diff --git a/test/integration/route-forwarding.test.ts b/test/integration/route-forwarding.test.ts
index b6ecce0..5100447 100644
--- a/test/integration/route-forwarding.test.ts
+++ b/test/integration/route-forwarding.test.ts
@@ -37,7 +37,7 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll, foundationBundle, catalogueModule, catalogueIsPresent } from "./harness.ts";
+import { labIsUsable, destroyAll, foundationBundle, catalogueModule, catalogueIsPresent, deriveTheFilterOn } from "./harness.ts";
 import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
@@ -172,10 +172,19 @@ test("the mesh routes a public name through the proxy to the consumer, and withd
   // the bed sets first.
   await mesh(`node public-domain ${MACHINE} ${DOMAIN}`);
   // The authority certifies itself for the machine's private-network address, which is what a
-  // consumer on any node dials; a machine raised from the bundle has none until it is placed on
-  // the overlay. Placed as a hub of one, the way a real first node is.
+  // consumer on any node dials (ADR 0098); a machine raised from the bundle has none until it is
+  // placed on the overlay. Placed as a hub of one, the way a real first node is, and converged
+  // BEFORE the modules arrive: the proxy fetches the authority's roots at that address at first
+  // start, so the interface must exist by then — in one push the order between modules is not
+  // promised. The derived filter admits the hub's port, as genesis does on a control-node (ADR 0088).
   await mesh(`overlay place ${MACHINE} --hub --endpoint 192.0.2.10:51820 --site lab`);
   await mesh(`assign ${MACHINE} networking`);
+  await mesh(`push ${MACHINE}`);
+  await settled();
+  await deriveTheFilterOn({ machine: MACHINE, node: MACHINE, hubPort: 51820,
+    must: (_m, c, t) => must(c, t), mesh, on: (_m, c, t) => on(c, t) });
+  const overlay = await must(`ip -4 addr show dev mesh0 2>&1 || ip -4 addr 2>&1`);
+  assert.match(overlay, /inet 10\./, `${MACHINE} has no private-network address after networking converged:\n${overlay}`);
   for (const name of ["step-ca", "route-proxy", "hello-web"]) {
     await must(`printf %s ${quote(catalogueModule(name, held))} > /tmp/${name}.json && docker cp /tmp/${name}.json mesh-controller:/${name}.json`);
     await mesh(`module add /${name}.json`);