diff --git a/internal/catalogue/foundation_manifests_test.go b/internal/catalogue/foundation_manifests_test.go
index 136b042..c07d5f4 100644
--- a/internal/catalogue/foundation_manifests_test.go
+++ b/internal/catalogue/foundation_manifests_test.go
@@ -161,9 +161,27 @@ func TestTheBuildersCarriedPackageBindingTakesThePortFromTheNode(t *testing.T) {
 	}
 }
 
+// The two halves are one number. The builder carries a binding because at genesis nothing provides
+// `package-registry` to resolve one from; the day the forge is a module, the same consumer is told
+// what the forge serves. They have to start from the same port, or a mesh raised on the defaults
+// dials one number before the forge is assigned and another after.
+func TestTheBuildersCarriedBindingStartsWhereTheForgeServes(t *testing.T) {
+	forge := ServedOn(catalogueManifest(t, "gitea"), "package-registry", nil)
+	carried := bindingIn(t, catalogueManifest(t, "builder"), nil)["serves"].(map[string]any)
+	for _, key := range []string{"port", "scheme", "npm-path"} {
+		if fmt.Sprint(forge[key]) != fmt.Sprint(carried[key]) {
+			t.Errorf("the forge serves %s %v and the builder's carried binding says %v — the two "+
+				"halves of the same registry have drifted apart in the catalogue",
+				key, forge[key], carried[key])
+		}
+	}
+}
+
 func TestTheBuildersPackageBindingKeepsItsIdentity(t *testing.T) {
 	builder := catalogueManifest(t, "builder")
-	for _, key := range []string{"provision", "from", "as"} {
+	// `at` above all: a setting that moves it points the builder, and the registry password it
+	// sends as basic auth, at a host somebody else chose.
+	for _, key := range []string{"provision", "from", "at", "as"} {
 		var refused error
 		for _, r := range builder.Resources {
 			if fmt.Sprint(r["id"]) != "package-binding" {