Accept ADR 0038; close issue 091

The decision (the mesh assigns a container's machine-side port; a module
says only what it needs) was proposed 2026-09-01, and the machinery
already implements it in full -- internal/inventory/ports.go's PortFor,
declaration.go's publishedOn. What was missing was the catalogue actually
complying: 14 of 46 modules baked a machine-side number into their own
manifest anyway. mesh-catalog PR fixes 11 of them (the two defensible
kinds -- foundation, protocol-fixed -- are left alone, per the issue's own
categories). Accepting the decision now that it's actually enforced, and
closing the issue it was blocking.

Checks pass.

02-DECISIONS/0038-the-mesh-assigns-the-port.md

@@ -1,6 +1,6 @@
 ---
 topic: what runs on it
-status: proposed
+status: accepted
 date: 2026-09-01
 deciders: jochen
 reconstructed: false

02-DECISIONS/README.md

@@ -132,7 +132,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0026** — [The mesh has a session of its own, and it is the node session's mechanism](0026-the-mesh-has-a-session-of-its-own.md)
 - **0027** — [A provision names what the consumer is coupled to, not the role it plays](0027-a-provision-names-what-the-consumer-is-coupled-to.md)
 - **0035** — [One implementation, several surfaces, and what that costs](0035-one-implementation-several-surfaces.md)
-- **0038** — [The mesh assigns the port, and a module does not care](0038-the-mesh-assigns-the-port.md)  *(proposed)*
+- **0038** — [The mesh assigns the port, and a module does not care](0038-the-mesh-assigns-the-port.md)
 - **0040** — [What a module is](0040-what-a-module-is.md)
 - **0041** — [Events are a relationship, the lighter sibling of provisioning](0041-events-are-a-relationship.md)
 - **0042** — [The shape of an event on the wire](0042-the-shape-of-an-event-on-the-wire.md)

04-ISSUES/091-a-module-definition-carries-a-machine-port/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-22
-located-in: []
-fixed-by:
+located-in: [mesh-catalog]
+fixed-by: mesh-catalog — the 11 not-defensible modules (de-spiegel, gitea, hello-web, mailu, mssql, n8n, novox.be, only-office, photos, photos-eef, photos-filip) had their hardcoded machine-side port mapping stripped to the bare software port, letting ADR 0038's existing assignment machinery (internal/inventory/ports.go's PortFor, declaration.go's publishedOn) assign it as designed. postgres, lavinmq, distribution (foundation, genesis-rewritten) and unifi (protocol-fixed) were left as-is — the two defensible kinds this report names.
 amended-design:
 ---