
+use std::time::Duration;
 
-use async_trait::async_trait;
-use devup_mcp::server::{DevupAuth, DevupServer, Services};
-use devup_mcp_figma::{AuthStatus, DevupError, FigmaUpstream, ReadToolCall, UpstreamResult};
 use rmcp::{
     ServiceExt,
     model::{CallToolRequestParams, ReadResourceRequestParams},
 };
 use serde_json::{Map, Value, json};
 
-/// Nothing here reaches Figma. Installing a skill is a local write of bytes
-/// already in the binary, and a test that needed a network to prove that would
-/// be proving the wrong thing.
-struct Offline;
-
-#[async_trait]
-impl DevupAuth for Offline {
-    async fn status(&self) -> Result<AuthStatus, DevupError> {
-        Ok(AuthStatus::Disconnected)
-    }
-    async fn login(&self) -> Result<AuthStatus, DevupError> {
-        panic!("installing a skill must never authenticate")
-    }
-    async fn logout(&self) -> Result<AuthStatus, DevupError> {
-        Ok(AuthStatus::Disconnected)
-    }
-}
-
-#[async_trait]
-impl FigmaUpstream for Offline {
-    async fn list_tools(&self) -> Result<Vec<String>, DevupError> {
-        Ok(vec![])
-    }
-    async fn call_read_tool(&self, _: ReadToolCall) -> Result<UpstreamResult, DevupError> {
-        panic!("installing a skill must never read Figma")
-    }
+#[test]
+fn self_check_works_without_entering_skill_delivery() -> anyhow::Result<()> {
+    let output = std::process::Command::new(env!("CARGO_BIN_EXE_devup-mcp"))
+        .arg("--self-check")
+        .env("DEVUP_MCP_SKILLS_OFFLINE", "0")
+        .env("DEVUP_MCP_NO_UPDATE_CHECK", "1")
+        .env("DEVUP_FIGMA_BRIDGE_PORT", "off")
+        .output()?;
+    assert!(output.status.success());
+    let report: Value = serde_json::from_slice(&output.stdout)?;
+    assert_eq!(report["binary"], "ok");
+    assert_eq!(report["serverConfig"], "ok");
+    Ok(())
 }
 
 fn scratch(label: &str) -> PathBuf {
@@ -56,19 +41,24 @@ async fn session<F, T>(workspace: &Path, body: F) -> anyhow::Result<T>
 where
     F: AsyncFnOnce(&rmcp::service::RunningService<rmcp::RoleClient, ()>) -> anyhow::Result<T>,
 {
-    let server = DevupServer::with_output_roots(
-        Services::new(Arc::new(Offline), Arc::new(Offline)),
-        vec![workspace.to_path_buf()],
-    )?;
-    let (server_transport, client_transport) = tokio::io::duplex(512 * 1024);
-    let task = tokio::spawn(async move {
-        server.serve(server_transport).await?.waiting().await?;
-        anyhow::Ok(())
-    });
-    let client = ().serve(client_transport).await?;
+    // Set process configuration before startup, without racing other tests by
+    // mutating this test process's environment. No HTTP or bridge socket opens.
+    let mut child = tokio::process::Command::new(env!("CARGO_BIN_EXE_devup-mcp"))
+        .current_dir(workspace)
+        .env("DEVUP_MCP_SKILLS_OFFLINE", "1")
+        .env("DEVUP_MCP_NO_UPDATE_CHECK", "1")
+        .env("DEVUP_FIGMA_BRIDGE_PORT", "off")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .kill_on_drop(true)
+        .spawn()?;
+    let transport = (child.stdout.take().unwrap(), child.stdin.take().unwrap());
+    let client = ().serve(transport).await?;
     let out = body(&client).await;
     client.cancel().await?;
-    let _ = task.await;
+    let status = tokio::time::timeout(Duration::from_secs(10), child.wait()).await??;
+    assert!(status.success());
     out
 }
 
@@ -135,6 +125,15 @@ async fn a_bare_workspace_reports_the_gap_and_one_call_closes_it() -> anyhow::Re
     let written = installed["installed"].as_array().unwrap();
     assert_eq!(written.len(), carried, "{installed}");
     for entry in written {
+        assert_eq!(entry["source"], "embedded");
+        if entry["name"] != "devfive-frontend" {
+            assert!(
+                entry["reason"]
+                    .as_str()
+                    .unwrap()
+                    .contains("DEVUP_MCP_SKILLS_OFFLINE")
+            );
+        }
         let paths = entry["paths"]
             .as_array()
             .unwrap_or_else(|| panic!("a skill reports every file it wrote: {entry}"));