A node may move a port a module publishes as a mapping's machine side

A module publishing `2222:22` — the machine's own ssh daemon holds 22, so
the module takes 2222 and says so in `listens` — could not be moved. The
setting was read against the last segment of each mapping alone, so the
number the module uses everywhere else was refused as a port it does not
publish, and the node's every push failed for as long as the setting was
stored. The one key that was accepted, the container's own port, was then
read only when the container's mapping was rewritten: the mapping moved
and the ports map, the filter, the adopted node's openings, its guard and
what a consumer is told all stayed on the number the software had left.

Either end of a mapping now names it, and a given port comes back under
both, so every reader finds the same number under the key it holds.
Ambiguity is refused where it is real — one number naming two different
mappings, or the two ends of one mapping given two different numbers.

internal/catalogue/foundation_manifests_test.go

@@ -250,3 +250,56 @@ func TestTheForgesOwnAddressFollowsThePortTheNodeGaveIt(t *testing.T) {
 			"whatever reads it dials a dead port", env["MESH_GITEA_URL"])
 	}
 }
+
+// **And the port the forge publishes the long way is the node's too** (novox/hq ADR 0100).
+//
+// The forge's ssh port is written `2222:22` — the machine's own daemon holds 22, so the module
+// takes 2222 and says so in `listens`. A node whose predecessor served git on another number
+// cannot be told to leave it there unless the setting may name the machine side of that mapping,
+// which is the number the manifest itself uses everywhere else. Composed from the manifest in the
+// catalogue beside this checkout, because what the mesh can move is a fact about what the module
+// actually writes.
+func TestTheForgesSshPortIsGivenByTheNumberTheForgeCallsIt(t *testing.T) {
+	forge := catalogueManifest(t, "gitea")
+	given, err := GivenPorts(forge, []Layer{{From: "anchor",
+		Values: map[string]any{PortsSetting: map[string]any{"2222": float64(222)}}}})
+	if err != nil {
+		t.Fatalf("the forge's ssh port cannot be given on a node: %v", err)
+	}
+	// Under the number the module listens on, which is how the plan finds it, and under the
+	// container's own port, which is how the mapping is rewritten.
+	if given[2222] != 222 || given[22] != 222 {
+		t.Fatalf("the forge was given %v", given)
+	}
+
+	resolved, err := forge.Resolve([]Built{{
+		Name: "runtime", Kind: ArtifactImage,
+		Reference: "registry.example/gitea-runtime@sha256:" + strings.Repeat("a", 64),
+	}})
+	if err != nil {
+		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
+	}
+	r := Resolution{Node: "anchor", Modules: []Manifest{resolved}, Needs: []Needed{
+		{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
+			Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
+		{Name: "route", For: "gitea", From: "anchor"},
+		{Name: "secret", For: "gitea", From: "anchor", Local: "internal-token", Sealed: "sealed-token"},
+		{Name: "secret", For: "gitea", From: "anchor", Local: "admin", Sealed: "sealed-admin"},
+	}}
+	out, err := r.Declaration(Rendering{
+		Needed: map[string]map[string]string{"gitea": {"broker": "sealed-broker"}},
+		Ports:  map[string]map[int]int{"gitea": {3000: 3000, 2222: 222}},
+		Given:  map[string]map[int]int{"gitea": given},
+	})
+	if err != nil {
+		t.Fatalf("the forge does not compose: %v", err)
+	}
+	server := fileNamed(out, "gitea.server")
+	if server == nil {
+		t.Fatalf("the forge's own container is not in the declaration: %v", out)
+	}
+	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "222:22") ||
+		strings.Contains(published, "2222:22") {
+		t.Fatalf("the forge is published on %v, not the port this node gave it", server["ports"])
+	}
+}