diff --git a/README.md b/README.md
index 931a60f..bb993ae 100644
--- a/README.md
+++ b/README.md
@@ -240,10 +240,10 @@ stale connected state from a previous crashed run without letting the TAP
 adapter influence relay DNS or route selection. The client then resolves the
 relay endpoint, completes the control-stream hello/welcome handshake, pins a
 host route for the resolved relay IP on the current pre-TAP interface, verifies
-that the relay route still uses that pinned host route after TAP activation,
-and bridges Ethernet frames between the relay and the TAP-Windows6 adapter
-until shutdown. `--relay` accepts a DNS name or socket address; bare hosts
-default to UDP/443.
+that Windows is already using that host route, verifies it again after TAP
+activation, and bridges Ethernet frames between the relay and the TAP-Windows6
+adapter until shutdown. `--relay` accepts a DNS name or socket address; bare
+hosts default to UDP/443.
 TAP frames whose source MAC does not match that generated tunnel MAC are
 dropped locally before they can consume relay bandwidth; the relay still
 enforces the same source-MAC rule.
diff --git a/TESTING.md b/TESTING.md
index f8a99b8..513f905 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -174,6 +174,7 @@ prepared TAP adapter ... MAC ... configured and media disconnected before relay
 lanparty-client-win connected as peer ...; LAN gateway connected yes (peer ...)
 relay event: LAN gateway connected as peer ...
 relay route pinned before TAP ...
+relay route verified before TAP activation ...
 relay route verified after TAP activation ...
 TAP driver reports MAC ... and MTU ...
 client diagnostics: relay reachable yes gateway connected yes route pinned yes ...
diff --git a/crates/lanparty-client-win/src/main.rs b/crates/lanparty-client-win/src/main.rs
index 23ef312..7a2e2e8 100644
--- a/crates/lanparty-client-win/src/main.rs
+++ b/crates/lanparty-client-win/src/main.rs
@@ -276,7 +276,7 @@ async fn run_client(
     let relay_route =
         verify_relay_route_is_pinned(session.config().relay_addr().ip(), relay_route_pin)
             .context("relay route changed after TAP activation")?;
-    print_verified_relay_route(&relay_route);
+    print_verified_relay_route("after TAP activation", &relay_route);
     print_and_report_client_diagnostics(
         session,
         &client_diagnostics_snapshot(
@@ -370,6 +370,9 @@ fn pin_relay_route_before_tap(destination: std::net::IpAddr) -> Result<PinnedRel
     let pin = lanparty_client_route::pin_relay_route(&route)
         .context("failed to pin relay route before TAP activation")?;
     print_pinned_relay_route(&pin);
+    let route = verify_relay_route_is_pinned(destination, &pin)
+        .context("relay route did not use pinned host route before TAP activation")?;
+    print_verified_relay_route("before TAP activation", &route);
 
     Ok(pin)
 }
@@ -445,9 +448,9 @@ fn relay_route_matches_pin(route: &RouteSnapshot, pin: &PinnedRelayRoute) -> boo
 }
 
 #[cfg(windows)]
-fn print_verified_relay_route(route: &RouteSnapshot) {
+fn print_verified_relay_route(phase: &str, route: &RouteSnapshot) {
     println!(
-        "relay route verified after TAP activation: destination {} next hop {} interface index {} LUID {} prefix {}/{} metric {}",
+        "relay route verified {phase}: destination {} next hop {} interface index {} LUID {} prefix {}/{} metric {}",
         route.destination(),
         route_next_hop_label(route.next_hop()),
         route.interface_index(),