Guard the broker's plaintext port too at an adopted genesis: the filter admits it from the private network only (hq ADR 0103)

internal/bootstrap/adopted.go

@@ -103,8 +103,11 @@ type AdoptedRewrite struct {
 }
 
 // RewriteAdopted makes the produced bundle one for an adopted machine: the foundation's own filter
-// taken out, and the mesh's guard put in its place, guarding the store's and the broker's
-// management ports on this node. The nftables package stays: the guard is loaded with it, and
+// taken out, and the mesh's guard put in its place, guarding on this node the store's port, the
+// broker's management port and the broker's plaintext port. The last is published on every
+// interface and the foundation's filter admits it from the private network only, so a found
+// firewall that filters only incoming traffic would leave it reachable from anywhere (novox/hq ADR
+// 0103). Every one is a port of a module genesis takes. The nftables package stays: the guard is loaded with it, and
 // installing a package loads no table. Openings are not the bundle's — the first push declares
 // them, once there is a controller to derive them.
 func RewriteAdopted(r *Rewritten, p FoundationPorts) (AdoptedRewrite, error) {
@@ -122,11 +125,12 @@ func RewriteAdopted(r *Rewritten, p FoundationPorts) (AdoptedRewrite, error) {
 		out.Removed = append(out.Removed, id)
 	}
 
-	out.Guarded = []int{p.Store, p.Management}
+	out.Guarded = []int{p.Store, p.Management, p.AMQP}
 	var text bytes.Buffer
 	text.WriteString(",\n    // The mesh's guard (novox/hq ADR 0100): this machine is adopted, so its own firewall\n" +
 		"    // stays in force and the foundation's filter is not loaded. The guard only refuses: the\n" +
-		"    // store's and the broker's management ports, except from the machine and the private network.")
+		"    // store's port and the broker's management and plaintext ports, except from the machine and\n" +
+		"    // the private network.")
 	for _, res := range guardResources(out.Guarded) {
 		var one bytes.Buffer
 		enc := json.NewEncoder(&one)