diff --git a/beehive/FIRST_DEMO_FINALIZATION.md b/beehive/FIRST_DEMO_FINALIZATION.md
new file mode 100644
index 0000000000..54fcd7eefd
--- /dev/null
+++ b/beehive/FIRST_DEMO_FINALIZATION.md
@@ -0,0 +1,92 @@
+# First-demo finalization — recovered state and remaining delta
+
+## Recovered repository state (2026-09-10)
+
+Worktree `REPOS/beehive-demo-transport-473233b8`, branch
+`beehive/demo-transport-473233b8`, approved origin `https://github.com/block/buzz.git`.
+Working tree clean. Local HEAD `ac32ae0d2`
+(`ac32ae0d248f61aaec1e8730b98544a93ccfb023`, "integrate private public-CLI Start
+reply Stop with fresh membership"). Remote branch head at recovery:
+`6caa4150d` — five local commits not yet published:
+`3dbf9aaaa` (owner-public immutable bindings and local wizard),
+`1315af75c` (credential-neutral assignment/auth guidance),
+`ac781fd95` (direct relay membership over relay HTTP contract; module fc62c755),
+`7176028b7` (module correction 30fffd4e: bounded chunked body acquisition and
+signer settling), `ac32ae0d2` (main public command-path integration + FIRST_DEMO.md).
+
+## Combined DEFAULT concurrent installed-enabled run — actual result
+
+Owned runner PID 59155 (evidence directory
+`WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/CLI_INTEGRATION_5A40/`, script `run-candidate.sh`,
+pin `v24.15.0` + `ac32ae0d2...` + clean status) **completed naturally**; it was not
+killed, restarted or duplicated during recovery. Actual recorded outcome:
+
+- Strict `tsc --noEmit`: exit 0.
+- Full default concurrent installed-enabled suite (`node --test test/*.test.ts`,
+  `BEEHIVE_REAL_BUZZ_ACP=/Applications/Buzz.app/Contents/MacOS/buzz-acp`):
+  **156/157 pass, 1 fail, natural duration 318624.507541 ms** (~318.6 s).
+  The single failure is the previously known compatibility assertion in
+  `test/enrollment-input.test.ts:35` ("actual standalone CLI private pairing,
+  existing-owner approval and bootstrap return stay offline"):
+  `assert.ok(imported.includes('Pending/no network'))`.
+- Run exited 1 (`full-default-installed.exit`, `complete.exit`); source and
+  native before/after sha256 sets identical (no file drift during the run).
+
+## Known assertion diagnosis (actual behavior inspected)
+
+Offline import remains offline: `enrollHostIdentity` writes the signed approval
+locally only, and `requireHostEnrollment` still reports
+"relay admission pending". The wording-only regression is in commit `ac32ae0d2`:
+the import completion line replaced
+`Host registered. Pending/no network: narrow relay admission is not implemented...`
+with guidance that no longer contains the literal `Pending/no network`, while the
+old test still asserts that phrase. No behavior, network use or test change is
+required; restoring clear truthful `Pending/no network` guidance in the import
+output is the compatibility fix. (The removed "narrow relay admission is not
+implemented" claim is outdated — direct relay membership is implemented and
+verified — and stays removed.)
+
+## Remaining delta for this finalization
+
+1. Restore `Pending/no network` wording in the offline import completion message.
+2. Strict + focused offline-enrollment test after the wording-only repair; no full
+   rerun solely for wording.
+3. Commit and publish the five verified local commits plus this delta to
+   `beehive/demo-transport-473233b8`.
+
+## Delta result (wording-only repair, updated at test boundary)
+
+Import completion line now reads: `Host registered offline. Pending/no network:
+relay admission remains pending. Host startup requires an already-enrolled direct
+relay member and a fresh live row check. No agent authorized or started.`
+Behavior unchanged: import stays offline, admission stays pending; the outdated
+"narrow relay admission is not implemented" claim stays removed.
+
+- Strict `tsc --noEmit` (node v24.15.0, package-local): exit 0.
+- Focused `node --test test/enrollment-input.test.ts`: **1/1 pass, natural
+  624.229166 ms**. This is the only test asserting the import output; no other
+test or module consumes that wording.
+
+The combined DEFAULT concurrent installed-enabled full-suite result above
+(156/157, natural 318.6 s, strict pass, unchanged source/native hashes) remains
+attributed to candidate `ac32ae0d2` and is preserved as-is; the wording repair
+is validated separately by this delta. Full-suite 149/149 evidence for `3dbf9aaaa`
+(natural 357.645 s + strict) remains preserved in `WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/`
+and the earlier strict+focused CLI-delta runs in `CLI_INTEGRATION_5A40.md`; none
+were rerun for this wording-only change.
+
+Publication state recorded at the commit boundary below.
+
+## FIRST_DEMO.md review against implemented CLI
+
+Verified commands and guards exist as documented: `setup` (create/approve/import),
+`provision-agent`, `reconcile-provision`, `auth-info`, `catalog`, private
+`host <dir> <relay> --owner-present` (guard: private installation without the flag
+exits with the OS-credential consent error), `tui <catalog> <relay>` with hidden
+owner signer, TUI commands `hosts/select/show/save/start/restart/stop/quit`,
+credential helper 10 s deadline, 10 s admission verification window, fresh
+single-use membership proof with close/reopen requirement after transport loss.
+Owner-run steps, prerequisites owner/operator must supply, and commands not
+executed by workers are in `FIRST_DEMO.md`.
+
+Result verified and recorded above; publication record follows.
diff --git a/beehive/src/enrollment-input.ts b/beehive/src/enrollment-input.ts
index 7ca725b2f8..e890497256 100644
--- a/beehive/src/enrollment-input.ts
+++ b/beehive/src/enrollment-input.ts
@@ -33,7 +33,7 @@ export async function enrollmentInput(directory: string): Promise<void> {
       console.log('Registration signed. Owner secret not persisted. Transfer approval privately back to host. Relay admission remains pending.');
     } else if (action === 'import') {
       enrollHostIdentity(directory, readPrivate(resolve(text(await ui.question('Private approval file: ')))));
-      console.log('Host registered offline. Host startup requires an already-enrolled direct relay member and a fresh live row check. No agent authorized or started.');
+      console.log('Host registered offline. Pending/no network: relay admission remains pending. Host startup requires an already-enrolled direct relay member and a fresh live row check. No agent authorized or started.');
     } else throw Error('Unknown enrollment action');
   } finally { ui.close(); }
 }