The packages port given at genesis is a module's setting, like every other

Every foundation port given at genesis became a per-node setting of the module
that binds it, except the package registry's: that one was fixed by rewriting
the builder's manifest when the installer registered it. Registering the builder
again from the catalogue undid it, and the forge's own module, when it took the
bootstrap forge over, came up on the catalogue's port — which on a machine where
a predecessor holds 3000 points the builder at the predecessor's forge.

So the rewrite is gone, and the port is recorded twice as a setting, both from
the one input:

- the forge's module is registered at genesis — not assigned, nothing of it runs
  — so the controller has something to hold `{"ports": {"3000": <given>}}`
  against. Assigning the forge later raises it on the port this machine was
  given, and its container, its filter rule, its opening, what it serves and
  what consumers are told all read it from there.
- the builder is given `{"serves": {"port": <given>}}`, which merges into the
  binding it carries in place of one nothing can resolve yet.

A genesis on the catalogue's port records nothing and registers nothing, so it
does exactly what it did before.

novox/hq 04-ISSUES/085, ADR 0100

internal/bootstrap/ports.go

@@ -105,12 +105,25 @@ func (p FoundationPorts) moduleSettings() map[string]map[string]int {
 	add("lavinmq", d.AMQP, p.AMQP)
 	add("lavinmq", d.Management, p.Management)
 	add(RegistryModule, d.Registry, p.Registry)
+	add(ForgeModule, d.Packages, p.Packages)
 	return out
 }
 
 // PortsSetting is the controller's settings key for a module's given ports.
 const PortsSetting = "ports"
 
+// ServesSetting is the settings key that carries what a provider serves, inside the one binding a
+// module carries rather than resolves — the builder's package binding (novox/hq 04-ISSUES/085).
+//
+// **A port given at genesis has to be a setting wherever it is read, or something puts it back.**
+// The builder reaches the package registry through a binding written in its own manifest, because
+// at genesis no module yet provides `package-registry` and so there is nothing for the controller
+// to resolve it from. That binding used to be rewritten, as text, when the installer registered the
+// builder — which a later registration from the catalogue undid silently. Set as a node's setting
+// instead, it is held by the controller rather than by the manifest, so re-registering the builder
+// leaves it where it was.
+const ServesSetting = "serves"
+
 // setFoundationSettings tells the controller the ports this node gave a foundation module — and,
 // on an adopted node, that the registry is reached from anywhere, as a node pulls from it before it
 // has a private-network address (novox/hq ADR 0100). Done after the module is registered and before
@@ -124,6 +137,13 @@ func setFoundationSettings(ctx context.Context, o Options, control controlPlane,
 	if o.Adopted && module == RegistryModule {
 		values["expose"] = map[string]string{strconv.Itoa(DefaultPorts().Registry): "anywhere"}
 	}
+	if packages := o.Ports.orDefaults().Packages; module == BuilderModule &&
+		packages != DefaultPorts().Packages {
+		// The one binding nothing resolves: the builder dials the forge by a number it carries.
+		// The rest of the binding — the provision, the forge it is from, the account it presents —
+		// is the manifest's and stays there.
+		values[ServesSetting] = map[string]int{"port": packages}
+	}
 	if len(values) == 0 {
 		return nil
 	}