diff --git a/crates/buzz-relay/src/api/operator/community_policy.rs b/crates/buzz-relay/src/api/operator/community_policy.rs
index df55a0c1d4..ecf86985fb 100644
--- a/crates/buzz-relay/src/api/operator/community_policy.rs
+++ b/crates/buzz-relay/src/api/operator/community_policy.rs
@@ -49,14 +49,8 @@ fn unavailable(error: buzz_db::DbError) -> Error {
 }
 
 fn mode_fields(state: &AppState, required: Option<bool>) -> Value {
-    use buzz_auth::NipFiMode;
     let mode = state.config.nip_fi.mode;
-    let name = match mode {
-        NipFiMode::Off => "off",
-        NipFiMode::Shadow => "shadow",
-        NipFiMode::Enforce => "enforce",
-        NipFiMode::DenyProtected => "deny-protected",
-    };
+    let name = crate::nip_fi_config::mode_name(mode);
     serde_json::json!({
         "mode": name,
         "effective_required": required.map(|r| mode.with_requirement(r).restricts()),
diff --git a/crates/buzz-relay/src/nip_fi_config.rs b/crates/buzz-relay/src/nip_fi_config.rs
index fa1b54f4d7..a6ed9c3280 100644
--- a/crates/buzz-relay/src/nip_fi_config.rs
+++ b/crates/buzz-relay/src/nip_fi_config.rs
@@ -620,14 +620,19 @@ fn parse_mode() -> Result<NipFiMode, ConfigError> {
     }
 }
 
-/// A missing-setting startup error naming the configured mode.
-fn mode_requires(mode: NipFiMode, missing: &str) -> ConfigError {
-    let value = match mode {
+/// Stable configured mode name for operator diagnostics and status.
+pub(crate) fn mode_name(mode: NipFiMode) -> &'static str {
+    match mode {
         NipFiMode::Enforce => "enforce",
         NipFiMode::Shadow => "shadow",
         NipFiMode::Off => "off",
         NipFiMode::DenyProtected => "deny_protected",
-    };
+    }
+}
+
+/// A missing-setting startup error naming the configured mode.
+fn mode_requires(mode: NipFiMode, missing: &str) -> ConfigError {
+    let value = mode_name(mode);
     ConfigError::InvalidValue(format!("BUZZ_NIP_FI_MODE={value} but {missing}"))
 }
 
diff --git a/docs/community-auth-upgrades.md b/docs/community-auth-upgrades.md
index 0d246da120..1692b5ee52 100644
--- a/docs/community-auth-upgrades.md
+++ b/docs/community-auth-upgrades.md
@@ -100,7 +100,7 @@ General status can read legacy receipts, with null CAS preconditions.
 ## Request enforcement and discovery
 
 `off` ignores stored requirements; `shadow` enforces stored true; `enforce` is a
-global requirement floor; `deny-protected` denies protected traffic. Report
+global requirement floor; `deny_protected` denies protected traffic. Report
 `effective_required` alongside stored state so disable under enforce and enable
 under off cannot be mistaken for effective changes. Evaluating policy lookups
 fail closed on errors; off does not require an FI policy read.