From 3bbc9b550c2416913b3a1d1d24ad9728a89fe0db Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 09:30:40 +0200
Subject: [PATCH 01/11] Update Reprint to 0.11.0 and drop the export window

Reprint 0.11.0 refuses shared secrets on hosts with OpenSSL and expects
every error body to carry auth_version 2. The exporter adds it, and answers
no_keys_enrolled with a 503, as it does not_configured.

The plugin is installed for one migration and removed after it, and
Reprint now verifies public keys, so the hour-long export window adds
nothing. A valid credential turns the exporter on: the enabled options,
the enable-export route, the manual on/off checkbox and the "Set up by
WordPress.com" mode are gone. The "Site ready to migrate" mode takes the
site address sentence from it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                                     |  15 +-
 plugin/composer.json                          |   2 +-
 plugin/composer.lock                          |  18 +-
 plugin/reprint/class-exporter.php             | 159 ++++--------------
 plugin/reprint/class-manual-page.php          |  99 ++---------
 plugin/reprint/class-rest-controller.php      |  52 +-----
 plugin/reprint/class-settings-page.php        |  55 +++---
 tests/e2e/blueprint-connection.json           |  10 +-
 tests/e2e/blueprint-enabled-hash-deleted.json |  18 --
 ...open.json => blueprint-no-credential.json} |   4 -
 tests/e2e/blueprint-screen.json               |  30 +---
 tests/e2e/blueprint-secret-hash-deleted.json  |   6 +-
 ...rint-closed.json => blueprint-secret.json} |   6 +-
 tests/e2e/connection-steps.php                |  32 +---
 tests/e2e/request.php                         | 155 +++++++----------
 tests/e2e/run.sh                              |   2 +-
 tests/e2e/screen-steps.php                    |  81 +++------
 17 files changed, 187 insertions(+), 557 deletions(-)
 delete mode 100644 tests/e2e/blueprint-enabled-hash-deleted.json
 rename tests/e2e/{blueprint-open.json => blueprint-no-credential.json} (57%)
 rename tests/e2e/{blueprint-closed.json => blueprint-secret.json} (65%)

diff --git a/README.md b/README.md
index 91e59b2f..e4f79cb3 100644
--- a/README.md
+++ b/README.md
@@ -32,9 +32,8 @@ To activate a source checkout directly (without a build), run `composer install
 |---|---|---|
 | The exporter runs on single sites only | Multisite | Nothing |
 | The export credential no longer matches this site | The site's salts changed | *Connect WordPress.com*, or *Go to WordPress.com* and *Disconnect* when connected |
-| Pill: *Site ready to migrate* | The exporter is on | *Go to WordPress.com* |
-| Pill: *Connected to WordPress.com* | Logged in; the exporter is off | *Go to WordPress.com*, a *Disconnect* link |
-| Pill: *Set up by WordPress.com* | Provisioned with an application password; the exporter is off | *Go to WordPress.com* |
+| Pill: *Site ready to migrate* | A credential is stored, so the exporter is on | *Go to WordPress.com* |
+| Pill: *Connected to WordPress.com* | Logged in; no credential yet | *Go to WordPress.com*, a *Disconnect* link |
 | Log in with your WordPress.com account to connect this site | Fresh site | *Connect WordPress.com* |
 
 `Settings_Page::mode()` picks the first that fits, top to bottom. *Go to WordPress.com* links to `https://my.wordpress.com/sites`; the `wpcom_migration_continue_url` filter changes that.
@@ -49,17 +48,17 @@ On a network the old screen keeps its row in the network admin, and the *Setting
 
 ## Setting up Reprint manually
 
-`wp-admin/admin.php?page=wpcom-migration-manual` (`administrator` role, single-site only). Nothing links to it; support gives out the URL. It holds the export secret form and a *Remove secret* button; on a host with `openssl_verify()`, a public key textarea (*Enroll key*, PEM or one line, replacing any enrolled key) and a table with the enrolled key's id and a *Remove* button; the exporter toggle, the export URL and the WordPress.com blog ID. Removing either credential turns the exporter off and leaves the other in place. Deactivating the plugin disconnects and discards the secret and the exporter state.
+`wp-admin/admin.php?page=wpcom-migration-manual` (`administrator` role, single-site only). Nothing links to it; support gives out the URL. It holds the export secret form and a *Remove secret* button; on a host with `openssl_verify()`, a public key textarea (*Enroll key*, PEM or one line, replacing any enrolled key) and a table with the enrolled key's id and a *Remove* button; the export URL and the WordPress.com blog ID. Removing either credential leaves the other in place. Deactivating the plugin disconnects and discards both credentials.
 
 ## How WordPress.com provisions the exporter
 
-Two lanes end at the same three routes: `POST /wp-json/wpcom-migration/v1/reprint/install-public-key {"public_key"}` → `{ "key_id", "export_url" }`, `POST …/rotate-export-secret` → `{ "secret", "export_url" }` and `POST …/enable-export` → `{ "enabled_at", "export_url" }`. All require an administrator, authenticated either by core (an application password) or by a Jetpack user token, and all answer 501 on a network. Reprint transfers over https only.
+Two lanes end at the same two routes: `POST /wp-json/wpcom-migration/v1/reprint/install-public-key {"public_key"}` → `{ "key_id", "export_url" }` and `POST …/rotate-export-secret` → `{ "secret", "export_url" }`. All require an administrator, authenticated either by core (an application password) or by a Jetpack user token, and all answer 501 on a network. Reprint transfers over https only.
 
-Which credential WordPress.com sets up depends on the host. Where `openssl_verify()` exists, Reprint signs with keys: WordPress.com installs its public key (PEM or one line of base64, RSA, 3072 bits or more; anything else is a 400 `wpcom_migration_invalid_public_key`), and `rotate-export-secret` answers 501 `wpcom_migration_secret_auth_unsupported`. Elsewhere it rotates the secret, and `install-public-key` answers 501 `wpcom_migration_key_auth_unsupported`. The site holds one key at a time; installing another replaces it. `enable-export` answers 409 `wpcom_migration_no_credential` until either credential is stored and valid. Export requests are verified by Reprint's `RequestAuthenticator`, which accepts whichever of the two the host supports.
+Which credential WordPress.com sets up depends on the host. Where `openssl_verify()` exists, Reprint signs with keys: WordPress.com installs its public key (PEM or one line of base64, RSA, 3072 bits or more; anything else is a 400 `wpcom_migration_invalid_public_key`), and `rotate-export-secret` answers 501 `wpcom_migration_secret_auth_unsupported`. Elsewhere it rotates the secret, and `install-public-key` answers 501 `wpcom_migration_key_auth_unsupported`. The site holds one key at a time; installing another replaces it. The exporter is on while either credential is stored and valid; there is no separate switch and no time limit, since the plugin is removed once the migration is done. Export requests are verified by Reprint's `RequestAuthenticator`, which accepts whichever of the two the host supports.
 
-**Application password** — where `GET /wp-json/` lists `authentication.application-passwords` (core: `is_ssl()` true and no plugin has switched them off). WordPress.com sends the administrator once to `wp-admin/authorize-application.php?app_name=Migrate+to+WordPress.com&app_id=<uuid>&success_url=…&reject_url=…`; core redirects to `success_url` with `site_url`, `user_login` and `password`. WordPress.com then checks the password with `GET /wp-json/wp/v2/users/me` (a 401 here means the server strips the `Authorization` header — Apache CGI without the rewrite rule WordPress 5.6 added; saving Permalinks regenerates it), installs and activates the plugin (`POST /wp-json/wp/v2/plugins {"slug":"wpcom-migration","status":"active"}`; an older copy is replaced by `PUT …/plugins/wpcom-migration/wpcom_migration {"status":"inactive"}`, `DELETE`, then the `POST`, since core has no update route), calls the two routes, exports, and revokes the password (`GET …/users/me/application-passwords/introspect`, then `DELETE …/application-passwords/<uuid>`). No login on the site.
+**Application password** — where `GET /wp-json/` lists `authentication.application-passwords` (core: `is_ssl()` true and no plugin has switched them off). WordPress.com sends the administrator once to `wp-admin/authorize-application.php?app_name=Migrate+to+WordPress.com&app_id=<uuid>&success_url=…&reject_url=…`; core redirects to `success_url` with `site_url`, `user_login` and `password`. WordPress.com then checks the password with `GET /wp-json/wp/v2/users/me` (a 401 here means the server strips the `Authorization` header — Apache CGI without the rewrite rule WordPress 5.6 added; saving Permalinks regenerates it), installs and activates the plugin (`POST /wp-json/wp/v2/plugins {"slug":"wpcom-migration","status":"active"}`; an older copy is replaced by `PUT …/plugins/wpcom-migration/wpcom_migration {"status":"inactive"}`, `DELETE`, then the `POST`, since core has no update route), calls the route for the host's credential, exports, and revokes the password (`GET …/users/me/application-passwords/introspect`, then `DELETE …/application-passwords/<uuid>`). No login on the site.
 
-**Jetpack connection** — everywhere else, including sites where Wordfence or another security plugin has disabled application passwords. The administrator installs the plugin from the plugin directory and presses *Connect WordPress.com* on the screen; the connection package registers the site and sends them to WordPress.com to authorize, then back. A site that already runs Jetpack is connected at once for the account that connected Jetpack — the connection is shared. WordPress.com then calls the routes signed with the user token.
+**Jetpack connection** — everywhere else, including sites where Wordfence or another security plugin has disabled application passwords. The administrator installs the plugin from the plugin directory and presses *Connect WordPress.com* on the screen; the connection package registers the site and sends them to WordPress.com to authorize, then back. A site that already runs Jetpack is connected at once for the account that connected Jetpack — the connection is shared. WordPress.com then calls the route signed with the user token.
 
 Connection events fire `wpcom_migration_connection_event`, exporter events `wpcom_migration_reprint_export_event`; none carries a token, secret or signature.
 
diff --git a/plugin/composer.json b/plugin/composer.json
index 28845f56..98eec8ba 100644
--- a/plugin/composer.json
+++ b/plugin/composer.json
@@ -8,7 +8,7 @@
         "automattic/jetpack-autoloader": "^6",
         "automattic/jetpack-config": "^4.0",
         "automattic/jetpack-connection": "^9.1",
-        "wp-php-toolkit/reprint-server": "0.10.13"
+        "wp-php-toolkit/reprint-server": "0.11.0"
     },
     "autoload": {
         "classmap": [
diff --git a/plugin/composer.lock b/plugin/composer.lock
index dd243a08..4048e695 100644
--- a/plugin/composer.lock
+++ b/plugin/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "4b89aa46ef6e3fecde290380e8e01762",
+    "content-hash": "b0f08b481b4e392fc2bd7939f2b63053",
     "packages": [
         {
             "name": "automattic/jetpack-a8c-mc-stats",
@@ -650,16 +650,16 @@
         },
         {
             "name": "wp-php-toolkit/reprint-server",
-            "version": "v0.10.13",
+            "version": "v0.11.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/wp-php-toolkit/reprint-server",
-                "reference": "2b298f2af6d15bc34d51ad4bc965d4a4c51765ea"
+                "url": "https://github.com/wp-php-toolkit/reprint-server.git",
+                "reference": "00e4dd6812dad5fcd5aed85878322c1f08023af5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/wp-php-toolkit/reprint-server/zipball/2b298f2af6d15bc34d51ad4bc965d4a4c51765ea",
-                "reference": "2b298f2af6d15bc34d51ad4bc965d4a4c51765ea",
+                "url": "https://api.github.com/repos/wp-php-toolkit/reprint-server/zipball/00e4dd6812dad5fcd5aed85878322c1f08023af5",
+                "reference": "00e4dd6812dad5fcd5aed85878322c1f08023af5",
                 "shasum": ""
             },
             "require": {
@@ -684,7 +684,11 @@
                 "GPL-2.0-or-later"
             ],
             "description": "Streaming export engine used by the Reprint Server WordPress plugin",
-            "time": "2026-10-01T13:01:25+00:00"
+            "support": {
+                "issues": "https://github.com/wp-php-toolkit/reprint-server/issues",
+                "source": "https://github.com/wp-php-toolkit/reprint-server/tree/v0.11.0"
+            },
+            "time": "2026-10-08T19:38:46+00:00"
         }
     ],
     "packages-dev": [],
diff --git a/plugin/reprint/class-exporter.php b/plugin/reprint/class-exporter.php
index c70921d3..0887c75e 100644
--- a/plugin/reprint/class-exporter.php
+++ b/plugin/reprint/class-exporter.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Signed, time-limited Reprint export.
+ * Signed Reprint export.
  *
  * Modeled on Jetpack's Reprint_Exporter (Automattic/jetpack#52278).
  *
@@ -53,21 +53,6 @@ class Exporter {
 	 */
 	const PUBLIC_KEY_HASH_OPTION = 'wpcom_migration_reprint_public_key_hash';
 
-	/**
-	 * Option holding the unix time the export window was last opened. The
-	 * window is a sliding 60-minute one.
-	 *
-	 * @var string
-	 */
-	const ENABLED_OPTION = 'wpcom_migration_reprint_enabled';
-
-	/**
-	 * Option holding the HMAC of the window stamp under the site's auth salt.
-	 *
-	 * @var string
-	 */
-	const ENABLED_HASH_OPTION = 'wpcom_migration_reprint_enabled_hash';
-
 	/**
 	 * The options only this class may write.
 	 *
@@ -78,13 +63,10 @@ class Exporter {
 		self::SECRET_HASH_OPTION,
 		self::PUBLIC_KEY_OPTION,
 		self::PUBLIC_KEY_HASH_OPTION,
-		self::ENABLED_OPTION,
-		self::ENABLED_HASH_OPTION,
 	);
 
 	/**
-	 * Clock-skew tolerance, in seconds, allowed for request signatures and
-	 * the window stamp.
+	 * Clock-skew tolerance, in seconds, allowed for request signatures.
 	 *
 	 * @var int
 	 */
@@ -207,7 +189,6 @@ public static function record_event( $event, array $context = array() ) {
 		 * @param string $event   One of export_served, export_refused,
 		 *                        secret_rotated, secret_removed,
 		 *                        public_key_installed, public_key_removed,
-		 *                        window_opened, window_closed,
 		 *                        credentials_discarded, credential_hash_mismatch.
 		 * @param array  $context Details of the event.
 		 */
@@ -235,23 +216,21 @@ public static function discard_credentials() {
 	}
 
 	/**
-	 * Discards the stored secret and turns the exporter off, leaving any
-	 * public key in place.
+	 * Discards the stored secret, leaving any public key in place.
 	 */
 	public static function discard_secret() {
 		self::discard_credential( self::SECRET_OPTION, self::SECRET_HASH_OPTION, 'secret_removed' );
 	}
 
 	/**
-	 * Discards the stored public key and turns the exporter off, leaving any
-	 * secret in place.
+	 * Discards the stored public key, leaving any secret in place.
 	 */
 	public static function discard_public_key() {
 		self::discard_credential( self::PUBLIC_KEY_OPTION, self::PUBLIC_KEY_HASH_OPTION, 'public_key_removed' );
 	}
 
 	/**
-	 * Deletes one credential and its hash, and closes the export window.
+	 * Deletes one credential and its hash.
 	 *
 	 * @param string $option      The credential's option.
 	 * @param string $hash_option The option holding its hash.
@@ -260,7 +239,6 @@ public static function discard_public_key() {
 	private static function discard_credential( $option, $hash_option, $event ) {
 		$had_any = delete_option( $option );
 		$had_any = delete_option( $hash_option ) || $had_any;
-		self::close_export_window();
 
 		if ( $had_any ) {
 			self::record_event( $event, array( 'user_id' => get_current_user_id() ) );
@@ -270,8 +248,6 @@ private static function discard_credential( $option, $hash_option, $event ) {
 	/**
 	 * Stores a shared secret together with its salt-keyed hash.
 	 *
-	 * Saving a secret does not touch the export window.
-	 *
 	 * @param string $secret The new secret.
 	 * @return bool Whether the secret and a matching hash are now stored.
 	 */
@@ -295,7 +271,7 @@ public static function store_secret( $secret ) {
 	 * key stored before.
 	 *
 	 * Takes the one-line form PublicKeyServer::assert_valid_public_key()
-	 * returns. Saving a key touches neither the secret nor the export window.
+	 * returns. Saving a key leaves any secret in place.
 	 *
 	 * @param string $public_key The one-line public key.
 	 * @return bool Whether the key and a matching hash are now stored.
@@ -320,8 +296,8 @@ public static function store_public_key( $public_key ) {
 	 * stores its own salt in wp_options, where whoever can write the credential
 	 * can read it, so the hashes add no protection there.
 	 *
-	 * The option name prefixes the message, so copying the window timestamp
-	 * and its hash into the secret options does not make a secret that
+	 * The option name prefixes the message, so copying one credential and
+	 * its hash into the other's options does not make a credential that
 	 * verifies.
 	 *
 	 * @param string     $hash_option The option the hash is stored in.
@@ -349,60 +325,16 @@ private static function credential_hash_matches( $hash_option, $value ) {
 		return hash_equals( self::compute_credential_hash( $hash_option, $value ), $stored_hash );
 	}
 
-	/**
-	 * Whether the current export window is open.
-	 *
-	 * @param int|null $now Unix time to compare against, or null for now.
-	 * @return bool
-	 */
-	public static function is_export_window_open( $now = null ) {
-		$enabled_at = (int) get_option( self::ENABLED_OPTION, 0 );
-		$now        = null === $now ? time() : (int) $now;
-
-		return $enabled_at > 0
-			&& $enabled_at <= $now + self::CLOCK_SKEW
-			&& ( $now - $enabled_at ) <= HOUR_IN_SECONDS
-			&& self::credential_hash_matches( self::ENABLED_HASH_OPTION, $enabled_at );
-	}
-
-	/**
-	 * Opens the export window by stamping the enabled option with the current
-	 * time and hashing the stamp.
-	 *
-	 * @return int The unix time the window was opened at.
-	 */
-	public static function open_export_window() {
-		$now = time();
-
-		// Value then hash: a crash between them leaves a mismatch, which reads
-		// as closed. Each skips an unchanged value, so a busy client costs at
-		// most two writes per elapsed second.
-		self::write_option( self::ENABLED_OPTION, $now );
-		self::write_option( self::ENABLED_HASH_OPTION, self::compute_credential_hash( self::ENABLED_HASH_OPTION, $now ) );
-
-		return $now;
-	}
-
-	/**
-	 * Closes the export window.
-	 */
-	public static function close_export_window() {
-		delete_option( self::ENABLED_OPTION );
-		delete_option( self::ENABLED_HASH_OPTION );
-	}
-
 	/**
 	 * The state the screens render.
 	 *
 	 * @return array {
-	 *     @type bool     $has_secret        Whether a secret is stored.
-	 *     @type bool     $secret_valid      Whether its hash matches under the current salt.
-	 *     @type bool     $has_public_key    Whether a public key is stored.
-	 *     @type bool     $public_key_valid  Whether its hash matches under the current salt.
-	 *     @type bool     $has_credential    Whether either is stored.
-	 *     @type bool     $credential_valid  Whether either is valid.
-	 *     @type bool     $window_open       Whether the export window is open.
-	 *     @type int|null $window_expires_at Unix time the window lapses, or null when closed.
+	 *     @type bool $has_secret       Whether a secret is stored.
+	 *     @type bool $secret_valid     Whether its hash matches under the current salt.
+	 *     @type bool $has_public_key   Whether a public key is stored.
+	 *     @type bool $public_key_valid Whether its hash matches under the current salt.
+	 *     @type bool $has_credential   Whether either is stored.
+	 *     @type bool $credential_valid Whether either is valid, which turns the exporter on.
 	 * }
 	 */
 	public static function get_state() {
@@ -412,17 +344,14 @@ public static function get_state() {
 		$public_key       = get_option( self::PUBLIC_KEY_OPTION, '' );
 		$has_public_key   = is_string( $public_key ) && '' !== $public_key;
 		$public_key_valid = $has_public_key && self::credential_hash_matches( self::PUBLIC_KEY_HASH_OPTION, $public_key );
-		$window_open      = self::is_export_window_open();
 
 		return array(
-			'has_secret'        => $has_secret,
-			'secret_valid'      => $secret_valid,
-			'has_public_key'    => $has_public_key,
-			'public_key_valid'  => $public_key_valid,
-			'has_credential'    => $has_secret || $has_public_key,
-			'credential_valid'  => $secret_valid || $public_key_valid,
-			'window_open'       => $window_open,
-			'window_expires_at' => $window_open ? (int) get_option( self::ENABLED_OPTION, 0 ) + HOUR_IN_SECONDS : null,
+			'has_secret'       => $has_secret,
+			'secret_valid'     => $secret_valid,
+			'has_public_key'   => $has_public_key,
+			'public_key_valid' => $public_key_valid,
+			'has_credential'   => $has_secret || $has_public_key,
+			'credential_valid' => $secret_valid || $public_key_valid,
 		);
 	}
 
@@ -446,9 +375,7 @@ public function handle_request() {
 		// Any origin: the client may run in a browser (Playground) from
 		// deployments we cannot know ahead of time, and origin is no boundary
 		// when every request must be signed anyway. Preflights come before
-		// the signature check because browsers send them without credentials, and
-		// before the window check so a client whose window has closed can
-		// reach the 409 below.
+		// the signature check because browsers send them without credentials.
 		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
 		$request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper( $_SERVER['REQUEST_METHOD'] ) : '';
 		if ( 'OPTIONS' === $request_method ) {
@@ -460,25 +387,16 @@ public function handle_request() {
 			return;
 		}
 
-		// Without a valid signature a closed window answers nothing, so an idle
-		// site stays indistinguishable from one that never had the feature.
-		$state       = self::get_state();
-		$window_open = $state['window_open'];
-
+		// Without a credential the request answers nothing, so a site that was
+		// never set up stays indistinguishable from one without the feature.
+		$state = self::get_state();
 		if ( ! $state['has_credential'] ) {
-			if ( ! $window_open ) {
-				return;
-			}
-			$this->error( 503, 'Export not configured. Start the migration on WordPress.com.' );
 			return;
 		}
 
 		// A credential this class did not hash under the current salt is no
 		// credential at all, so it never reaches signature verification.
 		if ( ! $state['credential_valid'] ) {
-			if ( ! $window_open ) {
-				return;
-			}
 			self::record_event( 'credential_hash_mismatch' );
 			$this->error( 503, 'Export credential invalidated: the stored credential does not match this site\'s salts. Start the migration again on WordPress.com.' );
 			return;
@@ -494,27 +412,14 @@ public function handle_request() {
 
 		$auth_failure = $this->verify_signature( $secret, $public_keys );
 		if ( null !== $auth_failure ) {
-			if ( ! $window_open ) {
-				return;
-			}
-			// Reprint's client maps the reason to its message, and reads
-			// not_configured as an answer only from a 503.
-			$status = RequestAuthenticator::REASON_NOT_CONFIGURED === $auth_failure['reason'] ? 503 : 403;
+			// Reprint's client maps the reason to its message, and reads the
+			// two not-set-up reasons as an answer only from a 503.
+			$unconfigured = array( RequestAuthenticator::REASON_NOT_CONFIGURED, RequestAuthenticator::REASON_NO_KEYS_ENROLLED );
+			$status       = in_array( $auth_failure['reason'], $unconfigured, true ) ? 503 : 403;
 			$this->error( $status, $auth_failure['message'], $auth_failure['reason'] );
 			return;
 		}
 
-		// Signature checks out, so say which state this is: still here, only
-		// needing re-arming, rather than gone.
-		if ( ! $window_open ) {
-			$this->error( 409, 'Export window closed. Enable the exporter on the settings screen.' );
-			return;
-		}
-
-		// An export spans many requests and can run past the hour, so keep the
-		// window open while a client is working.
-		self::open_export_window();
-
 		try {
 			$this->serve_export();
 		} catch ( \InvalidArgumentException $exception ) {
@@ -602,6 +507,9 @@ protected function send_cors_headers() {
 	/**
 	 * Sends a JSON error response and terminates.
 	 *
+	 * The body carries Reprint's auth_version, without which its client
+	 * reports the plugin as outdated.
+	 *
 	 * @param int         $code    HTTP status code.
 	 * @param string      $message Error description.
 	 * @param string|null $reason  Machine-readable reason code, or null for none.
@@ -612,8 +520,9 @@ protected function error( $code, $message, $reason = null ) {
 			'reason' => $message,
 		);
 		$body    = array(
-			'error' => $message,
-			'code'  => $code,
+			'error'        => $message,
+			'code'         => $code,
+			'auth_version' => Utils::AUTH_VERSION,
 		);
 		if ( null !== $reason ) {
 			$context['reason_code'] = $reason;
diff --git a/plugin/reprint/class-manual-page.php b/plugin/reprint/class-manual-page.php
index 34785cf4..274aa209 100644
--- a/plugin/reprint/class-manual-page.php
+++ b/plugin/reprint/class-manual-page.php
@@ -1,7 +1,6 @@
 <?php
 /**
- * The by-hand screen: export secret, public key, exporter toggle, export URL,
- * blog ID.
+ * The by-hand screen: export secret, public key, export URL, blog ID.
  *
  * Nothing links here; support gives out the URL.
  *
@@ -38,14 +37,7 @@ class Manual_Page {
 	const SAVE_SECRET_ACTION = 'wpcom_migration_reprint_save_secret';
 
 	/**
-	 * The admin-post action that turns the exporter on or off.
-	 *
-	 * @var string
-	 */
-	const SAVE_ENABLED_ACTION = 'wpcom_migration_reprint_save_enabled';
-
-	/**
-	 * The admin-post action that removes the secret and turns the exporter off.
+	 * The admin-post action that removes the secret.
 	 *
 	 * @var string
 	 */
@@ -59,8 +51,7 @@ class Manual_Page {
 	const SAVE_PUBLIC_KEY_ACTION = 'wpcom_migration_reprint_save_public_key';
 
 	/**
-	 * The admin-post action that removes the public key and turns the
-	 * exporter off.
+	 * The admin-post action that removes the public key.
 	 *
 	 * @var string
 	 */
@@ -87,13 +78,6 @@ class Manual_Page {
 	 */
 	const PUBLIC_KEY_FIELD = 'wpcom_migration_reprint_public_key';
 
-	/**
-	 * Name of the enable checkbox.
-	 *
-	 * @var string
-	 */
-	const ENABLED_FIELD = 'wpcom_migration_reprint_enabled';
-
 	/**
 	 * Script handle for manual-page.js.
 	 *
@@ -132,7 +116,6 @@ public function __construct( $plugin_file ) {
 
 		add_action( 'admin_menu', array( $this, 'add_admin_menu' ), 21 );
 		add_action( 'admin_post_' . self::SAVE_SECRET_ACTION, array( $this, 'handle_save_secret' ) );
-		add_action( 'admin_post_' . self::SAVE_ENABLED_ACTION, array( $this, 'handle_save_enabled' ) );
 		add_action( 'admin_post_' . self::DISCARD_SECRET_ACTION, array( $this, 'handle_discard_secret' ) );
 		add_action( 'admin_post_' . self::SAVE_PUBLIC_KEY_ACTION, array( $this, 'handle_save_public_key' ) );
 		add_action( 'admin_post_' . self::REMOVE_PUBLIC_KEY_ACTION, array( $this, 'handle_remove_public_key' ) );
@@ -240,31 +223,7 @@ public function handle_save_secret() {
 	}
 
 	/**
-	 * Turns the exporter on or off and redirects back with a result notice.
-	 */
-	public function handle_save_enabled() {
-		$this->authorize( self::SAVE_ENABLED_ACTION );
-
-		$state = Exporter::get_state();
-		if ( ! $state['credential_valid'] ) {
-			$this->redirect_with_notice( 'not_configured' );
-		}
-
-		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Checked in authorize().
-		if ( isset( $_POST[ self::ENABLED_FIELD ] ) ) {
-			Exporter::open_export_window();
-			Exporter::record_event( 'window_opened', array( 'user_id' => get_current_user_id() ) );
-			$this->redirect_with_notice( 'enabled' );
-		}
-
-		Exporter::close_export_window();
-		Exporter::record_event( 'window_closed', array( 'user_id' => get_current_user_id() ) );
-		$this->redirect_with_notice( 'disabled' );
-	}
-
-	/**
-	 * Removes the secret, turns the exporter off, and redirects back with a
-	 * result notice.
+	 * Removes the secret and redirects back with a result notice.
 	 */
 	public function handle_discard_secret() {
 		$this->authorize( self::DISCARD_SECRET_ACTION );
@@ -315,8 +274,7 @@ public function handle_save_public_key() {
 	}
 
 	/**
-	 * Removes the public key, turns the exporter off, and redirects back with
-	 * a result notice.
+	 * Removes the public key and redirects back with a result notice.
 	 */
 	public function handle_remove_public_key() {
 		$this->authorize( self::REMOVE_PUBLIC_KEY_ACTION );
@@ -346,11 +304,10 @@ private function authorize( $action ) {
 	/**
 	 * Redirects back to the screen with a result code and exits.
 	 *
-	 * @param string $result One of saved, unchanged, enabled, disabled,
-	 *                       discarded, not_configured, storage_failure,
-	 *                       key_saved, key_unchanged, key_removed,
-	 *                       key_invalid, key_unsupported,
-	 *                       key_storage_failure.
+	 * @param string $result One of saved, unchanged, discarded,
+	 *                       not_configured, storage_failure, key_saved,
+	 *                       key_unchanged, key_removed, key_invalid,
+	 *                       key_unsupported, key_storage_failure.
 	 */
 	private function redirect_with_notice( $result ) {
 		wp_safe_redirect( add_query_arg( self::NOTICE_QUERY_ARG, $result, self::page_url() ) );
@@ -359,8 +316,7 @@ private function redirect_with_notice( $result ) {
 
 	/**
 	 * Renders the screen: the secret form; the public key form and table; the
-	 * exporter toggle and export URL once a credential is valid; the blog ID
-	 * when connected.
+	 * export URL once a credential is valid; the blog ID when connected.
 	 */
 	public function render_page() {
 		if ( ! in_array( 'administrator', wp_get_current_user()->roles, true ) ) {
@@ -384,7 +340,6 @@ public function render_page() {
 		$this->render_public_key_section( $state );
 
 		if ( $state['credential_valid'] ) {
-			$this->render_enable_form( $state );
 			$this->render_api_url();
 		}
 
@@ -449,7 +404,7 @@ private function render_discard_form() {
 			<input type="hidden" name="action" value="<?php echo esc_attr( self::DISCARD_SECRET_ACTION ); ?>" />
 			<?php wp_nonce_field( self::DISCARD_SECRET_ACTION ); ?>
 			<button type="submit" name="wpcom_migration_reprint_discard_secret_submit" class="button-link"><?php esc_html_e( 'Remove secret', 'wpcom-migration' ); ?></button>
-			<p class="description"><?php esc_html_e( 'Also turns the exporter off. WordPress.com can no longer export this site with the secret until a new one is saved.', 'wpcom-migration' ); ?></p>
+			<p class="description"><?php esc_html_e( 'WordPress.com can no longer export this site with the secret until a new one is saved.', 'wpcom-migration' ); ?></p>
 		</form>
 		<?php
 	}
@@ -511,31 +466,6 @@ private function render_public_key_section( array $state ) {
 				</tr>
 			</tbody>
 		</table>
-		<p class="description"><?php esc_html_e( 'Removing the key also turns the exporter off.', 'wpcom-migration' ); ?></p>
-		<?php
-	}
-
-	/**
-	 * Renders the enable form.
-	 *
-	 * @param array $state Exporter::get_state().
-	 */
-	private function render_enable_form( array $state ) {
-		?>
-		<hr />
-		<h2><?php esc_html_e( 'Exporter', 'wpcom-migration' ); ?></h2>
-		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
-			<input type="hidden" name="action" value="<?php echo esc_attr( self::SAVE_ENABLED_ACTION ); ?>" />
-			<?php wp_nonce_field( self::SAVE_ENABLED_ACTION ); ?>
-			<label>
-				<input type="checkbox"
-					name="<?php echo esc_attr( self::ENABLED_FIELD ); ?>"
-					value="1"<?php checked( $state['window_open'] ); ?> />
-				<?php esc_html_e( 'Turn the exporter on', 'wpcom-migration' ); ?>
-			</label>
-			<p class="description"><?php esc_html_e( 'While on, anyone with the export secret or the private half of the public key can download this site\'s database and files. It turns itself off an hour after the last export.', 'wpcom-migration' ); ?></p>
-			<p><?php submit_button( __( 'Save', 'wpcom-migration' ), 'primary', 'wpcom_migration_reprint_save_enabled_submit', false ); ?></p>
-		</form>
 		<?php
 	}
 
@@ -557,6 +487,7 @@ class="button wpcom-migration-reprint-copy-url"
 			data-copied-message="<?php esc_attr_e( 'Export URL copied.', 'wpcom-migration' ); ?>">
 			<?php esc_html_e( 'Copy', 'wpcom-migration' ); ?>
 		</button>
+		<p class="description"><?php esc_html_e( 'Anyone with the export secret or the private half of the public key can download this site\'s database and files from this URL.', 'wpcom-migration' ); ?></p>
 		<?php
 	}
 
@@ -570,14 +501,12 @@ private function render_result_notice() {
 		$notices = array(
 			'saved'               => array( 'success', __( 'Secret saved.', 'wpcom-migration' ) ),
 			'unchanged'           => array( 'success', __( 'The secret was already up to date.', 'wpcom-migration' ) ),
-			'enabled'             => array( 'success', __( 'Exporter on for the next hour.', 'wpcom-migration' ) ),
-			'disabled'            => array( 'success', __( 'Exporter off.', 'wpcom-migration' ) ),
-			'discarded'           => array( 'success', __( 'Secret removed. The exporter is off.', 'wpcom-migration' ) ),
+			'discarded'           => array( 'success', __( 'Secret removed.', 'wpcom-migration' ) ),
 			'not_configured'      => array( 'error', __( 'Enter an export secret first.', 'wpcom-migration' ) ),
 			'storage_failure'     => array( 'error', __( 'The secret could not be saved.', 'wpcom-migration' ) ),
 			'key_saved'           => array( 'success', __( 'Public key saved.', 'wpcom-migration' ) ),
 			'key_unchanged'       => array( 'success', __( 'That public key was already enrolled.', 'wpcom-migration' ) ),
-			'key_removed'         => array( 'success', __( 'Public key removed. The exporter is off.', 'wpcom-migration' ) ),
+			'key_removed'         => array( 'success', __( 'Public key removed.', 'wpcom-migration' ) ),
 			'key_invalid'         => array( 'error', __( 'That is not a usable public key. Paste the RSA public key, 3072 bits or more, printed by "reprint keygen".', 'wpcom-migration' ) ),
 			'key_unsupported'     => array( 'error', __( 'Public keys need OpenSSL, which this host does not have.', 'wpcom-migration' ) ),
 			'key_storage_failure' => array( 'error', __( 'The public key could not be saved.', 'wpcom-migration' ) ),
diff --git a/plugin/reprint/class-rest-controller.php b/plugin/reprint/class-rest-controller.php
index 6dd0921c..b44a7d6d 100644
--- a/plugin/reprint/class-rest-controller.php
+++ b/plugin/reprint/class-rest-controller.php
@@ -22,8 +22,7 @@
 use WP_REST_Server;
 
 /**
- * POST wpcom-migration/v1/reprint/rotate-export-secret, install-public-key and
- * enable-export.
+ * POST wpcom-migration/v1/reprint/rotate-export-secret and install-public-key.
  */
 class REST_Controller extends WP_REST_Controller {
 
@@ -76,18 +75,6 @@ public function register_routes() {
 				),
 			)
 		);
-
-		register_rest_route(
-			$this->namespace,
-			'/' . $this->rest_base . '/enable-export',
-			array(
-				array(
-					'methods'             => WP_REST_Server::CREATABLE,
-					'callback'            => array( $this, 'enable_export' ),
-					'permission_callback' => array( $this, 'permission_check' ),
-				),
-			)
-		);
 	}
 
 	/**
@@ -197,43 +184,6 @@ public function install_public_key( WP_REST_Request $request ) {
 		);
 	}
 
-	/**
-	 * Opens the export window without rotating the secret, so a caller that
-	 * already has a credential can reopen a window that closed.
-	 *
-	 * @return WP_REST_Response|WP_Error The unix time the window opened at.
-	 */
-	public function enable_export() {
-		$state = Exporter::get_state();
-		if ( ! $state['credential_valid'] ) {
-			return new WP_Error(
-				'wpcom_migration_no_credential',
-				__( 'Install a public key or save a secret first.', 'wpcom-migration' ),
-				array( 'status' => 409 )
-			);
-		}
-
-		$enabled_at = Exporter::open_export_window();
-
-		if ( ! Exporter::is_export_window_open() ) {
-			return new WP_Error(
-				'wpcom_migration_window_not_opened',
-				__( 'Failed to open the export window.', 'wpcom-migration' ),
-				array( 'status' => 500 )
-			);
-		}
-
-		Exporter::record_event( 'window_opened', array( 'user_id' => get_current_user_id() ) );
-
-		return new WP_REST_Response(
-			array(
-				'enabled_at' => $enabled_at,
-				'export_url' => $this->export_url(),
-			),
-			200
-		);
-	}
-
 	/**
 	 * An administrator, authenticated by a Jetpack user token or by core.
 	 *
diff --git a/plugin/reprint/class-settings-page.php b/plugin/reprint/class-settings-page.php
index dd493f3f..abe3fe24 100644
--- a/plugin/reprint/class-settings-page.php
+++ b/plugin/reprint/class-settings-page.php
@@ -48,7 +48,7 @@ class Settings_Page {
 	const MODE_BROKEN = 'broken';
 
 	/**
-	 * A credential is valid and the exporter is on.
+	 * A credential is valid, so the exporter is on.
 	 *
 	 * @var string
 	 */
@@ -61,13 +61,6 @@ class Settings_Page {
 	 */
 	const MODE_CONNECTED_WAITING = 'connected_waiting';
 
-	/**
-	 * WordPress.com installed a credential; the exporter is off; no user connection.
-	 *
-	 * @var string
-	 */
-	const MODE_PROVISIONED_WAITING = 'provisioned_waiting';
-
 	/**
 	 * Nothing set up yet.
 	 *
@@ -262,7 +255,7 @@ public static function mode( array $state, $user_connected ) {
 			return self::MODE_BROKEN;
 		}
 
-		if ( $state['credential_valid'] && $state['window_open'] ) {
+		if ( $state['credential_valid'] ) {
 			return self::MODE_READY;
 		}
 
@@ -270,10 +263,6 @@ public static function mode( array $state, $user_connected ) {
 			return self::MODE_CONNECTED_WAITING;
 		}
 
-		if ( $state['credential_valid'] ) {
-			return self::MODE_PROVISIONED_WAITING;
-		}
-
 		return self::MODE_NEEDS_CONNECTING;
 	}
 
@@ -307,8 +296,14 @@ private function render_mode( $mode, $user_connected ) {
 
 			case self::MODE_READY:
 				$this->render_pill_and_heading( __( 'Site ready to migrate', 'wpcom-migration' ), 'info' );
-				$this->render_sentence( __( 'Your site is now ready to be copied by WordPress.com. Your site stays online and unchanged while it\'s copied.', 'wpcom-migration' ) );
-				$this->render_sentence( __( 'Keep this plugin active until the migration is done. We email you when it\'s finished.', 'wpcom-migration' ) );
+				$this->render_sentence(
+					sprintf(
+						/* translators: %s: the site's address, without the scheme. */
+						__( '%s is ready to migrate. The migration runs from WordPress.com, so there\'s nothing else to do here. Your site stays online and unchanged while it\'s copied.', 'wpcom-migration' ),
+						self::site_address()
+					)
+				);
+				$this->render_sentence( __( 'Keep this plugin active until the migration is done. We\'ll email you when it\'s finished.', 'wpcom-migration' ) );
 				if ( null !== $section ) {
 					$section->render_continue_button();
 				}
@@ -316,21 +311,19 @@ private function render_mode( $mode, $user_connected ) {
 
 			case self::MODE_CONNECTED_WAITING:
 				$this->render_pill_and_heading( __( 'Connected to WordPress.com', 'wpcom-migration' ), 'success' );
-				$this->render_ready_to_migrate();
+				$this->render_sentence(
+					sprintf(
+						/* translators: %s: the site's address, without the scheme. */
+						__( '%s is ready to migrate. The migration runs from WordPress.com, so there\'s nothing else to do here.', 'wpcom-migration' ),
+						self::site_address()
+					)
+				);
 				if ( null !== $section ) {
 					$section->render_continue_button();
 					$section->render_disconnect_link();
 				}
 				return;
 
-			case self::MODE_PROVISIONED_WAITING:
-				$this->render_pill_and_heading( __( 'Set up by WordPress.com', 'wpcom-migration' ), 'info' );
-				$this->render_ready_to_migrate();
-				if ( null !== $section ) {
-					$section->render_continue_button();
-				}
-				return;
-
 			case self::MODE_NEEDS_CONNECTING:
 			default:
 				$this->render_pill_and_heading();
@@ -357,16 +350,12 @@ private function render_pill_and_heading( $pill = '', $tone = 'info' ) {
 	}
 
 	/**
-	 * Renders the sentence the two waiting modes share.
+	 * The site's address, without the scheme.
+	 *
+	 * @return string
 	 */
-	private function render_ready_to_migrate() {
-		$this->render_sentence(
-			sprintf(
-				/* translators: %s: the site's address, without the scheme. */
-				__( '%s is ready to migrate. The migration runs from WordPress.com, so there\'s nothing else to do here.', 'wpcom-migration' ),
-				untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) )
-			)
-		);
+	private static function site_address() {
+		return untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) );
 	}
 
 	/**
diff --git a/tests/e2e/blueprint-connection.json b/tests/e2e/blueprint-connection.json
index 72cf6783..a256b990 100644
--- a/tests/e2e/blueprint-connection.json
+++ b/tests/e2e/blueprint-connection.json
@@ -92,11 +92,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/connection-steps.php'; wpcom_migration_e2e_connection_step( 'rest-enable-export-user-token' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/connection-steps.php'; wpcom_migration_e2e_connection_step( 'render-connected-and-enabled' );"
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/connection-steps.php'; wpcom_migration_e2e_connection_step( 'render-connected-and-ready' );"
 		},
 		{
 			"step": "runPHP",
@@ -105,10 +101,6 @@
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/connection-steps.php'; wpcom_migration_e2e_connection_step( 'rest-install-public-key-blog-token' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/connection-steps.php'; wpcom_migration_e2e_connection_step( 'swap-in-known-secret' );"
 		}
 	]
 }
diff --git a/tests/e2e/blueprint-enabled-hash-deleted.json b/tests/e2e/blueprint-enabled-hash-deleted.json
deleted file mode 100644
index d768c488..00000000
--- a/tests/e2e/blueprint-enabled-hash-deleted.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-	"$schema": "https://playground.wordpress.net/blueprint-schema.json",
-	"preferredVersions": { "php": "8.2", "wp": "latest" },
-	"steps": [
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-content/wpcom-migration-e2e/install-flag-mock.php';"
-		},
-		{
-			"step": "activatePlugin",
-			"pluginPath": "wpcom-migration/wpcom_migration.php"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' ); \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::open_export_window(); delete_option( \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::ENABLED_HASH_OPTION );"
-		}
-	]
-}
diff --git a/tests/e2e/blueprint-open.json b/tests/e2e/blueprint-no-credential.json
similarity index 57%
rename from tests/e2e/blueprint-open.json
rename to tests/e2e/blueprint-no-credential.json
index 8699543d..c4797766 100644
--- a/tests/e2e/blueprint-open.json
+++ b/tests/e2e/blueprint-no-credential.json
@@ -9,10 +9,6 @@
 		{
 			"step": "activatePlugin",
 			"pluginPath": "wpcom-migration/wpcom_migration.php"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' ); \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::open_export_window();"
 		}
 	]
 }
diff --git a/tests/e2e/blueprint-screen.json b/tests/e2e/blueprint-screen.json
index 66c1177b..eee5da33 100644
--- a/tests/e2e/blueprint-screen.json
+++ b/tests/e2e/blueprint-screen.json
@@ -48,23 +48,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'enable' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-enabled' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'disable' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-disabled' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'enable' );"
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-saved' );"
 		},
 		{
 			"step": "runPHP",
@@ -94,14 +78,6 @@
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-public-key-enrolled' );"
 		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'enable' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-enabled' );"
-		},
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'invalidate-public-key' );"
@@ -142,10 +118,6 @@
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret' );"
 		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'enable' );"
-		},
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-no-mode-headings' );"
diff --git a/tests/e2e/blueprint-secret-hash-deleted.json b/tests/e2e/blueprint-secret-hash-deleted.json
index 47c5c180..480e51c5 100644
--- a/tests/e2e/blueprint-secret-hash-deleted.json
+++ b/tests/e2e/blueprint-secret-hash-deleted.json
@@ -2,6 +2,10 @@
 	"$schema": "https://playground.wordpress.net/blueprint-schema.json",
 	"preferredVersions": { "php": "8.2", "wp": "latest" },
 	"steps": [
+		{
+			"step": "runPHP",
+			"code": "<?php @mkdir( '/wordpress/wp-content/mu-plugins', 0777, true ); copy( '/wordpress/wp-content/wpcom-migration-e2e/hmac-only-mu-plugin.php', '/wordpress/wp-content/mu-plugins/hmac-only.php' );"
+		},
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-content/wpcom-migration-e2e/install-flag-mock.php';"
@@ -12,7 +16,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' ); \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::open_export_window(); delete_option( \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::SECRET_HASH_OPTION );"
+			"code": "<?php require '/wordpress/wp-load.php'; \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' ); delete_option( \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::SECRET_HASH_OPTION );"
 		}
 	]
 }
diff --git a/tests/e2e/blueprint-closed.json b/tests/e2e/blueprint-secret.json
similarity index 65%
rename from tests/e2e/blueprint-closed.json
rename to tests/e2e/blueprint-secret.json
index a8ce7c6f..f8f21a1b 100644
--- a/tests/e2e/blueprint-closed.json
+++ b/tests/e2e/blueprint-secret.json
@@ -2,6 +2,10 @@
 	"$schema": "https://playground.wordpress.net/blueprint-schema.json",
 	"preferredVersions": { "php": "8.2", "wp": "latest" },
 	"steps": [
+		{
+			"step": "runPHP",
+			"code": "<?php @mkdir( '/wordpress/wp-content/mu-plugins', 0777, true ); copy( '/wordpress/wp-content/wpcom-migration-e2e/hmac-only-mu-plugin.php', '/wordpress/wp-content/mu-plugins/hmac-only.php' );"
+		},
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-content/wpcom-migration-e2e/install-flag-mock.php';"
@@ -12,7 +16,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' ); \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::open_export_window(); \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::close_export_window();"
+			"code": "<?php require '/wordpress/wp-load.php'; \\Automattic\\WPCOM_Migration\\Reprint\\Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' );"
 		}
 	]
 }
diff --git a/tests/e2e/connection-steps.php b/tests/e2e/connection-steps.php
index 09a0cbda..ab42173c 100644
--- a/tests/e2e/connection-steps.php
+++ b/tests/e2e/connection-steps.php
@@ -223,28 +223,12 @@ function ( $entry ) {
 				throw new RuntimeException( "Step '$step': unexpected export_url: " . wp_json_encode( $data ) );
 			}
 			$state = Exporter::get_state();
-			if ( ! $state['public_key_valid'] || $state['window_open'] ) {
-				throw new RuntimeException( "Step '$step': installing should store a valid key and leave the window closed: " . wp_json_encode( $state ) );
+			if ( ! $state['public_key_valid'] ) {
+				throw new RuntimeException( "Step '$step': installing should store a valid key: " . wp_json_encode( $state ) );
 			}
 			break;
 
-		case 'rest-enable-export-user-token':
-			$response = wpcom_migration_e2e_signed_rest_request( '/wpcom-migration/v1/reprint/enable-export', WPCOM_MIGRATION_E2E_USER_TOKEN, 1 );
-			wpcom_migration_e2e_expect_rest_status( $response, 200, $step );
-			$data = $response->get_data();
-			if ( ! isset( $data['enabled_at'] ) || ! is_int( $data['enabled_at'] ) || $data['enabled_at'] < time() - 60 ) {
-				throw new RuntimeException( "Step '$step': expected a fresh enabled_at, got: " . wp_json_encode( $data ) );
-			}
-			if ( ! isset( $data['export_url'] ) ) {
-				throw new RuntimeException( "Step '$step': enable-export must also carry export_url." );
-			}
-			$state = Exporter::get_state();
-			if ( ! $state['window_open'] ) {
-				throw new RuntimeException( "Step '$step': enabling should open the window: " . wp_json_encode( $state ) );
-			}
-			break;
-
-		case 'render-connected-and-enabled':
+		case 'render-connected-and-ready':
 			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
 			$html = wpcom_migration_e2e_render_connect_page();
 			wpcom_migration_e2e_expect_contains( $html, 'Site ready to migrate', $step );
@@ -286,14 +270,6 @@ function ( $entry ) {
 			}
 			break;
 
-		case 'swap-in-known-secret':
-			// request.php signs with a fixed secret; the random one never leaves
-			// Playground. The window opened through REST stays open.
-			if ( ! Exporter::store_secret( 'smoke-secret-0123456789abcdef0123456789abcdef' ) ) {
-				throw new RuntimeException( "Step '$step': could not store the known secret." );
-			}
-			break;
-
 		case 'render-not-connected':
 			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_NEEDS_CONNECTING, $step );
 			$html = wpcom_migration_e2e_render_connect_page();
@@ -415,7 +391,7 @@ function ( $location ) {
  * determine_current_user runs Rest_Authentication (nonce, timestamp, token,
  * signature), then dispatches in-process. Only the HTTP hop is skipped.
  *
- * @param string $route        REST route, e.g. /wpcom-migration/v1/reprint/enable-export.
+ * @param string $route        REST route, e.g. /wpcom-migration/v1/reprint/install-public-key.
  * @param string $access_token "key.secret" for a blog token, "key.secret.user_id" for a user token.
  * @param int    $user_id      0 for a blog token.
  * @param array  $params       REST parameters.
diff --git a/tests/e2e/request.php b/tests/e2e/request.php
index 5d3fd986..a889dc18 100644
--- a/tests/e2e/request.php
+++ b/tests/e2e/request.php
@@ -5,9 +5,9 @@
  *
  * Usage: php tests/e2e/request.php <base-url> <built-plugin-dir> <scenario>
  *
- * Scenarios: open, closed, secret-hash-deleted, enabled-hash-deleted, screen,
- * provisioning-hmac, provisioning-key, connection, menu. The secret must match the one the matching
- * blueprint stores.
+ * Scenarios: secret, no-credential, secret-hash-deleted, screen,
+ * provisioning-hmac, provisioning-key, connection, menu. The secret must match
+ * the one the matching blueprint stores.
  *
  * @package wpcom-migration
  */
@@ -32,69 +32,68 @@
 require_once __DIR__ . '/provisioning-steps.php';
 
 switch ( $wpcom_migration_scenario ) {
-	case 'open':
-		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
-		break;
+	case 'secret':
+		// A stored secret is all it takes: a signed request is served.
+		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret, $wpcom_migration_endpoint ) );
 
-	case 'screen':
-		// The screen blueprint ends with the window open (secret valid,
-		// enabled); the same signed-preflight assertions prove the screen's
-		// form handlers left the exporter in a working state.
-		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
+		// Unsigned: refused, in the code the client maps to its message.
+		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, array() );
+		wpcom_migration_e2e_expect_status( $response, 403 );
+		wpcom_migration_e2e_expect_error_json( $response, 403, 'missing_header' );
+
+		// A client from before Reprint 0.11 sends X-Auth-Content-Hash and is
+		// told to update.
+		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, array_merge( wpcom_migration_e2e_signed_headers( $wpcom_migration_secret, $wpcom_migration_endpoint ), array( 'X-Auth-Content-Hash: irrelevant' ) ) );
+		wpcom_migration_e2e_expect_status( $response, 403 );
+		wpcom_migration_e2e_expect_error_json( $response, 403, 'client_update_required' );
 		break;
 
+	case 'screen':
 	case 'menu':
 		// The blueprint's runPHP steps are the whole test; there is nothing
 		// to ask the site over HTTP.
 		break;
 
-	case 'closed':
-		// Unsigned with the window closed: the request falls through to
+	case 'no-credential':
+		// Nothing stored: signed or not, the request falls through to
 		// WordPress. The plain front page, no JSON, no export headers.
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, array() );
-		wpcom_migration_e2e_expect_status( $response, 200 );
-		if ( false === stripos( $response['body'], '<html' ) ) {
-			wpcom_migration_e2e_fail( 'Unsigned request with the window closed did not return the front page: ' . substr( $response['body'], 0, 200 ) );
-		}
-		if ( isset( $response['headers']['access-control-allow-origin'] ) ) {
-			wpcom_migration_e2e_fail( 'Unsigned request with the window closed carried export CORS headers.' );
-		}
-		if ( isset( $response['headers']['content-type'] ) && false !== stripos( $response['headers']['content-type'], 'json' ) ) {
-			wpcom_migration_e2e_fail( 'Unsigned request with the window closed answered JSON.' );
+		$unsigned = wpcom_migration_e2e_request( $wpcom_migration_endpoint, array() );
+		$signed   = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret, $wpcom_migration_endpoint ) );
+		foreach ( array(
+			'Unsigned' => $unsigned,
+			'Signed'   => $signed,
+		) as $label => $response ) {
+			wpcom_migration_e2e_expect_status( $response, 200 );
+			if ( false === stripos( $response['body'], '<html' ) ) {
+				wpcom_migration_e2e_fail( "$label request with no credential did not return the front page: " . substr( $response['body'], 0, 200 ) );
+			}
+			if ( isset( $response['headers']['access-control-allow-origin'] ) ) {
+				wpcom_migration_e2e_fail( "$label request with no credential carried export CORS headers." );
+			}
+			if ( isset( $response['headers']['content-type'] ) && false !== stripos( $response['headers']['content-type'], 'json' ) ) {
+				wpcom_migration_e2e_fail( "$label request with no credential answered JSON." );
+			}
 		}
-
-		// Signed with the window closed: 409.
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
-		wpcom_migration_e2e_expect_status( $response, 409 );
-		wpcom_migration_e2e_expect_error_json( $response, 409 );
 		break;
 
 	case 'secret-hash-deleted':
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
+		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret, $wpcom_migration_endpoint ) );
 		wpcom_migration_e2e_expect_status( $response, 503 );
 		wpcom_migration_e2e_expect_error_json( $response, 503 );
 		break;
 
-	case 'enabled-hash-deleted':
-		// A stamp without its hash reads as closed.
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
-		wpcom_migration_e2e_expect_status( $response, 409 );
-		wpcom_migration_e2e_expect_error_json( $response, 409 );
-		break;
-
 	case 'provisioning-hmac':
 		// On a host without OpenSSL, WordPress.com installs the plugin through
 		// core, then provisions the exporter with a shared secret and an
 		// application password. All over HTTP with basic auth, as
 		// WordPress.com sends it.
 		$rotate_url = $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1/reprint/rotate-export-secret';
-		$enable_url = $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1/reprint/enable-export';
 
 		// The routes exist.
 		$response = wpcom_migration_e2e_request( $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1', array() );
 		wpcom_migration_e2e_expect_status( $response, 200 );
 		$json = wpcom_migration_e2e_expect_json( $response );
-		foreach ( array( '/wpcom-migration/v1/reprint/rotate-export-secret', '/wpcom-migration/v1/reprint/install-public-key', '/wpcom-migration/v1/reprint/enable-export' ) as $route ) {
+		foreach ( array( '/wpcom-migration/v1/reprint/rotate-export-secret', '/wpcom-migration/v1/reprint/install-public-key' ) as $route ) {
 			if ( ! isset( $json['routes'][ $route ] ) ) {
 				wpcom_migration_e2e_fail( "Namespace index lacks $route: " . $response['body'] );
 			}
@@ -116,12 +115,6 @@
 		wpcom_migration_e2e_expect_status( $response, 501 );
 		wpcom_migration_e2e_expect_rest_error( $response, 'wpcom_migration_key_auth_unsupported' );
 
-		// No secret stored yet: enable refuses rather than open a window
-		// nothing can ever answer.
-		$response = wpcom_migration_e2e_request( $enable_url, $admin_headers, 'POST' );
-		wpcom_migration_e2e_expect_status( $response, 409 );
-		wpcom_migration_e2e_expect_rest_error( $response, 'wpcom_migration_no_credential' );
-
 		// An administrator rotates: a fresh 64-hex secret and the export URL.
 		$response = wpcom_migration_e2e_request( $rotate_url, $admin_headers, 'POST' );
 		wpcom_migration_e2e_expect_status( $response, 200 );
@@ -134,27 +127,11 @@
 		}
 		$rotated_secret = $json['secret'];
 
-		// Secret stored, window still closed: a signed request gets 409.
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $rotated_secret ) );
-		wpcom_migration_e2e_expect_status( $response, 409 );
-		wpcom_migration_e2e_expect_error_json( $response, 409 );
-
-		// Enable: the window opens.
-		$response = wpcom_migration_e2e_request( $enable_url, $admin_headers, 'POST' );
-		wpcom_migration_e2e_expect_status( $response, 200 );
-		$json = wpcom_migration_e2e_expect_json( $response );
-		if ( ! isset( $json['enabled_at'] ) || ! is_int( $json['enabled_at'] ) || $json['enabled_at'] < time() - 60 ) {
-			wpcom_migration_e2e_fail( 'Enable did not return a fresh enabled_at: ' . $response['body'] );
-		}
-		if ( ! isset( $json['export_url'] ) ) {
-			wpcom_migration_e2e_fail( 'Enable must also carry export_url: ' . $response['body'] );
-		}
-
 		// The secret WordPress.com received serves a real export.
-		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $rotated_secret ) );
+		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $rotated_secret, $wpcom_migration_endpoint ) );
 
 		// Rotating again retires the old secret: a request signed with it is
-		// refused, while the new one still opens the window.
+		// refused, while the new one is served.
 		$response = wpcom_migration_e2e_request( $rotate_url, $admin_headers, 'POST' );
 		wpcom_migration_e2e_expect_status( $response, 200 );
 		$json = wpcom_migration_e2e_expect_json( $response );
@@ -163,19 +140,17 @@
 		}
 		$new_secret = $json['secret'];
 
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $rotated_secret ) );
+		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $rotated_secret, $wpcom_migration_endpoint ) );
 		wpcom_migration_e2e_expect_status( $response, 403 );
-		wpcom_migration_e2e_expect_error_json( $response, 403 );
+		wpcom_migration_e2e_expect_error_json( $response, 403, 'signature_mismatch' );
 
-		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $new_secret ) );
+		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $new_secret, $wpcom_migration_endpoint ) );
 		break;
 
 	case 'provisioning-key':
 		// WordPress.com provisions a site that verifies keys: it installs its
-		// public key, opens the window, and signs every export request with
-		// the private half.
+		// public key and signs every export request with the private half.
 		$install_url = $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1/reprint/install-public-key';
-		$enable_url  = $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1/reprint/enable-export';
 
 		list( $private_key, $public_key ) = WordPress\Reprint\Server\PublicKeyClient::generate_keypair();
 		$key_client                       = new WordPress\Reprint\Server\PublicKeyClient( $private_key );
@@ -204,11 +179,6 @@
 		wpcom_migration_e2e_expect_status( $response, 501 );
 		wpcom_migration_e2e_expect_rest_error( $response, 'wpcom_migration_secret_auth_unsupported' );
 
-		// Nothing stored yet: enable refuses.
-		$response = wpcom_migration_e2e_request( $enable_url, $admin_headers, 'POST' );
-		wpcom_migration_e2e_expect_status( $response, 409 );
-		wpcom_migration_e2e_expect_rest_error( $response, 'wpcom_migration_no_credential' );
-
 		// Not a key, a private key, and a key under 3072 bits: each refused
 		// with Reprint's reason.
 		$weak_key = openssl_pkey_get_details(
@@ -237,14 +207,7 @@
 			wpcom_migration_e2e_fail( 'Install returned an unexpected export_url: ' . $response['body'] );
 		}
 
-		// Key stored, window still closed: a key-signed request gets 409.
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_key_signed_headers( $key_client, $wpcom_migration_endpoint ) );
-		wpcom_migration_e2e_expect_status( $response, 409 );
-		wpcom_migration_e2e_expect_error_json( $response, 409 );
-
-		// Enable, and the key serves a real export.
-		$response = wpcom_migration_e2e_request( $enable_url, $admin_headers, 'POST' );
-		wpcom_migration_e2e_expect_status( $response, 200 );
+		// The key serves a real export.
 		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_key_signed_headers( $key_client, $wpcom_migration_endpoint ) );
 
 		// Installing another key, sent as PEM, retires the first.
@@ -266,11 +229,10 @@
 
 		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_key_signed_headers( $second_client, $wpcom_migration_endpoint ) );
 
-		// A secret-signed request on a site with only a key: no secret is
-		// configured, which the client reads from a 503 not_configured.
-		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
-		wpcom_migration_e2e_expect_status( $response, 503 );
-		wpcom_migration_e2e_expect_error_json( $response, 503, 'not_configured' );
+		// A secret-signed request on a site that verifies keys is refused.
+		$response = wpcom_migration_e2e_request( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret, $wpcom_migration_endpoint ) );
+		wpcom_migration_e2e_expect_status( $response, 403 );
+		wpcom_migration_e2e_expect_error_json( $response, 403, 'requires_key_auth' );
 		break;
 
 	case 'connection':
@@ -278,7 +240,7 @@
 		$response = wpcom_migration_e2e_request( $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1', array() );
 		wpcom_migration_e2e_expect_status( $response, 200 );
 		$json = wpcom_migration_e2e_expect_json( $response );
-		foreach ( array( '/wpcom-migration/v1/reprint/rotate-export-secret', '/wpcom-migration/v1/reprint/install-public-key', '/wpcom-migration/v1/reprint/enable-export' ) as $route ) {
+		foreach ( array( '/wpcom-migration/v1/reprint/rotate-export-secret', '/wpcom-migration/v1/reprint/install-public-key' ) as $route ) {
 			if ( ! isset( $json['routes'][ $route ] ) ) {
 				wpcom_migration_e2e_fail( "Namespace index lacks $route: " . $response['body'] );
 			}
@@ -287,9 +249,6 @@
 		$response = wpcom_migration_e2e_request( $wpcom_migration_base_url . '/wp-json/wpcom-migration/v1/reprint/rotate-export-secret', array(), 'POST' );
 		wpcom_migration_e2e_expect_status( $response, 401 );
 		wpcom_migration_e2e_expect_rest_error( $response, 'rest_forbidden' );
-
-		// The window the REST route opened serves a real export.
-		wpcom_migration_e2e_assert_open( $wpcom_migration_endpoint, wpcom_migration_e2e_signed_headers( $wpcom_migration_secret ) );
 		break;
 
 	default:
@@ -299,7 +258,7 @@
 fwrite( STDOUT, "Scenario '$wpcom_migration_scenario' passed.\n" );
 
 /**
- * Asserts a signed preflight request answers as the window being open.
+ * Asserts a signed preflight request is served.
  *
  * @param string   $url     Preflight endpoint URL.
  * @param string[] $headers Signature header lines for $url.
@@ -328,15 +287,16 @@ function wpcom_migration_e2e_assert_open( $url, array $headers ) {
 }
 
 /**
- * X-Auth-* header lines for an empty-bodied signed request.
+ * X-Auth-* header lines for a GET signed with the shared secret.
  *
  * @param string $secret The shared secret.
+ * @param string $url    The request URL; its path and query are signed.
  * @return string[]
  */
-function wpcom_migration_e2e_signed_headers( $secret ) {
+function wpcom_migration_e2e_signed_headers( $secret, $url ) {
 	$client = new Site_Export_HMAC_Client( $secret );
 	$lines  = array();
-	foreach ( $client->get_auth_headers( '' ) as $name => $value ) {
+	foreach ( $client->get_auth_headers( 'GET', $url ) as $name => $value ) {
 		$lines[] = $name . ': ' . $value;
 	}
 	return $lines;
@@ -472,8 +432,8 @@ function wpcom_migration_e2e_expect_json( array $response ) {
 }
 
 /**
- * Fails unless the body is the exporter's error JSON with the given code,
- * and the given reason when one is named.
+ * Fails unless the body is the exporter's error JSON with the given code and
+ * Reprint's auth_version, and the given reason when one is named.
  *
  * @param array       $response Response from wpcom_migration_e2e_request().
  * @param int         $code     Expected 'code' value.
@@ -484,6 +444,9 @@ function wpcom_migration_e2e_expect_error_json( array $response, $code, $reason
 	if ( ! isset( $json['code'], $json['error'] ) || $code !== (int) $json['code'] ) {
 		wpcom_migration_e2e_fail( sprintf( 'Expected error JSON with code %d, got: %s', $code, $response['body'] ) );
 	}
+	if ( ! isset( $json['auth_version'] ) || 2 !== $json['auth_version'] ) {
+		wpcom_migration_e2e_fail( 'Expected error JSON with auth_version 2, got: ' . $response['body'] );
+	}
 	if ( null !== $reason && ( ! isset( $json['reason'] ) || $reason !== $json['reason'] ) ) {
 		wpcom_migration_e2e_fail( sprintf( 'Expected error JSON with reason %s, got: %s', $reason, $response['body'] ) );
 	}
diff --git a/tests/e2e/run.sh b/tests/e2e/run.sh
index a40c00f3..afceff81 100755
--- a/tests/e2e/run.sh
+++ b/tests/e2e/run.sh
@@ -32,7 +32,7 @@ PORT="${E2E_PORT:-9400}"
 BASE_URL="http://127.0.0.1:$PORT"
 PLAYGROUND_CLI="${PLAYGROUND_CLI:-npx --yes @wp-playground/cli@3.1.54}"
 # shellcheck disable=SC2206 # A space-separated scenario list, split on purpose.
-SCENARIOS=(${E2E_SCENARIOS:-open closed secret-hash-deleted enabled-hash-deleted screen provisioning-hmac provisioning-key connection menu multisite})
+SCENARIOS=(${E2E_SCENARIOS:-secret no-credential secret-hash-deleted screen provisioning-hmac provisioning-key connection menu multisite})
 
 for command_name in php npx; do
     if ! command -v "$command_name" >/dev/null 2>&1; then
diff --git a/tests/e2e/screen-steps.php b/tests/e2e/screen-steps.php
index 0e72a713..c923530d 100644
--- a/tests/e2e/screen-steps.php
+++ b/tests/e2e/screen-steps.php
@@ -88,13 +88,15 @@ function wpcom_migration_e2e_screen_step( $step ) {
 
 		case 'assert-secret-saved':
 			$state = Exporter::get_state();
-			if ( ! $state['secret_valid'] || $state['window_open'] ) {
-				throw new RuntimeException( 'Saving the secret should store a valid secret and leave the window closed: ' . wp_json_encode( $state ) );
+			if ( ! $state['secret_valid'] ) {
+				throw new RuntimeException( 'Saving the secret should store a valid secret: ' . wp_json_encode( $state ) );
 			}
-			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_PROVISIONED_WAITING, $step );
+			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
 			$html = wpcom_migration_e2e_render( $page );
-			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--info">Set up by WordPress.com</p>', $step );
-			wpcom_migration_e2e_expect_contains( $html, 'is ready to migrate. The migration runs from WordPress.com', $step );
+			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--info">Site ready to migrate</p>', $step );
+			wpcom_migration_e2e_expect_contains( $html, untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) ) . ' is ready to migrate. The migration runs from WordPress.com, so there&#039;s nothing else to do here. Your site stays online and unchanged while it&#039;s copied.', $step );
+			wpcom_migration_e2e_expect_contains( $html, 'Keep this plugin active until the migration is done. We&#039;ll email you when it&#039;s finished.', $step );
+			wpcom_migration_e2e_expect_not_contains( $html, 'Your site is now ready to be copied', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'Go to WordPress.com', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'href="https://my.wordpress.com/sites"', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'Connect WordPress.com', $step );
@@ -102,10 +104,7 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_primary_count( $html, 1, $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'id="wpcom-migration-reprint-api-url"', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, '<h2>Export secret</h2>', $step );
-			wpcom_migration_e2e_expect_not_contains( $html, 'Turn the exporter on', $step );
-			wpcom_migration_e2e_expect_not_contains( $html, 'Exporter disabled', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'Shared secret', $step );
-			wpcom_migration_e2e_expect_not_contains( $html, 'Export window', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'Remote API URL', $step );
 
 			$manual_html = wpcom_migration_e2e_render_manual( $manual );
@@ -114,7 +113,6 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_contains( $manual_html, 'id="wpcom-migration-reprint-api-url"', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, esc_attr( home_url( '?' . Exporter::QUERY_VAR ) ), $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, '<h2>Export secret</h2>', $step );
-			wpcom_migration_e2e_expect_contains( $manual_html, 'Turn the exporter on', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, '<h2>Export URL</h2>', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'Remove secret', $step );
 			break;
@@ -161,7 +159,6 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			try {
 				$actions = array(
 					array( Manual_Page::SAVE_SECRET_ACTION, 'handle_save_secret', array( Manual_Page::SECRET_FIELD => 'attacker-secret' ) ),
-					array( Manual_Page::SAVE_ENABLED_ACTION, 'handle_save_enabled', array( Manual_Page::ENABLED_FIELD => '1' ) ),
 					array( Manual_Page::DISCARD_SECRET_ACTION, 'handle_discard_secret', array() ),
 				);
 				foreach ( $actions as $action ) {
@@ -182,8 +179,8 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			}
 
 			$state = Exporter::get_state();
-			if ( 'smoke-secret-0123456789abcdef0123456789abcdef' !== get_option( Exporter::SECRET_OPTION ) || ! $state['secret_valid'] || $state['window_open'] ) {
-				throw new RuntimeException( 'Non-administrator access changed exporter credentials or state.' );
+			if ( 'smoke-secret-0123456789abcdef0123456789abcdef' !== get_option( Exporter::SECRET_OPTION ) || ! $state['secret_valid'] ) {
+				throw new RuntimeException( 'Non-administrator access changed exporter credentials.' );
 			}
 			break;
 
@@ -202,43 +199,6 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_not_contains( $html, 'Invalid: the site', $step );
 			break;
 
-		case 'enable':
-			wpcom_migration_e2e_post( Manual_Page::SAVE_ENABLED_ACTION, array( Manual_Page::ENABLED_FIELD => '1' ) );
-			$manual->handle_save_enabled();
-			break;
-
-		case 'assert-enabled':
-			$state = Exporter::get_state();
-			if ( ! $state['window_open'] ) {
-				throw new RuntimeException( 'Enabling should open the window: ' . wp_json_encode( $state ) );
-			}
-			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
-			$html = wpcom_migration_e2e_render( $page );
-			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--info">Site ready to migrate</p>', $step );
-			wpcom_migration_e2e_expect_contains( $html, 'Your site is now ready to be copied by WordPress.com', $step );
-			wpcom_migration_e2e_expect_contains( $html, 'Keep this plugin active until the migration is done', $step );
-			wpcom_migration_e2e_expect_contains( $html, 'Go to WordPress.com', $step );
-			wpcom_migration_e2e_expect_primary_count( $html, 1, $step );
-			wpcom_migration_e2e_expect_not_contains( $html, 'Connect WordPress.com', $step );
-			wpcom_migration_e2e_expect_not_contains( $html, 'Set up by WordPress.com', $step );
-			break;
-
-		case 'disable':
-			wpcom_migration_e2e_post( Manual_Page::SAVE_ENABLED_ACTION, array() );
-			$manual->handle_save_enabled();
-			break;
-
-		case 'assert-disabled':
-			$state = Exporter::get_state();
-			if ( $state['window_open'] ) {
-				throw new RuntimeException( 'Disabling should close the window: ' . wp_json_encode( $state ) );
-			}
-			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_PROVISIONED_WAITING, $step );
-			$html = wpcom_migration_e2e_render( $page );
-			wpcom_migration_e2e_expect_contains( $html, 'Set up by WordPress.com', $step );
-			wpcom_migration_e2e_expect_not_contains( $html, 'Site ready to migrate', $step );
-			break;
-
 		case 'discard-secret':
 			wpcom_migration_e2e_post( Manual_Page::DISCARD_SECRET_ACTION, array() );
 			$manual->handle_discard_secret();
@@ -246,8 +206,8 @@ function wpcom_migration_e2e_screen_step( $step ) {
 
 		case 'assert-secret-discarded':
 			$state = Exporter::get_state();
-			if ( $state['has_secret'] || $state['has_public_key'] || $state['window_open'] ) {
-				throw new RuntimeException( 'Removing the secret should delete it and close the window: ' . wp_json_encode( $state ) );
+			if ( $state['has_secret'] || $state['has_public_key'] ) {
+				throw new RuntimeException( 'Removing the secret should delete it: ' . wp_json_encode( $state ) );
 			}
 			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_NEEDS_CONNECTING, $step );
 			$_GET[ Manual_Page::NOTICE_QUERY_ARG ] = 'discarded';
@@ -257,7 +217,7 @@ function wpcom_migration_e2e_screen_step( $step ) {
 				throw new RuntimeException( "Step '$step': the notice should sit above the page heading." );
 			}
 			wpcom_migration_e2e_expect_not_contains( $manual_html, 'Remove secret', $step );
-			wpcom_migration_e2e_expect_not_contains( $manual_html, 'Turn the exporter on', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, 'wpcom-migration-reprint-api-url', $step );
 			break;
 
 		case 'render-public-key-form':
@@ -291,17 +251,16 @@ function wpcom_migration_e2e_screen_step( $step ) {
 		case 'assert-public-key-enrolled':
 			$public_key = get_option( 'wpcom_migration_e2e_public_key' );
 			$state      = Exporter::get_state();
-			if ( get_option( Exporter::PUBLIC_KEY_OPTION ) !== $public_key || ! $state['public_key_valid'] || $state['has_secret'] || $state['window_open'] ) {
-				throw new RuntimeException( "Step '$step': expected the enrolled key, no secret, window closed: " . wp_json_encode( $state ) );
+			if ( get_option( Exporter::PUBLIC_KEY_OPTION ) !== $public_key || ! $state['public_key_valid'] || $state['has_secret'] ) {
+				throw new RuntimeException( "Step '$step': expected the enrolled key and no secret: " . wp_json_encode( $state ) );
 			}
-			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_PROVISIONED_WAITING, $step );
+			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
 			$_GET[ Manual_Page::NOTICE_QUERY_ARG ] = 'key_saved';
 			$manual_html                           = wpcom_migration_e2e_render_manual( $manual );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'Public key saved.', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'wpcom-migration-reprint-key-table', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, '<code>' . \WordPress\Reprint\Server\Utils::public_key_fingerprint( $public_key ) . '</code>', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'value="' . Manual_Page::REMOVE_PUBLIC_KEY_ACTION . '"', $step );
-			wpcom_migration_e2e_expect_contains( $manual_html, 'Turn the exporter on', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'wpcom-migration-reprint-api-url', $step );
 			wpcom_migration_e2e_expect_not_contains( $manual_html, 'Remove secret', $step );
 			break;
@@ -313,8 +272,8 @@ function wpcom_migration_e2e_screen_step( $step ) {
 
 		case 'assert-public-key-removed':
 			$state = Exporter::get_state();
-			if ( $state['has_public_key'] || $state['window_open'] ) {
-				throw new RuntimeException( "Step '$step': removing the key should delete it and close the window: " . wp_json_encode( $state ) );
+			if ( $state['has_public_key'] ) {
+				throw new RuntimeException( "Step '$step': removing the key should delete it: " . wp_json_encode( $state ) );
 			}
 			$_GET[ Manual_Page::NOTICE_QUERY_ARG ] = 'key_removed';
 			$manual_html                           = wpcom_migration_e2e_render_manual( $manual );
@@ -324,9 +283,11 @@ function wpcom_migration_e2e_screen_step( $step ) {
 
 		case 'assert-secret-removed-key-kept':
 			$state = Exporter::get_state();
-			if ( $state['has_secret'] || ! $state['public_key_valid'] || $state['window_open'] ) {
-				throw new RuntimeException( "Step '$step': removing the secret should keep the key and close the window: " . wp_json_encode( $state ) );
+			if ( $state['has_secret'] || ! $state['public_key_valid'] ) {
+				throw new RuntimeException( "Step '$step': removing the secret should keep the key: " . wp_json_encode( $state ) );
 			}
+			// The key alone keeps the exporter on.
+			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
 			break;
 
 		case 'invalidate-public-key':

From c7412a46f848cf886fabff66aaf9c282339fa073 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 09:47:03 +0200
Subject: [PATCH 02/11] Show only the host's credential on the manual screen

Where Reprint requires keys, the screen offers the public key form and
refuses a posted secret; elsewhere it offers the secret form, as it
already refused a posted key. The screen e2e scenario splits in two:
screen for keys, screen-hmac for secrets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                            |  4 +-
 plugin/reprint/class-manual-page.php | 37 ++++++++-------
 tests/e2e/blueprint-screen-hmac.json | 70 ++++++++++++++++++++++++++++
 tests/e2e/blueprint-screen.json      | 64 +------------------------
 tests/e2e/request.php                |  3 +-
 tests/e2e/run.sh                     |  7 +--
 tests/e2e/screen-steps.php           | 32 +++++++++----
 7 files changed, 123 insertions(+), 94 deletions(-)
 create mode 100644 tests/e2e/blueprint-screen-hmac.json

diff --git a/README.md b/README.md
index e4f79cb3..8c6f1a26 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ Source for the [Migrate to WordPress.com](https://wordpress.org/plugins/wpcom-mi
 - `plugin/connection/` — `Connection` (package setup, connect, disconnect), `Connect_Page` (the connection section of the screen), `bootstrap.php`.
 - `bin/build.sh` — writes `build/wpcom-migration/` and `build/wpcom-migration.zip`.
 - `bin/check-autoload-manifest.php` — asserts which classes the ZIP publishes through the Jetpack autoloader.
-- `tests/e2e/` — Playground blueprints and request scripts: one scenario per credential state, one that drives the Reprint migration screen, two that provision through the REST routes (with a public key, and with a shared secret on a host made to look like it lacks OpenSSL), one that drives the WordPress.com connection, one that checks the admin menu, and one that checks the menu on a network.
+- `tests/e2e/` — Playground blueprints and request scripts: one scenario per credential state, two that drive the screens (with a public key, and with a shared secret), two that provision through the REST routes (with a public key, and with a shared secret on a host made to look like it lacks OpenSSL), one that drives the WordPress.com connection, one that checks the admin menu, and one that checks the menu on a network.
 
 ## Build
 
@@ -48,7 +48,7 @@ On a network the old screen keeps its row in the network admin, and the *Setting
 
 ## Setting up Reprint manually
 
-`wp-admin/admin.php?page=wpcom-migration-manual` (`administrator` role, single-site only). Nothing links to it; support gives out the URL. It holds the export secret form and a *Remove secret* button; on a host with `openssl_verify()`, a public key textarea (*Enroll key*, PEM or one line, replacing any enrolled key) and a table with the enrolled key's id and a *Remove* button; the export URL and the WordPress.com blog ID. Removing either credential leaves the other in place. Deactivating the plugin disconnects and discards both credentials.
+`wp-admin/admin.php?page=wpcom-migration-manual` (`administrator` role, single-site only). Nothing links to it; support gives out the URL. It holds the credential the host verifies: on a host with `openssl_verify()`, a public key textarea (*Enroll key*, PEM or one line, replacing any enrolled key) and a table with the enrolled key's id and a *Remove* button; elsewhere, the export secret form and a *Remove secret* button. Below it, the export URL and the WordPress.com blog ID. Deactivating the plugin disconnects and discards both credentials.
 
 ## How WordPress.com provisions the exporter
 
diff --git a/plugin/reprint/class-manual-page.php b/plugin/reprint/class-manual-page.php
index 274aa209..326e1bb2 100644
--- a/plugin/reprint/class-manual-page.php
+++ b/plugin/reprint/class-manual-page.php
@@ -1,6 +1,7 @@
 <?php
 /**
- * The by-hand screen: export secret, public key, export URL, blog ID.
+ * The by-hand screen: the export secret or the public key, whichever this
+ * host verifies; export URL; blog ID.
  *
  * Nothing links here; support gives out the URL.
  *
@@ -202,6 +203,10 @@ public function enqueue_assets( $hook_suffix ) {
 	public function handle_save_secret() {
 		$this->authorize( self::SAVE_SECRET_ACTION );
 
+		if ( Utils::key_auth_required() ) {
+			$this->redirect_with_notice( 'secret_unsupported' );
+		}
+
 		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Checked in authorize().
 		$secret = sanitize_text_field( wp_unslash( $_POST[ self::SECRET_FIELD ] ?? '' ) );
 
@@ -305,9 +310,10 @@ private function authorize( $action ) {
 	 * Redirects back to the screen with a result code and exits.
 	 *
 	 * @param string $result One of saved, unchanged, discarded,
-	 *                       not_configured, storage_failure, key_saved,
-	 *                       key_unchanged, key_removed, key_invalid,
-	 *                       key_unsupported, key_storage_failure.
+	 *                       not_configured, storage_failure,
+	 *                       secret_unsupported, key_saved, key_unchanged,
+	 *                       key_removed, key_invalid, key_unsupported,
+	 *                       key_storage_failure.
 	 */
 	private function redirect_with_notice( $result ) {
 		wp_safe_redirect( add_query_arg( self::NOTICE_QUERY_ARG, $result, self::page_url() ) );
@@ -315,8 +321,9 @@ private function redirect_with_notice( $result ) {
 	}
 
 	/**
-	 * Renders the screen: the secret form; the public key form and table; the
-	 * export URL once a credential is valid; the blog ID when connected.
+	 * Renders the screen: the public key form and table where this host
+	 * verifies keys, the secret form elsewhere; the export URL once a
+	 * credential is valid; the blog ID when connected.
 	 */
 	public function render_page() {
 		if ( ! in_array( 'administrator', wp_get_current_user()->roles, true ) ) {
@@ -336,8 +343,11 @@ public function render_page() {
 		echo '<h1>' . esc_html__( 'Set up Reprint manually', 'wpcom-migration' ) . '</h1>';
 		echo '<p class="description">' . esc_html__( 'Support may ask you to set this up by hand.', 'wpcom-migration' ) . '</p>';
 
-		$this->render_secret_form( $state );
-		$this->render_public_key_section( $state );
+		if ( Utils::key_auth_required() ) {
+			$this->render_public_key_section( $state );
+		} else {
+			$this->render_secret_form( $state );
+		}
 
 		if ( $state['credential_valid'] ) {
 			$this->render_api_url();
@@ -410,21 +420,13 @@ private function render_discard_form() {
 	}
 
 	/**
-	 * Renders the enrollment form and the enrolled key, or a note that this
-	 * host cannot verify keys.
+	 * Renders the enrollment form and the enrolled key.
 	 *
 	 * @param array $state Exporter::get_state().
 	 */
 	private function render_public_key_section( array $state ) {
 		?>
-		<hr />
 		<h2><?php esc_html_e( 'Public key', 'wpcom-migration' ); ?></h2>
-		<?php
-		if ( ! Utils::key_auth_required() ) {
-			echo '<p class="description">' . esc_html__( 'Public keys need OpenSSL, which this host does not have.', 'wpcom-migration' ) . '</p>';
-			return;
-		}
-		?>
 		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
 			<input type="hidden" name="action" value="<?php echo esc_attr( self::SAVE_PUBLIC_KEY_ACTION ); ?>" />
 			<?php wp_nonce_field( self::SAVE_PUBLIC_KEY_ACTION ); ?>
@@ -504,6 +506,7 @@ private function render_result_notice() {
 			'discarded'           => array( 'success', __( 'Secret removed.', 'wpcom-migration' ) ),
 			'not_configured'      => array( 'error', __( 'Enter an export secret first.', 'wpcom-migration' ) ),
 			'storage_failure'     => array( 'error', __( 'The secret could not be saved.', 'wpcom-migration' ) ),
+			'secret_unsupported'  => array( 'error', __( 'This site verifies exports with public keys. Enroll a public key instead.', 'wpcom-migration' ) ),
 			'key_saved'           => array( 'success', __( 'Public key saved.', 'wpcom-migration' ) ),
 			'key_unchanged'       => array( 'success', __( 'That public key was already enrolled.', 'wpcom-migration' ) ),
 			'key_removed'         => array( 'success', __( 'Public key removed.', 'wpcom-migration' ) ),
diff --git a/tests/e2e/blueprint-screen-hmac.json b/tests/e2e/blueprint-screen-hmac.json
new file mode 100644
index 00000000..319e74c5
--- /dev/null
+++ b/tests/e2e/blueprint-screen-hmac.json
@@ -0,0 +1,70 @@
+{
+	"$schema": "https://playground.wordpress.net/blueprint-schema.json",
+	"preferredVersions": { "php": "8.2", "wp": "latest" },
+	"steps": [
+		{
+			"step": "runPHP",
+			"code": "<?php @mkdir( '/wordpress/wp-content/mu-plugins', 0777, true ); copy( '/wordpress/wp-content/wpcom-migration-e2e/hmac-only-mu-plugin.php', '/wordpress/wp-content/mu-plugins/hmac-only.php' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-content/wpcom-migration-e2e/install-flag-mock.php';"
+		},
+		{
+			"step": "activatePlugin",
+			"pluginPath": "wpcom-migration/wpcom_migration.php"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'render-secret-form' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret-empty' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-unconfigured' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-saved' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; try { wpcom_migration_e2e_screen_step( 'reject-non-administrator-manual-access' ); } catch ( Throwable $error ) { echo $error->getMessage(); throw $error; }"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'invalidate-secret' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-saved' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'enroll-public-key' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-no-public-key' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'discard-secret' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-discarded' );"
+		}
+	]
+}
diff --git a/tests/e2e/blueprint-screen.json b/tests/e2e/blueprint-screen.json
index eee5da33..d819e1f2 100644
--- a/tests/e2e/blueprint-screen.json
+++ b/tests/e2e/blueprint-screen.json
@@ -20,27 +20,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret-empty' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-unconfigured' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-saved' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; try { wpcom_migration_e2e_screen_step( 'reject-non-administrator-manual-access' ); } catch ( Throwable $error ) { echo $error->getMessage(); throw $error; }"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'invalidate-secret' );"
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'render-public-key-form' );"
 		},
 		{
 			"step": "runPHP",
@@ -48,19 +28,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-saved' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'discard-secret' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-discarded' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'render-public-key-form' );"
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-refused' );"
 		},
 		{
 			"step": "runPHP",
@@ -90,34 +58,6 @@
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-public-key-removed' );"
 		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'enroll-public-key' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'discard-secret' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-removed-key-kept' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'remove-public-key' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-public-key-removed' );"
-		},
-		{
-			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'save-secret' );"
-		},
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-no-mode-headings' );"
diff --git a/tests/e2e/request.php b/tests/e2e/request.php
index a889dc18..440a865c 100644
--- a/tests/e2e/request.php
+++ b/tests/e2e/request.php
@@ -5,7 +5,7 @@
  *
  * Usage: php tests/e2e/request.php <base-url> <built-plugin-dir> <scenario>
  *
- * Scenarios: secret, no-credential, secret-hash-deleted, screen,
+ * Scenarios: secret, no-credential, secret-hash-deleted, screen, screen-hmac,
  * provisioning-hmac, provisioning-key, connection, menu. The secret must match
  * the one the matching blueprint stores.
  *
@@ -49,6 +49,7 @@
 		break;
 
 	case 'screen':
+	case 'screen-hmac':
 	case 'menu':
 		// The blueprint's runPHP steps are the whole test; there is nothing
 		// to ask the site over HTTP.
diff --git a/tests/e2e/run.sh b/tests/e2e/run.sh
index afceff81..2e66e397 100755
--- a/tests/e2e/run.sh
+++ b/tests/e2e/run.sh
@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 #
 # Boots the built plugin in WordPress Playground once per credential state
-# and checks the export endpoint's answers, then once more to drive the
-# settings screen through its form handlers, and twice more to provision
+# and checks the export endpoint's answers, then twice more to drive the
+# screens through their form handlers (once with a public key, once with a
+# shared secret), and twice more to provision
 # through the REST routes with application passwords: once with a shared
 # secret and once with a public key.
 #
@@ -32,7 +33,7 @@ PORT="${E2E_PORT:-9400}"
 BASE_URL="http://127.0.0.1:$PORT"
 PLAYGROUND_CLI="${PLAYGROUND_CLI:-npx --yes @wp-playground/cli@3.1.54}"
 # shellcheck disable=SC2206 # A space-separated scenario list, split on purpose.
-SCENARIOS=(${E2E_SCENARIOS:-secret no-credential secret-hash-deleted screen provisioning-hmac provisioning-key connection menu multisite})
+SCENARIOS=(${E2E_SCENARIOS:-secret no-credential secret-hash-deleted screen screen-hmac provisioning-hmac provisioning-key connection menu multisite})
 
 for command_name in php npx; do
     if ! command -v "$command_name" >/dev/null 2>&1; then
diff --git a/tests/e2e/screen-steps.php b/tests/e2e/screen-steps.php
index c923530d..25674be3 100644
--- a/tests/e2e/screen-steps.php
+++ b/tests/e2e/screen-steps.php
@@ -69,6 +69,25 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_not_contains( $html, 'id="wpcom-migration-reprint-secret"', $step );
 			break;
 
+		case 'render-secret-form':
+			$manual_html = wpcom_migration_e2e_render_manual( $manual );
+			wpcom_migration_e2e_expect_contains( $manual_html, 'id="wpcom-migration-reprint-secret"', $step );
+			wpcom_migration_e2e_expect_contains( $manual_html, '<h2>Export secret</h2>', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, 'name="' . Manual_Page::PUBLIC_KEY_FIELD . '"', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, '<h2>Public key</h2>', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, 'Public keys need OpenSSL', $step );
+			break;
+
+		case 'assert-secret-refused':
+			$state = Exporter::get_state();
+			if ( $state['has_secret'] ) {
+				throw new RuntimeException( "Step '$step': a host that verifies keys must not store a secret: " . wp_json_encode( $state ) );
+			}
+			$_GET[ Manual_Page::NOTICE_QUERY_ARG ] = 'secret_unsupported';
+			$manual_html                           = wpcom_migration_e2e_render_manual( $manual );
+			wpcom_migration_e2e_expect_contains( $manual_html, 'This site verifies exports with public keys.', $step );
+			break;
+
 		case 'save-secret-empty':
 			wpcom_migration_e2e_post( Manual_Page::SAVE_SECRET_ACTION, array( Manual_Page::SECRET_FIELD => '' ) );
 			$manual->handle_save_secret(); // Redirects and exits.
@@ -115,6 +134,7 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_contains( $manual_html, '<h2>Export secret</h2>', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, '<h2>Export URL</h2>', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'Remove secret', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, 'name="' . Manual_Page::PUBLIC_KEY_FIELD . '"', $step );
 			break;
 
 		case 'reject-non-administrator-manual-access':
@@ -225,6 +245,8 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_contains( $manual_html, 'name="' . Manual_Page::PUBLIC_KEY_FIELD . '"', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'Enroll key', $step );
 			wpcom_migration_e2e_expect_not_contains( $manual_html, 'wpcom-migration-reprint-key-table', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, 'id="wpcom-migration-reprint-secret"', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, '<h2>Export secret</h2>', $step );
 			break;
 
 		case 'enroll-invalid-public-key':
@@ -262,6 +284,7 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_contains( $manual_html, '<code>' . \WordPress\Reprint\Server\Utils::public_key_fingerprint( $public_key ) . '</code>', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'value="' . Manual_Page::REMOVE_PUBLIC_KEY_ACTION . '"', $step );
 			wpcom_migration_e2e_expect_contains( $manual_html, 'wpcom-migration-reprint-api-url', $step );
+			wpcom_migration_e2e_expect_not_contains( $manual_html, 'id="wpcom-migration-reprint-secret"', $step );
 			wpcom_migration_e2e_expect_not_contains( $manual_html, 'Remove secret', $step );
 			break;
 
@@ -281,15 +304,6 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_not_contains( $manual_html, 'wpcom-migration-reprint-key-table', $step );
 			break;
 
-		case 'assert-secret-removed-key-kept':
-			$state = Exporter::get_state();
-			if ( $state['has_secret'] || ! $state['public_key_valid'] ) {
-				throw new RuntimeException( "Step '$step': removing the secret should keep the key: " . wp_json_encode( $state ) );
-			}
-			// The key alone keeps the exporter on.
-			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
-			break;
-
 		case 'invalidate-public-key':
 			delete_option( Exporter::PUBLIC_KEY_HASH_OPTION );
 			$state = Exporter::get_state();

From 083f485a7bdd18f12f3a099dbcd8f07bf93e2ef6 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 09:47:03 +0200
Subject: [PATCH 03/11] Count only the credential the host verifies

A secret on a host that requires keys, or a key on one that cannot verify
them, no longer makes the site read as ready to migrate: the screens and
the export endpoint treat it as no credential.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugin/reprint/class-exporter.php    | 13 +++++++++----
 tests/e2e/blueprint-screen-hmac.json |  4 ++++
 tests/e2e/blueprint-screen.json      |  4 ++++
 tests/e2e/screen-steps.php           | 22 ++++++++++++++++++++++
 4 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/plugin/reprint/class-exporter.php b/plugin/reprint/class-exporter.php
index 0887c75e..53721f46 100644
--- a/plugin/reprint/class-exporter.php
+++ b/plugin/reprint/class-exporter.php
@@ -328,13 +328,17 @@ private static function credential_hash_matches( $hash_option, $value ) {
 	/**
 	 * The state the screens render.
 	 *
+	 * The credential is the one this host verifies: the public key where
+	 * Reprint requires keys, the secret elsewhere. The other one, if stored,
+	 * counts for nothing.
+	 *
 	 * @return array {
 	 *     @type bool $has_secret       Whether a secret is stored.
 	 *     @type bool $secret_valid     Whether its hash matches under the current salt.
 	 *     @type bool $has_public_key   Whether a public key is stored.
 	 *     @type bool $public_key_valid Whether its hash matches under the current salt.
-	 *     @type bool $has_credential   Whether either is stored.
-	 *     @type bool $credential_valid Whether either is valid, which turns the exporter on.
+	 *     @type bool $has_credential   Whether the credential is stored.
+	 *     @type bool $credential_valid Whether it is valid, which turns the exporter on.
 	 * }
 	 */
 	public static function get_state() {
@@ -344,14 +348,15 @@ public static function get_state() {
 		$public_key       = get_option( self::PUBLIC_KEY_OPTION, '' );
 		$has_public_key   = is_string( $public_key ) && '' !== $public_key;
 		$public_key_valid = $has_public_key && self::credential_hash_matches( self::PUBLIC_KEY_HASH_OPTION, $public_key );
+		$key_auth         = Utils::key_auth_required();
 
 		return array(
 			'has_secret'       => $has_secret,
 			'secret_valid'     => $secret_valid,
 			'has_public_key'   => $has_public_key,
 			'public_key_valid' => $public_key_valid,
-			'has_credential'   => $has_secret || $has_public_key,
-			'credential_valid' => $secret_valid || $public_key_valid,
+			'has_credential'   => $key_auth ? $has_public_key : $has_secret,
+			'credential_valid' => $key_auth ? $public_key_valid : $secret_valid,
 		);
 	}
 
diff --git a/tests/e2e/blueprint-screen-hmac.json b/tests/e2e/blueprint-screen-hmac.json
index 319e74c5..cda519ac 100644
--- a/tests/e2e/blueprint-screen-hmac.json
+++ b/tests/e2e/blueprint-screen-hmac.json
@@ -65,6 +65,10 @@
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-secret-discarded' );"
+		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-other-credential-ignored' );"
 		}
 	]
 }
diff --git a/tests/e2e/blueprint-screen.json b/tests/e2e/blueprint-screen.json
index d819e1f2..98f74259 100644
--- a/tests/e2e/blueprint-screen.json
+++ b/tests/e2e/blueprint-screen.json
@@ -58,6 +58,10 @@
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-public-key-removed' );"
 		},
+		{
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-other-credential-ignored' );"
+		},
 		{
 			"step": "runPHP",
 			"code": "<?php require '/wordpress/wp-load.php'; require '/wordpress/wp-content/wpcom-migration-e2e/screen-steps.php'; wpcom_migration_e2e_screen_step( 'assert-no-mode-headings' );"
diff --git a/tests/e2e/screen-steps.php b/tests/e2e/screen-steps.php
index 25674be3..e343ae11 100644
--- a/tests/e2e/screen-steps.php
+++ b/tests/e2e/screen-steps.php
@@ -315,6 +315,28 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_contains( $html, 'no longer matches this site', $step );
 			break;
 
+		case 'assert-other-credential-ignored':
+			// A credential this host does not verify, stored before the manual
+			// screen stopped offering it, must not read as ready.
+			if ( \WordPress\Reprint\Server\Utils::key_auth_required() ) {
+				$stored = Exporter::store_secret( $secret );
+			} else {
+				list( , $public_key ) = \WordPress\Reprint\Server\PublicKeyClient::generate_keypair();
+				$stored               = Exporter::store_public_key( $public_key );
+			}
+			if ( ! $stored ) {
+				throw new RuntimeException( "Step '$step': could not store the other credential." );
+			}
+			$state = Exporter::get_state();
+			if ( $state['has_credential'] || $state['credential_valid'] ) {
+				throw new RuntimeException( "Step '$step': the other credential must count for nothing: " . wp_json_encode( $state ) );
+			}
+			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_NEEDS_CONNECTING, $step );
+			wpcom_migration_e2e_expect_not_contains( wpcom_migration_e2e_render( $page ), 'Site ready to migrate', $step );
+			wpcom_migration_e2e_expect_not_contains( wpcom_migration_e2e_render_manual( $manual ), 'wpcom-migration-reprint-api-url', $step );
+			Exporter::discard_credentials();
+			break;
+
 		case 'assert-no-mode-headings':
 			$html = wpcom_migration_e2e_render( $page );
 			wpcom_migration_e2e_expect_not_contains( $html, 'wpcom-migration-mode', $step );

From 44a86040987feaca3b12b5b2346e67c7b66464c9 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 09:47:03 +0200
Subject: [PATCH 04/11] Set up the e2e network without WP-CLI

Playground downloads wp-cli.phar from playground.wordpress.net for any
blueprint with an enableMultisite step, and that download fails on CI
from time to time. The multisite blueprint now calls install_network()
and populate_network() itself and writes the constants with
defineWpConfigConsts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/e2e/blueprint-multisite.json | 17 +++++++++++++++--
 tests/e2e/run.sh                   |  4 ++--
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/tests/e2e/blueprint-multisite.json b/tests/e2e/blueprint-multisite.json
index 37db05d5..406911f6 100644
--- a/tests/e2e/blueprint-multisite.json
+++ b/tests/e2e/blueprint-multisite.json
@@ -7,11 +7,24 @@
 			"code": "<?php require '/wordpress/wp-content/wpcom-migration-e2e/install-flag-mock.php';"
 		},
 		{
-			"step": "enableMultisite"
+			"step": "runPHP",
+			"code": "<?php require '/wordpress/wp-load.php'; require_once ABSPATH . 'wp-admin/includes/upgrade.php'; require_once ABSPATH . 'wp-admin/includes/network.php'; install_network(); $result = populate_network( 1, 'localhost', get_option( 'admin_email' ), 'Network', '/', false ); if ( is_wp_error( $result ) ) { file_put_contents( 'php://stderr', $result->get_error_message() . \"\\n\" ); exit( 1 ); }"
+		},
+		{
+			"step": "defineWpConfigConsts",
+			"consts": {
+				"WP_ALLOW_MULTISITE": true,
+				"MULTISITE": true,
+				"SUBDOMAIN_INSTALL": false,
+				"DOMAIN_CURRENT_SITE": "localhost",
+				"PATH_CURRENT_SITE": "/",
+				"SITE_ID_CURRENT_SITE": 1,
+				"BLOG_ID_CURRENT_SITE": 1
+			}
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php require '/wordpress/wp-load.php'; require_once ABSPATH . 'wp-admin/includes/plugin.php'; $result = activate_plugin( 'wpcom-migration/wpcom_migration.php', '', true ); if ( is_wp_error( $result ) ) { file_put_contents( 'php://stderr', $result->get_error_message() . \"\\n\" ); exit( 1 ); }"
+			"code": "<?php require '/wordpress/wp-load.php'; if ( ! is_multisite() ) { file_put_contents( 'php://stderr', \"The network was not set up.\\n\" ); exit( 1 ); } require_once ABSPATH . 'wp-admin/includes/plugin.php'; $result = activate_plugin( 'wpcom-migration/wpcom_migration.php', '', true ); if ( is_wp_error( $result ) ) { file_put_contents( 'php://stderr', $result->get_error_message() . \"\\n\" ); exit( 1 ); }"
 		},
 		{
 			"step": "runPHP",
diff --git a/tests/e2e/run.sh b/tests/e2e/run.sh
index 2e66e397..b6aeb572 100755
--- a/tests/e2e/run.sh
+++ b/tests/e2e/run.sh
@@ -7,8 +7,8 @@
 # through the REST routes with application passwords: once with a shared
 # secret and once with a public key.
 #
-# The multisite scenario runs its blueprint without a server: Playground
-# refuses to enable multisite on a custom port, and its steps need no HTTP.
+# The multisite scenario runs its blueprint without a server: multisite
+# does not support custom ports, and its steps need no HTTP.
 #
 # Usage: tests/e2e/run.sh <built-plugin-dir>
 #   e.g. tests/e2e/run.sh build/wpcom-migration

From 96e015394e458ec7307bc1410ae3c0efe0fea0e6 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 09:50:46 +0200
Subject: [PATCH 05/11] Reorganise the README's screens and provisioning
 sections

Describe each screen before the main screen flag that decides which one
gets the sidebar row, and say plainly how WordPress.com reaches the
provisioning routes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 8c6f1a26..7dc268df 100644
--- a/README.md
+++ b/README.md
@@ -24,9 +24,9 @@ The build runs `composer install` in `plugin/`, copies the tree to a staging dir
 
 To activate a source checkout directly (without a build), run `composer install --no-dev --working-dir=plugin` first; without `plugin/vendor/` the plugin activates but the exporter and the WordPress.com connection are absent.
 
-## The Reprint migration screen
+## The screens
 
-`wp-admin/admin.php?page=wpcom-migration-status` (the plugin's one menu entry; `manage_options` to view; the `administrator` role to connect, disconnect, or provision through the routes; single-site only). The screen shows one mode at a time:
+`wp-admin/admin.php?page=wpcom-migration-status` is the Reprint migration screen. It tells the administrator where the site stands in the migration and offers the next step: connect the site to WordPress.com, continue on WordPress.com, or disconnect. Viewing it needs `manage_options`. Connecting, disconnecting, and provisioning through the routes need the `administrator` role. It works on single sites only, and shows one mode at a time:
 
 | Mode | When | Shows |
 |---|---|---|
@@ -38,13 +38,13 @@ To activate a source checkout directly (without a build), run `composer install
 
 `Settings_Page::mode()` picks the first that fits, top to bottom. *Go to WordPress.com* links to `https://my.wordpress.com/sites`; the `wpcom_migration_continue_url` filter changes that.
 
-Every activation sends the administrator to the main screen on their next wp-admin page load, except a bulk activation, which stays on the plugin list.
+`wp-admin/admin.php?page=wpcom-migration-manual` sets up Reprint by hand; see [Setting up Reprint manually](#setting-up-reprint-manually).
 
-The old BlogVault screen at `wp-admin/admin.php?page=wpcom-migration` is no longer in the sidebar. It stays reachable at its URL.
+`wp-admin/admin.php?page=wpcom-migration` is the BlogVault screen the plugin had before Reprint.
 
-Until the WordPress.com side of Reprint ships, WordPress.com decides which of the two screens is main: `Main_Screen` asks `GET https://public-api.wordpress.com/wpcom/v2/migration-plugin-config` for `{ "main_screen": "reprint" | "blogvault", "ttl": <seconds> }` on the first wp-admin page load after its stored answer (`wpcom_migration_main_screen`) expires. With `blogvault`, the old screen gets the sidebar row, the *Settings* link and the activation redirect, and the Reprint screen is reachable only at its URL. A failed fetch keeps the stored answer, or uses `blogvault` when there is none, and retries after five minutes. Networks never ask.
+Until the WordPress.com side of Reprint ships, WordPress.com decides which of the Reprint and BlogVault screens is the main one: `Main_Screen` asks `GET https://public-api.wordpress.com/wpcom/v2/migration-plugin-config` for `{ "main_screen": "reprint" | "blogvault", "ttl": <seconds> }` on the first wp-admin page load after its stored answer (`wpcom_migration_main_screen`) expires. A failed fetch keeps the stored answer, or uses `blogvault` when there is none, and retries after five minutes. The main screen gets the plugin's one sidebar row, the *Settings* link on the plugin list, and the activation redirect: every activation sends the administrator to it on their next wp-admin page load, except a bulk activation, which stays on the plugin list. The other screen stays reachable at its URL, as does the manual one. A brand whitelabelled with `hide` or `hide_from_menu` gets no sidebar row for either screen.
 
-On a network the old screen keeps its row in the network admin, and the *Settings* link and the activation redirect lead there; subsites get no row. A brand whitelabelled with `hide` or `hide_from_menu` takes away the Reprint screen's row too; the screen stays reachable at its URL.
+Networks never ask. On a network the BlogVault screen keeps its row in the network admin, and the *Settings* link and the activation redirect lead there; subsites get no row.
 
 ## Setting up Reprint manually
 
@@ -52,7 +52,7 @@ On a network the old screen keeps its row in the network admin, and the *Setting
 
 ## How WordPress.com provisions the exporter
 
-Two lanes end at the same two routes: `POST /wp-json/wpcom-migration/v1/reprint/install-public-key {"public_key"}` → `{ "key_id", "export_url" }` and `POST …/rotate-export-secret` → `{ "secret", "export_url" }`. All require an administrator, authenticated either by core (an application password) or by a Jetpack user token, and all answer 501 on a network. Reprint transfers over https only.
+WordPress.com reaches the site in one of two ways, described below: with an application password, or through a Jetpack connection. Either way it calls one of two routes: `POST /wp-json/wpcom-migration/v1/reprint/install-public-key {"public_key"}` → `{ "key_id", "export_url" }` or `POST …/rotate-export-secret` → `{ "secret", "export_url" }`. Both require an administrator, authenticated by core (an application password) or by a Jetpack user token, and both answer 501 on a network. Reprint transfers over https only.
 
 Which credential WordPress.com sets up depends on the host. Where `openssl_verify()` exists, Reprint signs with keys: WordPress.com installs its public key (PEM or one line of base64, RSA, 3072 bits or more; anything else is a 400 `wpcom_migration_invalid_public_key`), and `rotate-export-secret` answers 501 `wpcom_migration_secret_auth_unsupported`. Elsewhere it rotates the secret, and `install-public-key` answers 501 `wpcom_migration_key_auth_unsupported`. The site holds one key at a time; installing another replaces it. The exporter is on while either credential is stored and valid; there is no separate switch and no time limit, since the plugin is removed once the migration is done. Export requests are verified by Reprint's `RequestAuthenticator`, which accepts whichever of the two the host supports.
 

From df42dac33918cec6d4e2c7c99ad8d9643d13b037 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 10:48:06 +0200
Subject: [PATCH 06/11] Curl the apostrophes on the migration screen

Its paragraphs go through wptexturize() before esc_html(), so the
strings keep plain apostrophes and the screen shows typographic ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugin/reprint/class-settings-page.php | 2 +-
 tests/e2e/screen-steps.php             | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/plugin/reprint/class-settings-page.php b/plugin/reprint/class-settings-page.php
index abe3fe24..3f9b42ad 100644
--- a/plugin/reprint/class-settings-page.php
+++ b/plugin/reprint/class-settings-page.php
@@ -364,6 +364,6 @@ private static function site_address() {
 	 * @param string $text Plain text.
 	 */
 	private function render_sentence( $text ) {
-		echo '<p class="wpcom-migration-guidance">' . esc_html( $text ) . '</p>';
+		echo '<p class="wpcom-migration-guidance">' . esc_html( wptexturize( $text ) ) . '</p>';
 	}
 }
diff --git a/tests/e2e/screen-steps.php b/tests/e2e/screen-steps.php
index e343ae11..c2bdee8d 100644
--- a/tests/e2e/screen-steps.php
+++ b/tests/e2e/screen-steps.php
@@ -113,8 +113,8 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
 			$html = wpcom_migration_e2e_render( $page );
 			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--info">Site ready to migrate</p>', $step );
-			wpcom_migration_e2e_expect_contains( $html, untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) ) . ' is ready to migrate. The migration runs from WordPress.com, so there&#039;s nothing else to do here. Your site stays online and unchanged while it&#039;s copied.', $step );
-			wpcom_migration_e2e_expect_contains( $html, 'Keep this plugin active until the migration is done. We&#039;ll email you when it&#039;s finished.', $step );
+			wpcom_migration_e2e_expect_contains( $html, untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) ) . ' is ready to migrate. The migration runs from WordPress.com, so there&#8217;s nothing else to do here. Your site stays online and unchanged while it&#8217;s copied.', $step );
+			wpcom_migration_e2e_expect_contains( $html, 'Keep this plugin active until the migration is done. We&#8217;ll email you when it&#8217;s finished.', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'Your site is now ready to be copied', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'Go to WordPress.com', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'href="https://my.wordpress.com/sites"', $step );

From f03db932ca4e7f5b74da013c03f54f23274f799b Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 10:48:06 +0200
Subject: [PATCH 07/11] Give the ready and connected modes the same text and a
 green pill

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugin/reprint/class-settings-page.php | 34 ++++++++++----------------
 tests/e2e/connection-steps.php         |  3 ++-
 tests/e2e/screen-steps.php             |  2 +-
 3 files changed, 16 insertions(+), 23 deletions(-)

diff --git a/plugin/reprint/class-settings-page.php b/plugin/reprint/class-settings-page.php
index 3f9b42ad..7dd344c3 100644
--- a/plugin/reprint/class-settings-page.php
+++ b/plugin/reprint/class-settings-page.php
@@ -295,15 +295,8 @@ private function render_mode( $mode, $user_connected ) {
 				return;
 
 			case self::MODE_READY:
-				$this->render_pill_and_heading( __( 'Site ready to migrate', 'wpcom-migration' ), 'info' );
-				$this->render_sentence(
-					sprintf(
-						/* translators: %s: the site's address, without the scheme. */
-						__( '%s is ready to migrate. The migration runs from WordPress.com, so there\'s nothing else to do here. Your site stays online and unchanged while it\'s copied.', 'wpcom-migration' ),
-						self::site_address()
-					)
-				);
-				$this->render_sentence( __( 'Keep this plugin active until the migration is done. We\'ll email you when it\'s finished.', 'wpcom-migration' ) );
+				$this->render_pill_and_heading( __( 'Site ready to migrate', 'wpcom-migration' ), 'success' );
+				$this->render_ready_to_migrate();
 				if ( null !== $section ) {
 					$section->render_continue_button();
 				}
@@ -311,13 +304,7 @@ private function render_mode( $mode, $user_connected ) {
 
 			case self::MODE_CONNECTED_WAITING:
 				$this->render_pill_and_heading( __( 'Connected to WordPress.com', 'wpcom-migration' ), 'success' );
-				$this->render_sentence(
-					sprintf(
-						/* translators: %s: the site's address, without the scheme. */
-						__( '%s is ready to migrate. The migration runs from WordPress.com, so there\'s nothing else to do here.', 'wpcom-migration' ),
-						self::site_address()
-					)
-				);
+				$this->render_ready_to_migrate();
 				if ( null !== $section ) {
 					$section->render_continue_button();
 					$section->render_disconnect_link();
@@ -350,12 +337,17 @@ private function render_pill_and_heading( $pill = '', $tone = 'info' ) {
 	}
 
 	/**
-	 * The site's address, without the scheme.
-	 *
-	 * @return string
+	 * Renders the paragraphs the ready and connected modes share.
 	 */
-	private static function site_address() {
-		return untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) );
+	private function render_ready_to_migrate() {
+		$this->render_sentence(
+			sprintf(
+				/* translators: %s: the site's address, without the scheme. */
+				__( '%s is ready to migrate. The migration runs from WordPress.com, so there\'s nothing else to do here. Your site stays online and unchanged while it\'s copied.', 'wpcom-migration' ),
+				untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) )
+			)
+		);
+		$this->render_sentence( __( 'Keep this plugin active until the migration is done. We\'ll email you when it\'s finished.', 'wpcom-migration' ) );
 	}
 
 	/**
diff --git a/tests/e2e/connection-steps.php b/tests/e2e/connection-steps.php
index ab42173c..40194018 100644
--- a/tests/e2e/connection-steps.php
+++ b/tests/e2e/connection-steps.php
@@ -362,7 +362,8 @@ function ( $location ) {
 			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_CONNECTED_WAITING, $step );
 			$html = wpcom_migration_e2e_render_connect_page();
 			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--success">Connected to WordPress.com</p>', $step );
-			wpcom_migration_e2e_expect_contains( $html, untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) ) . ' is ready to migrate.', $step );
+			wpcom_migration_e2e_expect_contains( $html, untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) ) . ' is ready to migrate. The migration runs from WordPress.com, so there&#8217;s nothing else to do here. Your site stays online and unchanged while it&#8217;s copied.', $step );
+			wpcom_migration_e2e_expect_contains( $html, 'Keep this plugin active until the migration is done. We&#8217;ll email you when it&#8217;s finished.', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'e2e@example.com', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'Go to WordPress.com', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'href="https://my.wordpress.com/sites"', $step );
diff --git a/tests/e2e/screen-steps.php b/tests/e2e/screen-steps.php
index c2bdee8d..e1a55110 100644
--- a/tests/e2e/screen-steps.php
+++ b/tests/e2e/screen-steps.php
@@ -112,7 +112,7 @@ function wpcom_migration_e2e_screen_step( $step ) {
 			}
 			wpcom_migration_e2e_expect_mode( Settings_Page::MODE_READY, $step );
 			$html = wpcom_migration_e2e_render( $page );
-			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--info">Site ready to migrate</p>', $step );
+			wpcom_migration_e2e_expect_contains( $html, 'wpcom-migration-pill--success">Site ready to migrate</p>', $step );
 			wpcom_migration_e2e_expect_contains( $html, untrailingslashit( preg_replace( '#^https?://#i', '', home_url() ) ) . ' is ready to migrate. The migration runs from WordPress.com, so there&#8217;s nothing else to do here. Your site stays online and unchanged while it&#8217;s copied.', $step );
 			wpcom_migration_e2e_expect_contains( $html, 'Keep this plugin active until the migration is done. We&#8217;ll email you when it&#8217;s finished.', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'Your site is now ready to be copied', $step );

From a4f8be67ad2d3914f69a46334b8e0aa37356a601 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 11:20:41 +0200
Subject: [PATCH 08/11] Drop the support sentence from the manual screen

It is a debugging screen, not one users are sent to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                            | 2 +-
 plugin/reprint/class-manual-page.php | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 7dc268df..a8fb5036 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ Networks never ask. On a network the BlogVault screen keeps its row in the netwo
 
 ## Setting up Reprint manually
 
-`wp-admin/admin.php?page=wpcom-migration-manual` (`administrator` role, single-site only). Nothing links to it; support gives out the URL. It holds the credential the host verifies: on a host with `openssl_verify()`, a public key textarea (*Enroll key*, PEM or one line, replacing any enrolled key) and a table with the enrolled key's id and a *Remove* button; elsewhere, the export secret form and a *Remove secret* button. Below it, the export URL and the WordPress.com blog ID. Deactivating the plugin disconnects and discards both credentials.
+`wp-admin/admin.php?page=wpcom-migration-manual` (`administrator` role, single-site only). It is a debugging screen, and nothing links to it. It holds the credential the host verifies: on a host with `openssl_verify()`, a public key textarea (*Enroll key*, PEM or one line, replacing any enrolled key) and a table with the enrolled key's id and a *Remove* button; elsewhere, the export secret form and a *Remove secret* button. Below it, the export URL and the WordPress.com blog ID. Deactivating the plugin disconnects and discards both credentials.
 
 ## How WordPress.com provisions the exporter
 
diff --git a/plugin/reprint/class-manual-page.php b/plugin/reprint/class-manual-page.php
index 326e1bb2..067f1953 100644
--- a/plugin/reprint/class-manual-page.php
+++ b/plugin/reprint/class-manual-page.php
@@ -3,7 +3,7 @@
  * The by-hand screen: the export secret or the public key, whichever this
  * host verifies; export URL; blog ID.
  *
- * Nothing links here; support gives out the URL.
+ * A debugging screen. Nothing links here.
  *
  * @package wpcom-migration
  */
@@ -341,7 +341,6 @@ public function render_page() {
 		echo '<div class="wrap wpcom-migration-manual">';
 		$this->render_result_notice();
 		echo '<h1>' . esc_html__( 'Set up Reprint manually', 'wpcom-migration' ) . '</h1>';
-		echo '<p class="description">' . esc_html__( 'Support may ask you to set this up by hand.', 'wpcom-migration' ) . '</p>';
 
 		if ( Utils::key_auth_required() ) {
 			$this->render_public_key_section( $state );

From c372d48bd9fa6a65a586d7f0c35adb8743fbe2dc Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 11:20:41 +0200
Subject: [PATCH 09/11] Curl the apostrophe in the disconnect description

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugin/connection/class-connect-page.php | 2 +-
 tests/e2e/connection-steps.php           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugin/connection/class-connect-page.php b/plugin/connection/class-connect-page.php
index d4bd8a45..870c9833 100644
--- a/plugin/connection/class-connect-page.php
+++ b/plugin/connection/class-connect-page.php
@@ -232,7 +232,7 @@ public function render_disconnect_link() {
 				<button type="submit" name="wpcom_migration_disconnect_submit" class="wpcom-migration-link wpcom-migration-link--quiet"><?php esc_html_e( 'Disconnect', 'wpcom-migration' ); ?></button>
 			</p>
 			<p class="wpcom-migration-description">
-				<?php esc_html_e( 'Removes this site\'s connection to WordPress.com.', 'wpcom-migration' ); ?>
+				<?php echo esc_html( wptexturize( __( 'Removes this site\'s connection to WordPress.com.', 'wpcom-migration' ) ) ); ?>
 			</p>
 		</form>
 		<?php
diff --git a/tests/e2e/connection-steps.php b/tests/e2e/connection-steps.php
index 40194018..eb720682 100644
--- a/tests/e2e/connection-steps.php
+++ b/tests/e2e/connection-steps.php
@@ -369,7 +369,7 @@ function ( $location ) {
 			wpcom_migration_e2e_expect_contains( $html, 'href="https://my.wordpress.com/sites"', $step );
 			wpcom_migration_e2e_expect_primary_count( $html, 1, $step );
 			wpcom_migration_e2e_expect_contains( $html, 'value="' . Connect_Page::DISCONNECT_ACTION . '"', $step );
-			wpcom_migration_e2e_expect_contains( $html, 's connection to WordPress.com.', $step );
+			wpcom_migration_e2e_expect_contains( $html, '&#8217;s connection to WordPress.com.', $step );
 			wpcom_migration_e2e_expect_not_contains( $html, (string) WPCOM_MIGRATION_E2E_BLOG_ID, $step );
 			wpcom_migration_e2e_expect_not_contains( $html, 'Connect WordPress.com', $step );
 

From ae8e4a3932184434ee05cbd403ec714bd5723a45 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 11:30:59 +0200
Subject: [PATCH 10/11] Trim the README's hooks line and known limitations

Drop the event hooks line, which only matters to someone writing a
listener and is documented where the hooks fire, and the https
limitation, which the client enforces rather than this plugin. Name the
Jetpack connection package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index a8fb5036..ef6e9676 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ To activate a source checkout directly (without a build), run `composer install
 
 ## The screens
 
-`wp-admin/admin.php?page=wpcom-migration-status` is the Reprint migration screen. It tells the administrator where the site stands in the migration and offers the next step: connect the site to WordPress.com, continue on WordPress.com, or disconnect. Viewing it needs `manage_options`. Connecting, disconnecting, and provisioning through the routes need the `administrator` role. It works on single sites only, and shows one mode at a time:
+`wp-admin/admin.php?page=wpcom-migration-status` is the Reprint migration screen. It tells the administrator where the site stands in the migration and offers the next step: connect the site to WordPress.com or continue on WordPress.com. Viewing it needs `manage_options`. Connecting, disconnecting, and provisioning through the routes need the `administrator` role. It works on single sites only, and shows one mode at a time:
 
 | Mode | When | Shows |
 |---|---|---|
@@ -52,7 +52,7 @@ Networks never ask. On a network the BlogVault screen keeps its row in the netwo
 
 ## How WordPress.com provisions the exporter
 
-WordPress.com reaches the site in one of two ways, described below: with an application password, or through a Jetpack connection. Either way it calls one of two routes: `POST /wp-json/wpcom-migration/v1/reprint/install-public-key {"public_key"}` → `{ "key_id", "export_url" }` or `POST …/rotate-export-secret` → `{ "secret", "export_url" }`. Both require an administrator, authenticated by core (an application password) or by a Jetpack user token, and both answer 501 on a network. Reprint transfers over https only.
+WordPress.com reaches the site in one of two ways, described below: with an application password, or through a Jetpack connection. Either way it calls one of two routes: `POST /wp-json/wpcom-migration/v1/reprint/install-public-key {"public_key"}` → `{ "key_id", "export_url" }` or `POST …/rotate-export-secret` → `{ "secret", "export_url" }`. Both require an administrator, authenticated by core (an application password) or by a Jetpack user token, and both answer 501 on a network.
 
 Which credential WordPress.com sets up depends on the host. Where `openssl_verify()` exists, Reprint signs with keys: WordPress.com installs its public key (PEM or one line of base64, RSA, 3072 bits or more; anything else is a 400 `wpcom_migration_invalid_public_key`), and `rotate-export-secret` answers 501 `wpcom_migration_secret_auth_unsupported`. Elsewhere it rotates the secret, and `install-public-key` answers 501 `wpcom_migration_key_auth_unsupported`. The site holds one key at a time; installing another replaces it. The exporter is on while either credential is stored and valid; there is no separate switch and no time limit, since the plugin is removed once the migration is done. Export requests are verified by Reprint's `RequestAuthenticator`, which accepts whichever of the two the host supports.
 
@@ -60,8 +60,6 @@ Which credential WordPress.com sets up depends on the host. Where `openssl_verif
 
 **Jetpack connection** — everywhere else, including sites where Wordfence or another security plugin has disabled application passwords. The administrator installs the plugin from the plugin directory and presses *Connect WordPress.com* on the screen; the connection package registers the site and sends them to WordPress.com to authorize, then back. A site that already runs Jetpack is connected at once for the account that connected Jetpack — the connection is shared. WordPress.com then calls the route signed with the user token.
 
-Connection events fire `wpcom_migration_connection_event`, exporter events `wpcom_migration_reprint_export_event`; none carries a token, secret or signature.
-
 ## Checks
 
 ```sh
@@ -81,8 +79,7 @@ Publishing to wp.org is not automated.
 - Running this plugin next to `reprint-server-wp` is unsupported. Both ship the same package; a request that loads classes from both copies can fatal on the package's path-required function files.
 - The reprint client appends `&reprint-api` to any URL that lacks it. If `reprint-server-wp` is active and loads first, it answers on `reprint-api` before this plugin runs.
 - Sites on placeholder salts get the write veto but not the salt binding: `wp_salt()` stores its own salt in `wp_options`, where whoever can write the credential can read it.
-- The connection package requires PHP 7.4, so the plugin does too.
-- Reprint transfers over https only; a site that cannot serve https cannot be migrated this way.
+- The Jetpack connection package (`automattic/jetpack-connection`) requires PHP 7.4, so the plugin does too.
 - `wp/v2/plugins` installs from wordpress.org by slug only, so the version with the exporter must be published there before WordPress.com can install it.
 
 ## Security

From 89949b809c638fa104d8c963bf344e1406d876e5 Mon Sep 17 00:00:00 2001
From: Fredrik Rombach Ekelund <fredrik.rombach.ekelund@automattic.com>
Date: Mon, 12 Oct 2026 11:38:04 +0200
Subject: [PATCH 11/11] Drop the README's reprint-server-wp fatal claim

Loading the package from both plugins cannot fatal: compat.php declares
nothing, and HTTPServer::serve() loads export.php only once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index ef6e9676..0d70362c 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,6 @@ Publishing to wp.org is not automated.
 
 ## Known limitations
 
-- Running this plugin next to `reprint-server-wp` is unsupported. Both ship the same package; a request that loads classes from both copies can fatal on the package's path-required function files.
 - The reprint client appends `&reprint-api` to any URL that lacks it. If `reprint-server-wp` is active and loads first, it answers on `reprint-api` before this plugin runs.
 - Sites on placeholder salts get the write veto but not the salt binding: `wp_salt()` stores its own salt in `wp_options`, where whoever can write the credential can read it.
 - The Jetpack connection package (`automattic/jetpack-connection`) requires PHP 7.4, so the plugin does too.