Found preparing the control-node's convergence. Reach is settled independently by the filter, the proxy's names and the certificate authority, so "this must not be public" cannot be written and a public certificate is obtained regardless. And the forward chain allows two hardcoded ranges plus a typed list, though the mesh already knows which networks exist because its own modules declared them — a range wide enough to keep four of them would have forwarded two predecessor leftovers too.