diff --git a/docs/reaching-a-host-you-cannot-dial.md b/docs/reaching-a-host-you-cannot-dial.md
index 30d3ea3..3538451 100644
--- a/docs/reaching-a-host-you-cannot-dial.md
+++ b/docs/reaching-a-host-you-cannot-dial.md
@@ -12,11 +12,11 @@ This document is the comparison between them, which is the thing that has to be
 built, and then the plan. It replaces an earlier draft of `docs/jump-hosts.md` that recommended deleting the
 jump chain — see the last section for why that was wrong.
 
-> **Status: planned, nothing started.** Step 0 is a one-line honesty fix and should not wait for the rest.
+> **Status: step 0 done, the rest planned.**
 >
 > | Step | State | Notes |
 > | --- | --- | --- |
-> | 0. Stop promising the relay | Not started | The checkbox is wired to storage and to nothing else |
+> | 0. Stop promising the relay | **Done** | Both heads say the box is not wired up and that ticking it stores the address and changes nothing. Left tickable, so a host already carrying the flag can lose it |
 > | 1. The loopback bridge | Not started | ADR 0004's "one mechanism, two features" |
 > | 2. Jump hosts over it | Not started | No server change at all |
 > | 3. The relay over it | Not started | Ticket call, WebSocket, then the same bridge |
@@ -38,9 +38,13 @@ design, per ADR 0004 — and the connection is still made from their laptop to t
 not reach. It then fails exactly as it did before, with no hint that the box did nothing.
 
 This is worse than the jump chain, which is invisible and harmless. It is a control that spends something
-real. Step 0 exists because it should not survive another release in that state, and it is one line: the
-checkbox says the relay is not wired up yet, the way this codebase already handles port forwarding on the
-phone's More screen.
+real.
+
+**Step 0 is done.** Both heads now name the absence in the label and lead the paragraph under it with what
+ticking the box actually does today — the way this codebase already handles port forwarding on the phone's
+More screen. It is left *tickable* rather than disabled, deliberately: a host that already carries the flag
+has to be able to lose it, and a disabled control would trap the concession on. The sentence comes out again
+at step 3.
 
 ## The comparison
 
diff --git a/src/DodoSSH.Client.Android/Views/HostsScreen.axaml b/src/DodoSSH.Client.Android/Views/HostsScreen.axaml
index 622cc11..bb3a919 100644
--- a/src/DodoSSH.Client.Android/Views/HostsScreen.axaml
+++ b/src/DodoSSH.Client.Android/Views/HostsScreen.axaml
@@ -1099,13 +1099,20 @@
             ◆ The one control here that publishes something. Turning it on copies this host's address and
             port into plaintext columns the server can read, which is the single deliberate concession in
             the design — see ADR 0004 — so it says so rather than being a switch labelled "relay".
+
+            ◆ AND IT SAYS, FIRST, THAT IT BUYS NOTHING TODAY. The relay's server half is built and this
+            client has no path to it — the connect path dials the address directly whether this is ticked or
+            not — so the box as it stood spent that concession and delivered nothing for it. Left tickable
+            rather than disabled, so a host already carrying the flag can lose it. See
+            docs/reaching-a-host-you-cannot-dial.md.
           -->
           <CheckBox IsChecked="{Binding EditorRelayEnabled}" MinHeight="44">
-            <TextBlock Classes="mono" FontSize="11.5" Text="Reach this host through the server relay"
+            <TextBlock Classes="mono" FontSize="11.5"
+                       Text="Reach this host through the server relay (not wired up yet)"
                        TextWrapping="Wrap" />
           </CheckBox>
           <TextBlock Classes="body"
-                     Text="The relay dials on your behalf, so this host's address and port are stored on the server in the clear. Everything else about it stays encrypted. A relayed host also needs a port of its own rather than its group's." />
+                     Text="Not built yet: this app always dials the host itself, so ticking this stores the address on the server and changes nothing about how the host is reached. When it works, the relay will dial on your behalf — which is why the address and port have to be stored in the clear. Everything else about the host stays encrypted either way, and a relayed host needs a port of its own rather than its group's." />
 
           <Grid ColumnDefinitions="*,8,*" Margin="0,6,0,0">
             <Button Grid.Column="0" Classes="primary" Height="44" Content="SAVE"
diff --git a/src/DodoSSH.Client.App/Views/HostDrawer.axaml b/src/DodoSSH.Client.App/Views/HostDrawer.axaml
index 6842665..6a1d632 100644
--- a/src/DodoSSH.Client.App/Views/HostDrawer.axaml
+++ b/src/DodoSSH.Client.App/Views/HostDrawer.axaml
@@ -514,14 +514,25 @@
                 </ComboBox>
 
                 <CheckBox IsChecked="{Binding EditorRelayEnabled}"
-                          Content="Connect through the server relay" />
+                          Content="Connect through the server relay (not wired up yet)" />
                 <!--
                   Stated at the moment the decision is made, which is the only place it means anything. With
                   relay off the server stores no address at all; with it on the server must be able to
                   resolve the target, or it becomes an authenticated open proxy into the operator's network.
+
+                  ◆ AND IT SAYS, FIRST, THAT TICKING IT BUYS NOTHING TODAY. The server half of the relay is
+                  built and this client has no path to it: VaultViewModel dials the address directly whether
+                  this is ticked or not. So the box as it stood spent the one deliberate privacy concession
+                  in the design — the address in plaintext columns — and delivered a connection that failed
+                  exactly as it had before, with nothing saying why.
+
+                  Left tickable rather than disabled, because a host that already carries the flag has to be
+                  able to lose it, and a disabled control would trap the concession on. See
+                  docs/reaching-a-host-you-cannot-dial.md, which is the plan that makes this sentence
+                  removable.
                 -->
                 <TextBlock Classes="hint" FontSize="11"
-                           Text="The relay stores this host's address on the server in plain text. Everything else stays encrypted." />
+                           Text="Not built yet: this client always dials the host itself, so ticking this stores the address on the server and changes nothing about how the host is reached. When it does work, the relay will dial on your behalf — which is why the address and port have to be stored in plain text. Everything else about the host stays encrypted either way." />
 
                 <!--
                   Withdrawing host key trust lives here, in the host's own settings, because a changed host