create-egregore 0.21.2 → 0.21.4

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.2
+// egregore-launcher-version: 0.21.4
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.2";
+const VERSION = "0.21.4";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -1707,6 +1707,18 @@ function connectedOrganizationId(config, response) {
   return returned || current;
 }
 
+function validatedConnectedClaim(config, response, expectedOrgIds = []) {
+  const orgId = connectedOrganizationId(config, response);
+  for (const expectedOrgId of expectedOrgIds) {
+    if (expectedOrgId) connectedOrganizationId({ org_id: expectedOrgId }, response);
+  }
+  if (typeof response?.api_url !== "string" || !response.api_url.trim() ||
+      typeof response?.api_key !== "string" || !response.api_key.trim()) {
+    die("Connected did not return usable access settings. Local configuration is unchanged; run the same command to retry.");
+  }
+  return { orgId, apiUrl: response.api_url, apiKey: response.api_key };
+}
+
 function hostedMemorySyncEnabled(config) {
   const override = process.env.EGREGORE_GRAPH_PROJECTION;
   if (["1", "true", "enabled"].includes(override)) return true;
@@ -1714,6 +1726,25 @@ function hostedMemorySyncEnabled(config) {
   return config.features?.graph_projection === true;
 }
 
+function connectionHasSubscription(status) {
+  if (typeof status?.entitled === "boolean") return status.entitled;
+  return ["entitled", "provisioning", "backfilling", "connected"].includes(status?.status);
+}
+
+function refreshConnectedRuntime(inst) {
+  // Connect is an instance-scoped overlay; never refresh other runtimes here.
+  const result = spawnSync(
+    "npx", ["-y", `${PUBLIC_NPX_PACKAGE}@${VERSION}`, "--refresh-connect"],
+    { cwd: inst.path, encoding: "utf-8", stdio: "pipe", timeout: 3 * 60 * 1000 },
+  );
+  if (result.status === 0) {
+    console.log(`        ${GREEN}✓${RESET} Connect features installed`);
+  } else {
+    console.log(`        ${YELLOW}!${RESET} Connect features will retry on the next update`);
+    console.log(`          ${DIM}npx -y ${PUBLIC_NPX_PACKAGE}@${VERSION} --refresh-connect${RESET}`);
+  }
+}
+
 async function cmdConnect(args) {
   const fresh = args.includes("--fresh");
   const positional = args.filter((a) => !String(a).startsWith("--"));
@@ -1733,7 +1764,7 @@ async function cmdConnect(args) {
   const activation = state.connected_activation || {};
   let expectedOrgId = cfg.org_id && !String(cfg.org_id).startsWith("legacy-org:")
     ? cfg.org_id : activation.org_id || "";
-  if (cfg.mode === "connected" && activation.status === "connected") {
+  if (cfg.mode === "connected" && activation.status === "connected" && activation.intent_id) {
     if (activation.intent_id) {
       const repaired = await connectedApiRequest(
         githubToken,
@@ -1746,16 +1777,14 @@ async function cmdConnect(args) {
           `Connected is active, but its shared configuration could not be published: ${connectError(repaired, `HTTP ${repaired.status}`)}`,
         );
       }
-      const orgId = connectedOrganizationId(cfg, repaired.data);
+      const access = validatedConnectedClaim(cfg, repaired.data, [activation.org_id]);
       writeJsonFileAtomic(path.join(inst.path, "egregore.json"), {
         ...cfg,
-        ...(orgId ? { org_id: orgId } : {}),
+        org_id: access.orgId,
         mode: "connected",
-        api_url: repaired.data.api_url,
+        api_url: access.apiUrl,
       });
-      if (repaired.data.api_key) {
-        writeEnvValueAtomic(path.join(inst.path, ".env"), "EGREGORE_API_KEY", repaired.data.api_key);
-      }
+      writeEnvValueAtomic(path.join(inst.path, ".env"), "EGREGORE_API_KEY", access.apiKey);
     }
     normalizeClaudeDenyRules(inst.path);
     ensureClaudeModeStatusLine(inst.path);
@@ -1766,18 +1795,80 @@ async function cmdConnect(args) {
 
   console.log("");
   console.log(`  ${BOLD}CONNECT${RESET}  ${DIM}${inst.slug}${RESET}`);
-  console.log(`  ${DIM}€500/month · Stripe checkout · existing Markdown and Git stay in place${RESET}`);
+  console.log(`  ${DIM}Connect this installation · existing Markdown and Git stay in place${RESET}`);
   console.log("");
 
   let intentId = activation.intent_id || "";
   let connectUrl = activation.connect_url || "";
   let ticketExpiresAt = Number(activation.connect_ticket_expires_at || 0) * 1000;
-  const resumable = ["created", "checkout_pending", "entitled", "provisioning", "backfilling"].includes(
+  let checkoutRequired = true;
+  const resumable = ["created", "checkout_pending", "entitled", "provisioning", "backfilling", "connected"].includes(
     activation.status,
   );
+  const connectRequest = {
+    org_slug: cfg.slug || inst.slug,
+    plan: "connect",
+    instance_metadata: {
+      launcher_version: VERSION,
+      mode: cfg.mode || "local",
+      repo_name: cfg.repo_name || "",
+      managed_repo_count: Array.isArray(cfg.repos) ? cfg.repos.length : 0,
+      hosted_memory_sync: hostedMemorySyncEnabled(cfg),
+      fresh,
+    },
+  };
+  if (intentId && resumable) {
+    const current = await connectedApiRequest(
+      githubToken, "GET", `/api/billing/connect/${encodeURIComponent(intentId)}`,
+    );
+    if (current.status !== 200) {
+      die(`could not check the existing connection: ${connectError(current, `HTTP ${current.status}`)}. Run the same command to retry.`);
+    }
+    checkoutRequired = !connectionHasSubscription(current.data);
+    if (checkoutRequired && ["entitled", "provisioning", "backfilling", "connected"].includes(current.data?.status)) {
+      die("Your subscription is not active. Check its billing status before reconnecting this installation.");
+    }
+    if (current.data?.entitled === true &&
+        [activation.status, current.data.status].some(value => ["created", "checkout_pending"].includes(value))) {
+      if (activation.org_id && !String(activation.org_id).startsWith("legacy-org:")) {
+        connectedOrganizationId(cfg, { org_id: activation.org_id });
+      }
+      if (current.data.org_slug && current.data.org_slug !== connectRequest.org_slug) {
+        die("The saved connection belongs to another Egregore. Local configuration is unchanged.");
+      }
+      // Retry this saved attempt with the current target and explicit optional
+      // sync choice. No local writes until the API confirms a claimable intent.
+      const retryKey = crypto.createHash("sha256").update(JSON.stringify([
+        intentId, connectRequest.org_slug, connectRequest.instance_metadata.repo_name,
+        connectRequest.instance_metadata.hosted_memory_sync,
+      ])).digest("hex");
+      const recovered = await connectedApiRequest(
+        githubToken, "POST", "/api/billing/connect-intents", connectRequest,
+        { "X-Idempotency-Key": `cli:recover:${retryKey}`, "X-Egregore-Connect-Recovery": "1" },
+      );
+      if (recovered.status !== 200) {
+        die(`could not recover the saved connection: ${connectError(recovered, `HTTP ${recovered.status}`)}. Run the same command to retry.`);
+      }
+      const result = recovered.data;
+      if (typeof result?.connection_intent_id !== "string" || !result.connection_intent_id.trim() ||
+          result.entitled !== true || result.checkout_required !== false ||
+          !["entitled", "provisioning", "backfilling", "connected"].includes(result.status) ||
+          (result.org_slug && result.org_slug !== connectRequest.org_slug)) {
+        die("The saved connection could not be recovered without a new purchase. Check its billing status, then retry; your saved activation is unchanged.");
+      }
+      intentId = result.connection_intent_id;
+      checkoutRequired = false;
+      connectUrl = "";
+      persistConnectState(inst, {
+        intent_id: intentId, status: result.status, checkout_required: false,
+        connect_url: "", connect_ticket: undefined, connect_ticket_expires_at: undefined,
+      });
+    }
+  }
   if (
     intentId &&
     resumable &&
+    checkoutRequired &&
     (!activation.connect_ticket || !ticketExpiresAt || ticketExpiresAt <= Date.now() + 60_000)
   ) {
     const refreshed = await connectedApiRequest(
@@ -1822,31 +1913,22 @@ async function cmdConnect(args) {
       githubToken,
       "POST",
       "/api/billing/connect-intents",
-      {
-        org_slug: cfg.slug || inst.slug,
-        plan: "connect",
-        instance_metadata: {
-          launcher_version: VERSION,
-          mode: cfg.mode || "local",
-          repo_name: cfg.repo_name || "",
-          managed_repo_count: Array.isArray(cfg.repos) ? cfg.repos.length : 0,
-          hosted_memory_sync: hostedMemorySyncEnabled(cfg),
-          fresh,
-        },
-      },
-      { "X-Idempotency-Key": `cli:${inst.slug}:${crypto.randomUUID()}` },
+      connectRequest,
+      { "X-Idempotency-Key": `cli:${inst.slug}:${crypto.randomUUID()}`, "X-Egregore-Connect-Recovery": "1" },
     );
     if (checkout.status !== 200) {
-      die(`could not start Connected checkout: ${connectError(checkout, `HTTP ${checkout.status}`)}`);
+      die(`could not connect this installation: ${connectError(checkout, `HTTP ${checkout.status}`)}`);
     }
     intentId = checkout.data.connection_intent_id;
-    connectUrl = checkout.data.connect_url;
+    connectUrl = checkout.data.connect_url || "";
+    checkoutRequired = checkout.data.checkout_required !== false && !connectionHasSubscription(checkout.data);
     persistConnectState(inst, {
       intent_id: intentId,
       org_id: expectedOrgId,
       connect_ticket: checkout.data.connect_ticket,
       connect_ticket_expires_at: checkout.data.connect_ticket_expires_at,
       connect_url: connectUrl,
+      checkout_required: checkoutRequired,
       status: checkout.data.status || "created",
     });
     console.log(`  [1/5] ${GREEN}✓${RESET} Connection intent`);
@@ -1865,16 +1947,16 @@ async function cmdConnect(args) {
     console.log(`  [1/5] ${GREEN}✓${RESET} Resuming connection intent`);
   }
 
-  if (activation.status !== "backfilling") {
+  if (checkoutRequired) {
     if (connectUrl) {
       const opened = openExternalUrl(connectUrl);
       const mark = opened ? `${GREEN}✓${RESET}` : `${YELLOW}!${RESET}`;
       console.log(`  [2/5] ${mark} ${opened ? "Opened" : "Open"} Egregore Connect`);
       console.log(`        ${CYAN}${connectUrl}${RESET}`);
     }
-    console.log(`  ${DIM}Complete checkout in the browser. Promotion codes are entered in Stripe.${RESET}`);
+    console.log(`  ${DIM}New subscription: €500/month. Complete checkout in the browser; promotion codes are entered in Stripe.${RESET}`);
   } else {
-    console.log(`  [2/5] ${GREEN}✓${RESET} Subscription already confirmed`);
+    console.log(`  [2/5] ${GREEN}✓${RESET} Existing subscription found · no new purchase needed`);
   }
 
   const pollMs = Math.max(100, Number(process.env.EGREGORE_CONNECT_POLL_INTERVAL_MS || 2000));
@@ -1889,10 +1971,10 @@ async function cmdConnect(args) {
     );
     if (result.status === 200) {
       status = result.data;
-      if (
-        status.entitled ||
-        ["entitled", "provisioning", "backfilling", "connected"].includes(status.status)
-      ) break;
+      if (connectionHasSubscription(status)) break;
+      if (["entitled", "provisioning", "backfilling", "connected"].includes(status.status)) {
+        die("Your subscription is not active. Check its billing status before reconnecting this installation.");
+      }
       if (["canceled", "failed"].includes(status.status)) {
         persistConnectState(inst, { status: status.status });
         die(`Connected checkout ${status.status}. Your local Egregore was not changed.`);
@@ -1902,7 +1984,7 @@ async function cmdConnect(args) {
     }
     await sleep(pollMs);
   }
-  if (!status || !(status.entitled || ["entitled", "provisioning", "backfilling", "connected"].includes(status.status))) {
+  if (!connectionHasSubscription(status)) {
     die("timed out waiting for checkout. Run the same command to resume.");
   }
   console.log(`  [3/5] ${GREEN}✓${RESET} Subscription confirmed`);
@@ -1921,17 +2003,25 @@ async function cmdConnect(args) {
   const configFile = path.join(inst.path, "egregore.json");
   const envFile = path.join(inst.path, ".env");
   const currentConfig = readJsonFile(configFile);
-  const orgId = connectedOrganizationId({ ...currentConfig, org_id: expectedOrgId || currentConfig.org_id }, claim.data);
+  const access = validatedConnectedClaim(currentConfig, claim.data, [expectedOrgId, activation.org_id]);
   const syncEnabled = hostedMemorySyncEnabled(currentConfig);
   writeJsonFileAtomic(configFile, {
     ...currentConfig,
-    ...(orgId ? { org_id: orgId } : {}),
+    org_id: access.orgId,
     mode: "connected",
-    api_url: claim.data.api_url,
+    api_url: access.apiUrl,
   });
-  writeEnvValueAtomic(envFile, "EGREGORE_API_KEY", claim.data.api_key);
+  writeEnvValueAtomic(envFile, "EGREGORE_API_KEY", access.apiKey);
   normalizeClaudeDenyRules(inst.path);
   ensureClaudeModeStatusLine(inst.path);
+  if (claim.data.status === "connected") {
+    persistConnectState(inst, { status: "connected", activation_protocol: claim.data.activation_protocol });
+    console.log(`  [4/5] ${GREEN}✓${RESET} Access restored for this installation`);
+    console.log(`  [5/5] ${GREEN}✓${RESET} Existing connection restored · memory sync was not restarted`);
+    refreshConnectedRuntime(inst);
+    console.log(`\n  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is connected. Local files remain the source of truth.\n`);
+    return;
+  }
   persistConnectState(inst, {
     status: "backfilling",
     activation_protocol: claim.data.activation_protocol,
@@ -1991,23 +2081,7 @@ async function cmdConnect(args) {
       console.log(`        ${DIM}${line}${RESET}`);
     }
   }
-  // Connect is an instance-scoped overlay; never refresh other runtimes here.
-  const runtimeRefresh = spawnSync(
-    "npx",
-    ["-y", `${PUBLIC_NPX_PACKAGE}@${VERSION}`, "--refresh-connect"],
-    {
-      cwd: inst.path,
-      encoding: "utf-8",
-      stdio: "pipe",
-      timeout: 3 * 60 * 1000,
-    },
-  );
-  if (runtimeRefresh.status === 0) {
-    console.log(`        ${GREEN}✓${RESET} Connect features installed`);
-  } else {
-    console.log(`        ${YELLOW}!${RESET} Connect features will retry on the next update`);
-    console.log(`          ${DIM}npx -y ${PUBLIC_NPX_PACKAGE}@${VERSION} --refresh-connect${RESET}`);
-  }
+  refreshConnectedRuntime(inst);
   console.log("");
   console.log(`  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is connected. Local files remain the source of truth.`);
   console.log("");
@@ -3562,6 +3636,13 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
     }
   } else {
     const upgradeValue = runtimeUpdateRowValue(upgrade, candidate);
+    const hostingReadiness = d.hosting === false ? "disabled" : d.hosting_status?.readiness;
+    const hostingLabels = {
+      disabled: `${YELLOW}OFF${RESET}`,
+      connected_configured: `${GREEN}ACCESS CONFIGURED${RESET}`,
+      public_relay: `${YELLOW}PUBLIC RELAY${RESET}`,
+      setup_incomplete: `${YELLOW}SETUP INCOMPLETE${RESET}`,
+    };
     const rows = [
       {
         name: "Runtime update",
@@ -3571,7 +3652,7 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
       },
       { name: "Privacy & access", value: `${DIM}identity · boundary · consent${RESET}` },
       { name: "Telemetry", value: `${DIM}personal · opt-out${RESET}` },
-      { name: "Hosted Artifacts", value: (d.hosting !== false) ? `${GREEN}ON${RESET}` : `${YELLOW}OFF${RESET}` },
+      { name: "Hosted Artifacts", value: hostingLabels[hostingReadiness] || `${YELLOW}STATUS UNKNOWN${RESET}` },
       {
         name: "Git workflow",
         value: d.workflow === "simple"
@@ -3591,6 +3672,21 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
       lines.push(boxLine(`${marker} ${pad(name, 20)}  ${row.value}`, innerWidth, margin));
     });
     lines.push(emptyBoxLine(innerWidth, margin));
+    if (cursor === 3) {
+      const hostingHints = {
+        disabled: ["Publishing is turned off."],
+        connected_configured: ["Access is configured. Connection not checked."],
+        public_relay: ["Pages are public without sign-in and expire after 7 days."],
+        setup_incomplete: [
+          "Publishing is enabled; connection setup is incomplete.",
+          `Run ${d.hosting_status?.recovery_command || `egregore connect ${inst.slug}`}`,
+        ],
+      };
+      for (const hint of hostingHints[hostingReadiness] || ["Update this Egregore to check publishing readiness."]) {
+        lines.push(boxLine(`${DIM}${hint}${RESET}`, innerWidth, margin));
+      }
+      lines.push(emptyBoxLine(innerWidth, margin));
+    }
     if (notice) lines.push(boxLine(notice, innerWidth, margin));
     lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}enter${RESET}${DIM} ${cursor === 3 ? "toggle" : "open"} · ← back · q quit${RESET}`, innerWidth, margin));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "description": "Set up Egregore for your team in one command \u2014 installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/.claude/context/telemetry.md

@@ -153,51 +153,30 @@ On the first session where telemetry events are emitted, if `telemetry_noticed`
 
 Then set `telemetry_noticed: true` in the state file. Never repeat this notice.
 
-## Session Reports
-
-Separate from telemetry. Users can optionally share session reports during `/wrap` or via `/issue egregore:`. Reports are **opt-in per session** — the user is asked each time and must explicitly agree.
-
-### How it works
-
-`bin/session-report.sh` handles report submission. It POSTs directly to Supabase via the anon key (no API server needed). The agent generates a structured report from the session context inline — no separate LLM call.
-
-```bash
-# Submit a report (reads JSON from stdin)
-echo '{"topic":"...","summary":"..."}' | bash bin/session-report.sh submit
-
-# Check reporting status
-bash bin/session-report.sh status
-```
-
-### What is sent
-
-- AI-analyzed topic + summary (same as what's written to memory)
-- Gap analysis: `{type, detail}` where type is `missing_skill`, `missing_tool`, `repeated_failure`, `wrong_info`, or `confusing_ux`
-- User's own description (if provided)
-- System info: mode, platform, shell, framework version
-- Session duration and message count
-
-### What is NEVER sent
-
-- Code, file contents, or file paths
-- Conversation transcript or user prompts
-- Environment variables or secrets
-- Org-specific data (sanitized before sending — org names, person names, tokens replaced)
-
-### Opt-out
-
-- `EGREGORE_NO_REPORTS=1` in `.env`
-- `.egregore-state.json` → `"session_reports": false`
-- Simply answer "No thanks" when prompted during `/wrap`
-- `DO_NOT_TRACK=1` also disables reports
-
-### Transport
-
-- Direct to Supabase via anon key (INSERT-only RLS policy)
-- If network fails: saved locally to `~/.egregore/reports/` as fallback
-- Telegram notification to maintainers fires server-side via Supabase DB webhook
-- Optional: GitHub issue creation on `egregore-labs/egregore` (user chooses each time)
-
-### Configuration
-
-Reports require `report_url` and `report_key` in `egregore.json`. New OSS installations get these automatically via `create-egregore`. If missing, the report prompt is skipped entirely.
+## Framework support and legacy session feedback
+
+For an Egregore bug, including the historical `/issue egregore:` wording, use
+the [issue workflow](../skills/issue/SKILL.md). Connected instances prepare an
+exact private support preview and submit only after confirmation. Local users
+can explicitly choose a public upstream report. An internal issue stays within
+its organization's memory or configured tracker; it does not automatically
+reach Egregore support. `/wrap` does not collect or submit session feedback.
+
+The older `bin/session-report.sh` is a feedback-storage compatibility helper,
+not a support-reporting route. It inserts selected feedback into `session_reports`
+when `report_url` and `report_key` are configured. A `submitted` receipt means
+only that storage accepted the feedback: no GitHub issue was created and no
+Telegram message was sent. The authenticated database callback acknowledges
+storage without planning or dispatching a notification to a named teammate.
+Transport failure saves feedback locally under `~/.egregore/reports/`; that
+does not establish remote storage or delivery. Missing configuration skips
+submission.
+
+Never invoke legacy feedback automatically, generate it from a transcript, or
+use it as a fallback when private support fails. Only explicitly selected and
+reviewed content may be shared. The helper adds legacy user and organization
+labels; it does not guarantee anonymization or scrub arbitrary input.
+
+Legacy feedback can be disabled with `EGREGORE_NO_REPORTS=1` or
+`DO_NOT_TRACK=1` in the process environment, or `"session_reports": false` in
+`.egregore-state.json`. These switches do not grant consent to submit content.

package/runtime/claude/.claude/skills/issue/SKILL.md

@@ -67,6 +67,12 @@ its default recipient is **Egregore support, private**. Local/OSS users may
 explicitly choose `upstream` for a **public** report. Connected users can also
 choose public upstream explicitly. Never fall back from private to public.
 
+Treat the historical `egregore:` prefix as framework-support intent and use
+this reviewed reporting flow. Never route a framework bug through the
+legacy session-feedback helper: it only stores feedback and does not
+file a support issue or send a Telegram notification. Being Connected does not
+turn an internal issue in the customer's memory into a report to Egregore.
+
 Use `'{title}'` for the concise title derived from the user's report and
 `'{report}'` for the report text the user supplied or reviewed.
 Write an embedded single quote as `'\''` in each substituted value.
@@ -119,6 +125,13 @@ review the private issue in its Project/Archive. Keep a failed/uncertain report'
 request ID; no backend failure authorizes public publication or a fresh blind
 submission.
 
+Report the confirmed outcome precisely: a preview is not submitted; a local
+issue is saved within this organization; only a matching private receipt with
+`submission_state: filed` means filed with Egregore support. Other states need
+recovery using the same request ID. A filed issue does not prove Telegram
+delivery: `notification_state: unverified` must never be described as sent or
+received. Only a separate delivery receipt can establish that.
+
 Public reports use the reporter's GitHub authentication and return a public
 issue URL. Destination comes only from HTTPS GitHub `upstream_url`; absent means
 `egregore-labs/egregore`, `none` means no upstream. Do not infer it from remotes.

package/runtime/claude/bin/settings.sh

@@ -56,7 +56,7 @@ _control_plane_push() {
   local api_url api_key payload actor response revision
   api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
   [ -n "$api_url" ] || return 0
-  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)
   [ -n "$api_key" ] || return 0
   actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
   payload=$(jq -c --arg by "$actor" '{
@@ -104,22 +104,78 @@ EOF
 
 # ── verbs ────────────────────────────────────────────────────────────────
 
+_hosting_status() {
+  # Read local configuration only. A saved key is not proof that the hosted
+  # service can be reached or that the credential is still accepted.
+  local api_key="" has_key=false slug recovery="egregore connect"
+  if [ -r "$SCRIPT_DIR/.env" ]; then
+    api_key=$(sed -n 's/^EGREGORE_API_KEY=//p' "$SCRIPT_DIR/.env" | tail -n 1)
+    api_key="${api_key#"${api_key%%[![:space:]]*}"}"
+    api_key="${api_key%"${api_key##*[![:space:]]}"}"
+    case "$api_key" in
+      \"*\"|\'*\') api_key="${api_key:1:${#api_key}-2}" ;;
+    esac
+    [ -n "${api_key//[[:space:]]/}" ] && has_key=true
+  fi
+  # Match publish-artifact.sh's route selection separately from the saved
+  # configuration check. Raw nonempty overrides (even malformed ones) select
+  # organisation upload, so they must never imply the public relay's expiry.
+  local effective_url="${EGREGORE_API_URL:-}" effective_key="${EGREGORE_API_KEY:-}" org_route=false
+  if [ -f "$SCRIPT_DIR/.env" ]; then
+    effective_url="${effective_url:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+    effective_key="${effective_key:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+  fi
+  effective_url="${effective_url:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
+  if [ -n "$effective_url" ] && [ -n "$effective_key" ]; then org_route=true; fi
+  slug=$(jq -r '.slug // empty' "$CONFIG")
+  if _valid_token "$slug"; then recovery="egregore connect $slug"; fi
+  jq --argjson has_key "$has_key" --argjson org_route "$org_route" --arg recovery "$recovery" '
+    def nonblank: if type == "string" then test("\\S") else false end;
+    (.features.publishing != false) as $publishing |
+    (.features.public_relay == true) as $relay |
+    (((if .mode == null then "connected" else .mode end) == "connected") and
+      (.api_url | nonblank) and $has_key) as $configured |
+    (if $publishing == false then "disabled"
+     elif $configured then "connected_configured"
+     elif $org_route then "setup_incomplete"
+     elif $relay then "public_relay"
+     else "setup_incomplete" end) as $readiness |
+    {
+      domain: "hosting",
+      publishing: $publishing,
+      readiness: $readiness,
+      connection_configured: $configured,
+      public_relay: $relay,
+      connectivity: "not_checked",
+      recovery_command: (if $readiness == "setup_incomplete" then $recovery else null end)
+    }' "$CONFIG"
+}
+
 cmd_hosting() {
   local action="${1:-status}"
-  # NEVER use jq's `// "true"` here: `//` treats an explicit `false` as empty and
-  # would return the default, silently defeating the off-switch. Test `!= false`
-  # so absent/true => enabled, explicit false => disabled. `enabled` is the
-  # resolved boolean string ("true"/"false").
-  local enabled; enabled="$(jq -r '.features.publishing != false' "$CONFIG" 2>/dev/null || echo "true")"
   case "$action" in
     status)
+      local status; status="$(_hosting_status)"
       if [ "$JSON" = 1 ]; then
-        jq -n --argjson on "$enabled" '{domain:"hosting", publishing:$on}'
-      elif [ "$enabled" = "false" ]; then echo "Hosting (egregore.xyz): OFF"
-      else echo "Hosting (egregore.xyz): ON"; fi ;;
+        printf '%s\n' "$status"
+      else
+        case "$(printf '%s' "$status" | jq -r '.readiness')" in
+          disabled) echo "Hosting (egregore.xyz): OFF" ;;
+          connected_configured)
+            echo "Hosting (egregore.xyz): ACCESS CONFIGURED"
+            echo "  Connection not checked." ;;
+          public_relay)
+            echo "Hosting (egregore.xyz): PUBLIC RELAY"
+            echo "  Anyone with the link can read published artifacts for 7 days. Connection not checked." ;;
+          setup_incomplete)
+            echo "Hosting (egregore.xyz): SETUP INCOMPLETE"
+            echo "  Publishing is enabled; connection setup is incomplete."
+            echo "  Run: $(printf '%s' "$status" | jq -r '.recovery_command')" ;;
+        esac
+      fi ;;
     on)
       _save '.features.publishing = true'
-      echo "Hosting (egregore.xyz): ON" ;;
+      JSON=0 cmd_hosting status ;;
     off)
       _save '.features.publishing = false'
       echo "Hosting (egregore.xyz): OFF — artifacts will no longer upload to egregore.xyz" ;;
@@ -378,10 +434,12 @@ cmd_people() {
 cmd_dump() {
   # Always JSON — the launcher calls this once to render the whole settings screen.
   local people; people="$(_people_json)"
-  jq --argjson people "$people" '{
+  local hosting_status; hosting_status="$(_hosting_status)"
+  jq --argjson people "$people" --argjson hosting_status "$hosting_status" '{
     org: .org_name,
     slug: .slug,
     hosting: (.features.publishing != false),
+    hosting_status: $hosting_status,
     public_relay: (.features.public_relay == true),
     workflow: (
       if ((if has("base_branch") then .base_branch else "develop" end) == "main") then "simple"

package/runtime/claude/egregore_runtime/issue_reporting.py

@@ -21,6 +21,26 @@ from .policy import scope_allows_path
 KINDS = {"bug", "improvement", "question"}
 AREAS = {"runtime", "onboarding", "connectors", "site", "other"}
 SEVERITIES = {"critical", "high", "normal"}
+SUPPORT_STATES = {"filed", "failed", "submitting", "uncertain"}
+
+
+def support_receipt(result, identifier):
+    """Accept only a receipt for this request; filing never proves notification."""
+    if (not isinstance(result, dict) or result.get('request_id') != identifier
+        or not isinstance(result.get('submission_state'), str)
+        or result['submission_state'] not in SUPPORT_STATES):
+        raise ValueError(f"private support returned an invalid receipt; keep request {identifier} and use report-status")
+    state = result['submission_state']
+    notices = {
+        'filed': 'Filed with Egregore support. Telegram delivery has not been verified.',
+        'failed': 'Report preserved; support filing failed. Retry this same request.',
+        'submitting': 'Report preserved; support filing is not confirmed. Keep this request ID and check report-status.',
+        'uncertain': 'Report preserved; support filing needs reconciliation. Keep this request ID and check report-status.',
+    }
+    return {'request_id': identifier, 'submission_state': state,
+            'retryable': state == 'failed',
+            'reconciliation_needed': state in {'submitting', 'uncertain'},
+            'notification_state': 'unverified', 'notice': notices[state]}
 
 
 def _scrub(value, *, public=False):
@@ -207,18 +227,29 @@ class FrameworkReporting:
                 return {'request_id':identifier,'status':result['status'],'github_url':result['github_url']}
             credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
             state['status'] = 'submitting'; GitHubIssues._save(path,state)
-            code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
-                {'request_id':identifier, **state['payload']},credential=credential)
-            if code >= 400:
+            try:
+                code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
+                    {'request_id':identifier, **state['payload']},credential=credential)
+            except OSError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise OSError(f"private support response unavailable; keep request {identifier} and use report-status or confirm this same preview") from None
+            if not 200 <= code < 300:
                 state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
                 raise ValueError(f"private support request {identifier} needs recovery (HTTP {code}); use report-status or confirm this same preview")
-            state['status'] = result.get('submission_state','unknown'); GitHubIssues._save(path,state)
-            return result
+            try:
+                receipt = support_receipt(result, identifier)
+            except ValueError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise
+            state['status'] = receipt['submission_state']; GitHubIssues._save(path,state)
+            if state['status'] != 'filed':
+                raise ValueError(f"private support request {identifier} needs recovery ({state['status']}); use report-status or confirm this same preview")
+            return receipt
 
     def status(self, identifier):
         path, state = self._load('report',identifier,write=False)
         credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
         code, result = self.api(self.root,state['destination'],f'/api/v1/support-reports/{identifier}',credential=credential)
-        if code >= 400:
+        if not 200 <= code < 300:
             raise ValueError(f"private support status unavailable (HTTP {code}); keep request {identifier}")
-        return result
+        return support_receipt(result, identifier)

package/runtime/codex/bin/settings.sh

@@ -56,7 +56,7 @@ _control_plane_push() {
   local api_url api_key payload actor response revision
   api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
   [ -n "$api_url" ] || return 0
-  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)
   [ -n "$api_key" ] || return 0
   actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
   payload=$(jq -c --arg by "$actor" '{
@@ -104,22 +104,78 @@ EOF
 
 # ── verbs ────────────────────────────────────────────────────────────────
 
+_hosting_status() {
+  # Read local configuration only. A saved key is not proof that the hosted
+  # service can be reached or that the credential is still accepted.
+  local api_key="" has_key=false slug recovery="egregore connect"
+  if [ -r "$SCRIPT_DIR/.env" ]; then
+    api_key=$(sed -n 's/^EGREGORE_API_KEY=//p' "$SCRIPT_DIR/.env" | tail -n 1)
+    api_key="${api_key#"${api_key%%[![:space:]]*}"}"
+    api_key="${api_key%"${api_key##*[![:space:]]}"}"
+    case "$api_key" in
+      \"*\"|\'*\') api_key="${api_key:1:${#api_key}-2}" ;;
+    esac
+    [ -n "${api_key//[[:space:]]/}" ] && has_key=true
+  fi
+  # Match publish-artifact.sh's route selection separately from the saved
+  # configuration check. Raw nonempty overrides (even malformed ones) select
+  # organisation upload, so they must never imply the public relay's expiry.
+  local effective_url="${EGREGORE_API_URL:-}" effective_key="${EGREGORE_API_KEY:-}" org_route=false
+  if [ -f "$SCRIPT_DIR/.env" ]; then
+    effective_url="${effective_url:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+    effective_key="${effective_key:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+  fi
+  effective_url="${effective_url:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
+  if [ -n "$effective_url" ] && [ -n "$effective_key" ]; then org_route=true; fi
+  slug=$(jq -r '.slug // empty' "$CONFIG")
+  if _valid_token "$slug"; then recovery="egregore connect $slug"; fi
+  jq --argjson has_key "$has_key" --argjson org_route "$org_route" --arg recovery "$recovery" '
+    def nonblank: if type == "string" then test("\\S") else false end;
+    (.features.publishing != false) as $publishing |
+    (.features.public_relay == true) as $relay |
+    (((if .mode == null then "connected" else .mode end) == "connected") and
+      (.api_url | nonblank) and $has_key) as $configured |
+    (if $publishing == false then "disabled"
+     elif $configured then "connected_configured"
+     elif $org_route then "setup_incomplete"
+     elif $relay then "public_relay"
+     else "setup_incomplete" end) as $readiness |
+    {
+      domain: "hosting",
+      publishing: $publishing,
+      readiness: $readiness,
+      connection_configured: $configured,
+      public_relay: $relay,
+      connectivity: "not_checked",
+      recovery_command: (if $readiness == "setup_incomplete" then $recovery else null end)
+    }' "$CONFIG"
+}
+
 cmd_hosting() {
   local action="${1:-status}"
-  # NEVER use jq's `// "true"` here: `//` treats an explicit `false` as empty and
-  # would return the default, silently defeating the off-switch. Test `!= false`
-  # so absent/true => enabled, explicit false => disabled. `enabled` is the
-  # resolved boolean string ("true"/"false").
-  local enabled; enabled="$(jq -r '.features.publishing != false' "$CONFIG" 2>/dev/null || echo "true")"
   case "$action" in
     status)
+      local status; status="$(_hosting_status)"
       if [ "$JSON" = 1 ]; then
-        jq -n --argjson on "$enabled" '{domain:"hosting", publishing:$on}'
-      elif [ "$enabled" = "false" ]; then echo "Hosting (egregore.xyz): OFF"
-      else echo "Hosting (egregore.xyz): ON"; fi ;;
+        printf '%s\n' "$status"
+      else
+        case "$(printf '%s' "$status" | jq -r '.readiness')" in
+          disabled) echo "Hosting (egregore.xyz): OFF" ;;
+          connected_configured)
+            echo "Hosting (egregore.xyz): ACCESS CONFIGURED"
+            echo "  Connection not checked." ;;
+          public_relay)
+            echo "Hosting (egregore.xyz): PUBLIC RELAY"
+            echo "  Anyone with the link can read published artifacts for 7 days. Connection not checked." ;;
+          setup_incomplete)
+            echo "Hosting (egregore.xyz): SETUP INCOMPLETE"
+            echo "  Publishing is enabled; connection setup is incomplete."
+            echo "  Run: $(printf '%s' "$status" | jq -r '.recovery_command')" ;;
+        esac
+      fi ;;
     on)
       _save '.features.publishing = true'
-      echo "Hosting (egregore.xyz): ON" ;;
+      JSON=0 cmd_hosting status ;;
     off)
       _save '.features.publishing = false'
       echo "Hosting (egregore.xyz): OFF — artifacts will no longer upload to egregore.xyz" ;;
@@ -378,10 +434,12 @@ cmd_people() {
 cmd_dump() {
   # Always JSON — the launcher calls this once to render the whole settings screen.
   local people; people="$(_people_json)"
-  jq --argjson people "$people" '{
+  local hosting_status; hosting_status="$(_hosting_status)"
+  jq --argjson people "$people" --argjson hosting_status "$hosting_status" '{
     org: .org_name,
     slug: .slug,
     hosting: (.features.publishing != false),
+    hosting_status: $hosting_status,
     public_relay: (.features.public_relay == true),
     workflow: (
       if ((if has("base_branch") then .base_branch else "develop" end) == "main") then "simple"

package/runtime/codex/egregore_runtime/issue_reporting.py

@@ -21,6 +21,26 @@ from .policy import scope_allows_path
 KINDS = {"bug", "improvement", "question"}
 AREAS = {"runtime", "onboarding", "connectors", "site", "other"}
 SEVERITIES = {"critical", "high", "normal"}
+SUPPORT_STATES = {"filed", "failed", "submitting", "uncertain"}
+
+
+def support_receipt(result, identifier):
+    """Accept only a receipt for this request; filing never proves notification."""
+    if (not isinstance(result, dict) or result.get('request_id') != identifier
+        or not isinstance(result.get('submission_state'), str)
+        or result['submission_state'] not in SUPPORT_STATES):
+        raise ValueError(f"private support returned an invalid receipt; keep request {identifier} and use report-status")
+    state = result['submission_state']
+    notices = {
+        'filed': 'Filed with Egregore support. Telegram delivery has not been verified.',
+        'failed': 'Report preserved; support filing failed. Retry this same request.',
+        'submitting': 'Report preserved; support filing is not confirmed. Keep this request ID and check report-status.',
+        'uncertain': 'Report preserved; support filing needs reconciliation. Keep this request ID and check report-status.',
+    }
+    return {'request_id': identifier, 'submission_state': state,
+            'retryable': state == 'failed',
+            'reconciliation_needed': state in {'submitting', 'uncertain'},
+            'notification_state': 'unverified', 'notice': notices[state]}
 
 
 def _scrub(value, *, public=False):
@@ -207,18 +227,29 @@ class FrameworkReporting:
                 return {'request_id':identifier,'status':result['status'],'github_url':result['github_url']}
             credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
             state['status'] = 'submitting'; GitHubIssues._save(path,state)
-            code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
-                {'request_id':identifier, **state['payload']},credential=credential)
-            if code >= 400:
+            try:
+                code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
+                    {'request_id':identifier, **state['payload']},credential=credential)
+            except OSError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise OSError(f"private support response unavailable; keep request {identifier} and use report-status or confirm this same preview") from None
+            if not 200 <= code < 300:
                 state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
                 raise ValueError(f"private support request {identifier} needs recovery (HTTP {code}); use report-status or confirm this same preview")
-            state['status'] = result.get('submission_state','unknown'); GitHubIssues._save(path,state)
-            return result
+            try:
+                receipt = support_receipt(result, identifier)
+            except ValueError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise
+            state['status'] = receipt['submission_state']; GitHubIssues._save(path,state)
+            if state['status'] != 'filed':
+                raise ValueError(f"private support request {identifier} needs recovery ({state['status']}); use report-status or confirm this same preview")
+            return receipt
 
     def status(self, identifier):
         path, state = self._load('report',identifier,write=False)
         credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
         code, result = self.api(self.root,state['destination'],f'/api/v1/support-reports/{identifier}',credential=credential)
-        if code >= 400:
+        if not 200 <= code < 300:
             raise ValueError(f"private support status unavailable (HTTP {code}); keep request {identifier}")
-        return result
+        return support_receipt(result, identifier)

package/runtime/pi/bin/settings.sh

@@ -56,7 +56,7 @@ _control_plane_push() {
   local api_url api_key payload actor response revision
   api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
   [ -n "$api_url" ] || return 0
-  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)
   [ -n "$api_key" ] || return 0
   actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
   payload=$(jq -c --arg by "$actor" '{
@@ -104,22 +104,78 @@ EOF
 
 # ── verbs ────────────────────────────────────────────────────────────────
 
+_hosting_status() {
+  # Read local configuration only. A saved key is not proof that the hosted
+  # service can be reached or that the credential is still accepted.
+  local api_key="" has_key=false slug recovery="egregore connect"
+  if [ -r "$SCRIPT_DIR/.env" ]; then
+    api_key=$(sed -n 's/^EGREGORE_API_KEY=//p' "$SCRIPT_DIR/.env" | tail -n 1)
+    api_key="${api_key#"${api_key%%[![:space:]]*}"}"
+    api_key="${api_key%"${api_key##*[![:space:]]}"}"
+    case "$api_key" in
+      \"*\"|\'*\') api_key="${api_key:1:${#api_key}-2}" ;;
+    esac
+    [ -n "${api_key//[[:space:]]/}" ] && has_key=true
+  fi
+  # Match publish-artifact.sh's route selection separately from the saved
+  # configuration check. Raw nonempty overrides (even malformed ones) select
+  # organisation upload, so they must never imply the public relay's expiry.
+  local effective_url="${EGREGORE_API_URL:-}" effective_key="${EGREGORE_API_KEY:-}" org_route=false
+  if [ -f "$SCRIPT_DIR/.env" ]; then
+    effective_url="${effective_url:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+    effective_key="${effective_key:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+  fi
+  effective_url="${effective_url:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
+  if [ -n "$effective_url" ] && [ -n "$effective_key" ]; then org_route=true; fi
+  slug=$(jq -r '.slug // empty' "$CONFIG")
+  if _valid_token "$slug"; then recovery="egregore connect $slug"; fi
+  jq --argjson has_key "$has_key" --argjson org_route "$org_route" --arg recovery "$recovery" '
+    def nonblank: if type == "string" then test("\\S") else false end;
+    (.features.publishing != false) as $publishing |
+    (.features.public_relay == true) as $relay |
+    (((if .mode == null then "connected" else .mode end) == "connected") and
+      (.api_url | nonblank) and $has_key) as $configured |
+    (if $publishing == false then "disabled"
+     elif $configured then "connected_configured"
+     elif $org_route then "setup_incomplete"
+     elif $relay then "public_relay"
+     else "setup_incomplete" end) as $readiness |
+    {
+      domain: "hosting",
+      publishing: $publishing,
+      readiness: $readiness,
+      connection_configured: $configured,
+      public_relay: $relay,
+      connectivity: "not_checked",
+      recovery_command: (if $readiness == "setup_incomplete" then $recovery else null end)
+    }' "$CONFIG"
+}
+
 cmd_hosting() {
   local action="${1:-status}"
-  # NEVER use jq's `// "true"` here: `//` treats an explicit `false` as empty and
-  # would return the default, silently defeating the off-switch. Test `!= false`
-  # so absent/true => enabled, explicit false => disabled. `enabled` is the
-  # resolved boolean string ("true"/"false").
-  local enabled; enabled="$(jq -r '.features.publishing != false' "$CONFIG" 2>/dev/null || echo "true")"
   case "$action" in
     status)
+      local status; status="$(_hosting_status)"
       if [ "$JSON" = 1 ]; then
-        jq -n --argjson on "$enabled" '{domain:"hosting", publishing:$on}'
-      elif [ "$enabled" = "false" ]; then echo "Hosting (egregore.xyz): OFF"
-      else echo "Hosting (egregore.xyz): ON"; fi ;;
+        printf '%s\n' "$status"
+      else
+        case "$(printf '%s' "$status" | jq -r '.readiness')" in
+          disabled) echo "Hosting (egregore.xyz): OFF" ;;
+          connected_configured)
+            echo "Hosting (egregore.xyz): ACCESS CONFIGURED"
+            echo "  Connection not checked." ;;
+          public_relay)
+            echo "Hosting (egregore.xyz): PUBLIC RELAY"
+            echo "  Anyone with the link can read published artifacts for 7 days. Connection not checked." ;;
+          setup_incomplete)
+            echo "Hosting (egregore.xyz): SETUP INCOMPLETE"
+            echo "  Publishing is enabled; connection setup is incomplete."
+            echo "  Run: $(printf '%s' "$status" | jq -r '.recovery_command')" ;;
+        esac
+      fi ;;
     on)
       _save '.features.publishing = true'
-      echo "Hosting (egregore.xyz): ON" ;;
+      JSON=0 cmd_hosting status ;;
     off)
       _save '.features.publishing = false'
       echo "Hosting (egregore.xyz): OFF — artifacts will no longer upload to egregore.xyz" ;;
@@ -378,10 +434,12 @@ cmd_people() {
 cmd_dump() {
   # Always JSON — the launcher calls this once to render the whole settings screen.
   local people; people="$(_people_json)"
-  jq --argjson people "$people" '{
+  local hosting_status; hosting_status="$(_hosting_status)"
+  jq --argjson people "$people" --argjson hosting_status "$hosting_status" '{
     org: .org_name,
     slug: .slug,
     hosting: (.features.publishing != false),
+    hosting_status: $hosting_status,
     public_relay: (.features.public_relay == true),
     workflow: (
       if ((if has("base_branch") then .base_branch else "develop" end) == "main") then "simple"

package/runtime/pi/egregore_runtime/issue_reporting.py

@@ -21,6 +21,26 @@ from .policy import scope_allows_path
 KINDS = {"bug", "improvement", "question"}
 AREAS = {"runtime", "onboarding", "connectors", "site", "other"}
 SEVERITIES = {"critical", "high", "normal"}
+SUPPORT_STATES = {"filed", "failed", "submitting", "uncertain"}
+
+
+def support_receipt(result, identifier):
+    """Accept only a receipt for this request; filing never proves notification."""
+    if (not isinstance(result, dict) or result.get('request_id') != identifier
+        or not isinstance(result.get('submission_state'), str)
+        or result['submission_state'] not in SUPPORT_STATES):
+        raise ValueError(f"private support returned an invalid receipt; keep request {identifier} and use report-status")
+    state = result['submission_state']
+    notices = {
+        'filed': 'Filed with Egregore support. Telegram delivery has not been verified.',
+        'failed': 'Report preserved; support filing failed. Retry this same request.',
+        'submitting': 'Report preserved; support filing is not confirmed. Keep this request ID and check report-status.',
+        'uncertain': 'Report preserved; support filing needs reconciliation. Keep this request ID and check report-status.',
+    }
+    return {'request_id': identifier, 'submission_state': state,
+            'retryable': state == 'failed',
+            'reconciliation_needed': state in {'submitting', 'uncertain'},
+            'notification_state': 'unverified', 'notice': notices[state]}
 
 
 def _scrub(value, *, public=False):
@@ -207,18 +227,29 @@ class FrameworkReporting:
                 return {'request_id':identifier,'status':result['status'],'github_url':result['github_url']}
             credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
             state['status'] = 'submitting'; GitHubIssues._save(path,state)
-            code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
-                {'request_id':identifier, **state['payload']},credential=credential)
-            if code >= 400:
+            try:
+                code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
+                    {'request_id':identifier, **state['payload']},credential=credential)
+            except OSError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise OSError(f"private support response unavailable; keep request {identifier} and use report-status or confirm this same preview") from None
+            if not 200 <= code < 300:
                 state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
                 raise ValueError(f"private support request {identifier} needs recovery (HTTP {code}); use report-status or confirm this same preview")
-            state['status'] = result.get('submission_state','unknown'); GitHubIssues._save(path,state)
-            return result
+            try:
+                receipt = support_receipt(result, identifier)
+            except ValueError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise
+            state['status'] = receipt['submission_state']; GitHubIssues._save(path,state)
+            if state['status'] != 'filed':
+                raise ValueError(f"private support request {identifier} needs recovery ({state['status']}); use report-status or confirm this same preview")
+            return receipt
 
     def status(self, identifier):
         path, state = self._load('report',identifier,write=False)
         credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
         code, result = self.api(self.root,state['destination'],f'/api/v1/support-reports/{identifier}',credential=credential)
-        if code >= 400:
+        if not 200 <= code < 300:
             raise ValueError(f"private support status unavailable (HTTP {code}); keep request {identifier}")
-        return result
+        return support_receipt(result, identifier)

package/runtime/prime/bin/settings.sh

@@ -56,7 +56,7 @@ _control_plane_push() {
   local api_url api_key payload actor response revision
   api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
   [ -n "$api_url" ] || return 0
-  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)
   [ -n "$api_key" ] || return 0
   actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
   payload=$(jq -c --arg by "$actor" '{
@@ -104,22 +104,78 @@ EOF
 
 # ── verbs ────────────────────────────────────────────────────────────────
 
+_hosting_status() {
+  # Read local configuration only. A saved key is not proof that the hosted
+  # service can be reached or that the credential is still accepted.
+  local api_key="" has_key=false slug recovery="egregore connect"
+  if [ -r "$SCRIPT_DIR/.env" ]; then
+    api_key=$(sed -n 's/^EGREGORE_API_KEY=//p' "$SCRIPT_DIR/.env" | tail -n 1)
+    api_key="${api_key#"${api_key%%[![:space:]]*}"}"
+    api_key="${api_key%"${api_key##*[![:space:]]}"}"
+    case "$api_key" in
+      \"*\"|\'*\') api_key="${api_key:1:${#api_key}-2}" ;;
+    esac
+    [ -n "${api_key//[[:space:]]/}" ] && has_key=true
+  fi
+  # Match publish-artifact.sh's route selection separately from the saved
+  # configuration check. Raw nonempty overrides (even malformed ones) select
+  # organisation upload, so they must never imply the public relay's expiry.
+  local effective_url="${EGREGORE_API_URL:-}" effective_key="${EGREGORE_API_KEY:-}" org_route=false
+  if [ -f "$SCRIPT_DIR/.env" ]; then
+    effective_url="${effective_url:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+    effective_key="${effective_key:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+  fi
+  effective_url="${effective_url:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
+  if [ -n "$effective_url" ] && [ -n "$effective_key" ]; then org_route=true; fi
+  slug=$(jq -r '.slug // empty' "$CONFIG")
+  if _valid_token "$slug"; then recovery="egregore connect $slug"; fi
+  jq --argjson has_key "$has_key" --argjson org_route "$org_route" --arg recovery "$recovery" '
+    def nonblank: if type == "string" then test("\\S") else false end;
+    (.features.publishing != false) as $publishing |
+    (.features.public_relay == true) as $relay |
+    (((if .mode == null then "connected" else .mode end) == "connected") and
+      (.api_url | nonblank) and $has_key) as $configured |
+    (if $publishing == false then "disabled"
+     elif $configured then "connected_configured"
+     elif $org_route then "setup_incomplete"
+     elif $relay then "public_relay"
+     else "setup_incomplete" end) as $readiness |
+    {
+      domain: "hosting",
+      publishing: $publishing,
+      readiness: $readiness,
+      connection_configured: $configured,
+      public_relay: $relay,
+      connectivity: "not_checked",
+      recovery_command: (if $readiness == "setup_incomplete" then $recovery else null end)
+    }' "$CONFIG"
+}
+
 cmd_hosting() {
   local action="${1:-status}"
-  # NEVER use jq's `// "true"` here: `//` treats an explicit `false` as empty and
-  # would return the default, silently defeating the off-switch. Test `!= false`
-  # so absent/true => enabled, explicit false => disabled. `enabled` is the
-  # resolved boolean string ("true"/"false").
-  local enabled; enabled="$(jq -r '.features.publishing != false' "$CONFIG" 2>/dev/null || echo "true")"
   case "$action" in
     status)
+      local status; status="$(_hosting_status)"
       if [ "$JSON" = 1 ]; then
-        jq -n --argjson on "$enabled" '{domain:"hosting", publishing:$on}'
-      elif [ "$enabled" = "false" ]; then echo "Hosting (egregore.xyz): OFF"
-      else echo "Hosting (egregore.xyz): ON"; fi ;;
+        printf '%s\n' "$status"
+      else
+        case "$(printf '%s' "$status" | jq -r '.readiness')" in
+          disabled) echo "Hosting (egregore.xyz): OFF" ;;
+          connected_configured)
+            echo "Hosting (egregore.xyz): ACCESS CONFIGURED"
+            echo "  Connection not checked." ;;
+          public_relay)
+            echo "Hosting (egregore.xyz): PUBLIC RELAY"
+            echo "  Anyone with the link can read published artifacts for 7 days. Connection not checked." ;;
+          setup_incomplete)
+            echo "Hosting (egregore.xyz): SETUP INCOMPLETE"
+            echo "  Publishing is enabled; connection setup is incomplete."
+            echo "  Run: $(printf '%s' "$status" | jq -r '.recovery_command')" ;;
+        esac
+      fi ;;
     on)
       _save '.features.publishing = true'
-      echo "Hosting (egregore.xyz): ON" ;;
+      JSON=0 cmd_hosting status ;;
     off)
       _save '.features.publishing = false'
       echo "Hosting (egregore.xyz): OFF — artifacts will no longer upload to egregore.xyz" ;;
@@ -378,10 +434,12 @@ cmd_people() {
 cmd_dump() {
   # Always JSON — the launcher calls this once to render the whole settings screen.
   local people; people="$(_people_json)"
-  jq --argjson people "$people" '{
+  local hosting_status; hosting_status="$(_hosting_status)"
+  jq --argjson people "$people" --argjson hosting_status "$hosting_status" '{
     org: .org_name,
     slug: .slug,
     hosting: (.features.publishing != false),
+    hosting_status: $hosting_status,
     public_relay: (.features.public_relay == true),
     workflow: (
       if ((if has("base_branch") then .base_branch else "develop" end) == "main") then "simple"

package/runtime/prime/egregore_runtime/issue_reporting.py

@@ -21,6 +21,26 @@ from .policy import scope_allows_path
 KINDS = {"bug", "improvement", "question"}
 AREAS = {"runtime", "onboarding", "connectors", "site", "other"}
 SEVERITIES = {"critical", "high", "normal"}
+SUPPORT_STATES = {"filed", "failed", "submitting", "uncertain"}
+
+
+def support_receipt(result, identifier):
+    """Accept only a receipt for this request; filing never proves notification."""
+    if (not isinstance(result, dict) or result.get('request_id') != identifier
+        or not isinstance(result.get('submission_state'), str)
+        or result['submission_state'] not in SUPPORT_STATES):
+        raise ValueError(f"private support returned an invalid receipt; keep request {identifier} and use report-status")
+    state = result['submission_state']
+    notices = {
+        'filed': 'Filed with Egregore support. Telegram delivery has not been verified.',
+        'failed': 'Report preserved; support filing failed. Retry this same request.',
+        'submitting': 'Report preserved; support filing is not confirmed. Keep this request ID and check report-status.',
+        'uncertain': 'Report preserved; support filing needs reconciliation. Keep this request ID and check report-status.',
+    }
+    return {'request_id': identifier, 'submission_state': state,
+            'retryable': state == 'failed',
+            'reconciliation_needed': state in {'submitting', 'uncertain'},
+            'notification_state': 'unverified', 'notice': notices[state]}
 
 
 def _scrub(value, *, public=False):
@@ -207,18 +227,29 @@ class FrameworkReporting:
                 return {'request_id':identifier,'status':result['status'],'github_url':result['github_url']}
             credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
             state['status'] = 'submitting'; GitHubIssues._save(path,state)
-            code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
-                {'request_id':identifier, **state['payload']},credential=credential)
-            if code >= 400:
+            try:
+                code, result = self.api(self.root,state['destination'],'/api/v1/support-reports',
+                    {'request_id':identifier, **state['payload']},credential=credential)
+            except OSError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise OSError(f"private support response unavailable; keep request {identifier} and use report-status or confirm this same preview") from None
+            if not 200 <= code < 300:
                 state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
                 raise ValueError(f"private support request {identifier} needs recovery (HTTP {code}); use report-status or confirm this same preview")
-            state['status'] = result.get('submission_state','unknown'); GitHubIssues._save(path,state)
-            return result
+            try:
+                receipt = support_receipt(result, identifier)
+            except ValueError:
+                state['status'] = 'reconciliation_needed'; GitHubIssues._save(path,state)
+                raise
+            state['status'] = receipt['submission_state']; GitHubIssues._save(path,state)
+            if state['status'] != 'filed':
+                raise ValueError(f"private support request {identifier} needs recovery ({state['status']}); use report-status or confirm this same preview")
+            return receipt
 
     def status(self, identifier):
         path, state = self._load('report',identifier,write=False)
         credential, _ = self._verified_credential(state['destination'],state['authenticated_org'])
         code, result = self.api(self.root,state['destination'],f'/api/v1/support-reports/{identifier}',credential=credential)
-        if code >= 400:
+        if not 200 <= code < 300:
             raise ValueError(f"private support status unavailable (HTTP {code}); keep request {identifier}")
-        return result
+        return support_receipt(result, identifier)