diff --git a/test/beds-read-the-catalogue.test.ts b/test/beds-read-the-catalogue.test.ts
index 720a356..39bfcdf 100644
--- a/test/beds-read-the-catalogue.test.ts
+++ b/test/beds-read-the-catalogue.test.ts
@@ -56,8 +56,6 @@ const STILL_CARRIED: Record<string, { modules: string[]; why: string }> = {
     why: "BESIDE (lavinmq, with a bootstrap step and a data directory the catalogue has not got); DIFFERS (amqp-ping names its entrypoint)" },
   "provider-uses-mesh-credential.test.ts": { modules: ["redis"], why: "WEARING: a credential mechanism test" },
   "runtime-restart-on-config.test.ts": { modules: ["grafana"], why: "WEARING: a restart mechanism test" },
-  "route-forwarding.test.ts": { modules: ["route-proxy", "hello-web"],
-    why: "WEARING: route-proxy without its certificate authority, hello-web with the route shape ADR 0066 replaced — waits on novox/hq 04-ISSUES/076 (step-ca's root is a minted secret, so the catalogue's authority cannot be raised beside the proxy yet)" },
   "mesh.test.ts": { modules: ["postgres", "builder", "umami"],
     why: "WEARING: a postgres with no resources, a builder that builds itself, an umami that is another module of that name" },
 };
diff --git a/test/integration/route-forwarding.test.ts b/test/integration/route-forwarding.test.ts
index 9ded2b1..8fb35da 100644
--- a/test/integration/route-forwarding.test.ts
+++ b/test/integration/route-forwarding.test.ts
@@ -37,7 +37,7 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll, foundationBundle, onTheMachine } from "./harness.ts";
+import { labIsUsable, destroyAll, foundationBundle, catalogueModule, catalogueIsPresent } from "./harness.ts";
 import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
@@ -50,12 +50,14 @@ const skip = !capability.usable
     ? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
     : !bundle || !existsSync(bundle)
       ? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
-      : false;
+      : catalogueIsPresent();
 
 const SCENARIO = "route-forwarding";
 const MACHINE = "anchor";
 const NAME = "hello.example";
 const PAGE = "hello from hello-web, routed by the mesh";
+/** The node's public domain; hello-web's label composes under it (ADR 0066). */
+const DOMAIN = "example";
 
 let instanceId = "";
 let held: HeldImage[] = [];
@@ -85,10 +87,6 @@ async function mesh(command: string, timeoutMs?: number): Promise<string> {
 }
 
 /** The reference a manifest should carry, once this scenario has been raised. */
-/** What a manifest's image reference becomes on the machine — ours by ID, everything else as written. */
-function pinned(reference: string): string {
-  return onTheMachine(reference, held);
-}
 
 /** The foundation bundle: ours by the ID the machine holds, everything else upstream. */
 function bundleFor(images: HeldImage[]): string {
@@ -167,64 +165,18 @@ after(async () => {
 test("the mesh routes a public name through the proxy to the consumer, and withdraws it on unassign", {
   skip, timeout: 1_500_000,
 }, async () => {
-  // The PROVIDER: route-proxy in the plain-HTTP shape — provides `route`, is given every consumer as
-  // the file at receives.route, forwards by Host. No TLS here (that is certificates.test.ts); the
-  // image is pinned to what this scenario serves by digest.
-  const proxyManifest = JSON.stringify({
-    module: "route-proxy",
-    version: "1",
-    capabilities: ["container-runtime"],
-    provides: [{ name: "route", scope: "mesh" }],
-    serves: { route: {} },
-    receives: { route: "/var/lib/route-proxy/routes/mesh.json" },
-    listens: [{ port: 80, protocol: "tcp", from: "anywhere", why: "public HTTP; the route-forwarding front door" }],
-    resources: [
-      { id: "state", type: "directory", path: "/var/lib/route-proxy", mode: "0700" },
-      { id: "routes-dir", type: "directory", path: "/var/lib/route-proxy/routes", mode: "0700" },
-      {
-        id: "server", type: "container", name: "route-proxy",
-        image: pinned("mesh-route-proxy"), network: "host",
-        volumes: ["/var/lib/route-proxy/routes:/routes:ro"],
-        env: { ROUTES: "/routes/mesh.json", LISTEN: ":80" },
-      },
-    ],
-  });
-
-  // The CONSUMER: hello-web requires `route` and contributes the name it wants and the port it
-  // listens on. It runs no code of the mesh's — a bare alpine serving a fixed page over a busybox nc
-  // loop stands in for a web service. `contributes` is what makes it *ask*: the grant forms from it.
-  const webManifest = JSON.stringify({
-    module: "hello-web",
-    slug: "hello",
-    version: "1",
-    capabilities: ["container-runtime"],
-    requires: ["route"],
-    contributes: { route: { name: NAME, port: 8080 } },
-    binds: { route: "/var/lib/hello-web/route.json" },
-    listens: [{ port: 8080, protocol: "tcp", from: "mesh", why: "the demo page; only the proxy reaches it" }],
-    resources: [
-      { id: "state", type: "directory", path: "/var/lib/hello-web", mode: "0700" },
-      { id: "page", type: "file", path: "/var/lib/hello-web/index.html", mode: "0644", content: `${PAGE}\n` },
-      { id: "net", type: "network", name: "hello-web" },
-      {
-        id: "server", type: "container", name: "hello-web",
-        image: pinned("alpine"), network: "hello-web", ports: ["8080:8080"],
-        volumes: ["/var/lib/hello-web/index.html:/www/index.html:ro"],
-        args: ["sh", "-c",
-          "while true; do { printf 'HTTP/1.1 200 OK\\r\\nContent-Type: text/plain\\r\\nConnection: close\\r\\n\\r\\n'; cat /www/index.html; } | nc -l -p 8080; done"],
-      },
-    ],
-  });
-
-  await must(`printf %s ${quote(proxyManifest)} > /tmp/route-proxy.json && docker cp /tmp/route-proxy.json mesh-controller:/route-proxy.json`);
-  await mesh("module add /route-proxy.json");
-  // No `module issue`: route-proxy has no broker account and no own-secret to mint. `assign` resolves
-  // its plan and the provider is matchable by a consumer's route from that alone.
-  await mesh(`assign ${MACHINE} route-proxy`);
-
-  await must(`printf %s ${quote(webManifest)} > /tmp/hello-web.json && docker cp /tmp/hello-web.json mesh-controller:/hello-web.json`);
-  await mesh("module add /hello-web.json");
-  await mesh(`assign ${MACHINE} hello-web`);
+  // All three from the catalogue (novox/hq ADR 0093, issue 074): the authority the proxy requires,
+  // the proxy, and the consumer. The proxy's manifest names the runtime image the scenario stocks;
+  // the authority and the consumer's server are pulled upstream by digest. The name the consumer
+  // is routed under is composed from its label and the node's public domain (ADR 0066), which
+  // the bed sets first.
+  await mesh(`node public-domain ${MACHINE} ${DOMAIN}`);
+  for (const name of ["step-ca", "route-proxy", "hello-web"]) {
+    await must(`printf %s ${quote(catalogueModule(name, held))} > /tmp/${name}.json && docker cp /tmp/${name}.json mesh-controller:/${name}.json`);
+    await mesh(`module add /${name}.json`);
+    if (name === "step-ca") await mesh(`module issue ${name} --node ${MACHINE}`);
+    await mesh(`assign ${MACHINE} ${name}`);
+  }
 
   await mesh(`push ${MACHINE}`);
   await settled();