diff --git a/README.md b/README.md
index bb993ae..309385f 100644
--- a/README.md
+++ b/README.md
@@ -238,12 +238,12 @@ it writes the generated tunnel MAC to the selected TAP driver's
 `NetworkAddress` registry setting and marks TAP media disconnected. That clears
 stale connected state from a previous crashed run without letting the TAP
 adapter influence relay DNS or route selection. The client then resolves the
-relay endpoint, completes the control-stream hello/welcome handshake, pins a
-host route for the resolved relay IP on the current pre-TAP interface, verifies
-that Windows is already using that host route, verifies it again after TAP
-activation, and bridges Ethernet frames between the relay and the TAP-Windows6
-adapter until shutdown. `--relay` accepts a DNS name or socket address; bare
-hosts default to UDP/443.
+relay endpoint, pins a host route for the resolved relay IP on the current
+pre-TAP interface, verifies that Windows is using that host route, completes
+the control-stream hello/welcome handshake, verifies the host route again after
+TAP activation, and bridges Ethernet frames between the relay and the
+TAP-Windows6 adapter until shutdown. `--relay` accepts a DNS name or socket
+address; bare hosts default to UDP/443.
 TAP frames whose source MAC does not match that generated tunnel MAC are
 dropped locally before they can consume relay bandwidth; the relay still
 enforces the same source-MAC rule.
diff --git a/TESTING.md b/TESTING.md
index 513f905..b5c05b7 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -171,10 +171,10 @@ Expected client output:
 
 ```text
 prepared TAP adapter ... MAC ... configured and media disconnected before relay connect
-lanparty-client-win connected as peer ...; LAN gateway connected yes (peer ...)
-relay event: LAN gateway connected as peer ...
 relay route pinned before TAP ...
 relay route verified before TAP activation ...
+lanparty-client-win connected as peer ...; LAN gateway connected yes (peer ...)
+relay event: LAN gateway connected as peer ...
 relay route verified after TAP activation ...
 TAP driver reports MAC ... and MTU ...
 client diagnostics: relay reachable yes gateway connected yes route pinned yes ...
diff --git a/crates/lanparty-client-win/src/main.rs b/crates/lanparty-client-win/src/main.rs
index 7a2e2e8..c821b55 100644
--- a/crates/lanparty-client-win/src/main.rs
+++ b/crates/lanparty-client-win/src/main.rs
@@ -179,6 +179,8 @@ async fn main() -> Result<()> {
         startup_config.identity.virtual_mac(),
     )?;
     let config = startup_config.into_runtime_config()?;
+    #[cfg(windows)]
+    let relay_route_pin = pin_relay_route_before_tap(config.session.relay_addr().ip())?;
     println!(
         "lanparty-client-win connecting virtual MAC {} to relay {} room {}",
         config.session.virtual_mac(),
@@ -199,14 +201,6 @@ async fn main() -> Result<()> {
         )
     );
     #[cfg(windows)]
-    let relay_route_pin = match pin_relay_route_before_tap(session.config().relay_addr().ip()) {
-        Ok(pin) => pin,
-        Err(error) => {
-            session.shutdown("client startup failed").await;
-            return Err(error);
-        }
-    };
-    #[cfg(windows)]
     let run_result = run_client(
         &session,
         &relay_route_pin,