A machine says which ports it already holds

novox/hq ADR 0038 and 04-ISSUES/028. The substrate is not a module: a
node raises it from the bundle it carries before any mesh exists, so the
control plane has never heard of the store, the broker, or the control
plane's own container. A module assigned afterwards is handed a port one
of them holds, and finds out from a container runtime three layers down.

The host already recorded which resources it carried and which the mesh
sent — that distinction exists so the two never remove each other. It
now also records what each one binds, and reports the carried ones.

What the declaration binds, not what is open. A machine's open ports are
a moving target — something a person started, a connection the kernel
handed out — and assigning around those would mean a port that was free
when it was asked for and taken when it was used. What a resource
declares is stable, and it is the half the mesh can be responsible for.

Only the carried ones are reported. What the mesh put here it already
knows, and reporting it back would make the machine an authority on the
mesh's own bookkeeping.

internal/apply/apply.go

@@ -204,6 +204,7 @@ func Apply(
 			ID:     resource.Identity(), Type: string(resource.Kind()),
 			Target: outcome.Target, AppliedAt: time.Now().UTC(),
 			Wrote: outcome.wrote,
+			Holds: holds(resource),
 		})
 		report.Outcomes = append(report.Outcomes, outcome)
 		if outcome.Action != "unchanged" {
@@ -1063,3 +1064,31 @@ func digestOf(content string) string {
 	sum := sha256.Sum256([]byte(content))
 	return hex.EncodeToString(sum[:])
 }
+
+// holds is the machine's own ports a resource occupies.
+//
+// **What the declaration binds, not what is open.** A machine's open ports are a moving target —
+// something a person started, a connection the kernel handed out — and assigning around them would
+// mean a port that was free when it was asked for and taken when it was used. What a resource
+// declares is stable, and it is the half the mesh can be responsible for.
+func holds(resource declaration.Resource) []int {
+	container, ok := resource.(*declaration.Container)
+	if !ok {
+		return nil
+	}
+	var out []int
+	for _, mapping := range container.Ports {
+		// "8080:80", or "127.0.0.1:8080:80" when an address was named. The machine's port is the
+		// one before the last colon; the last is inside the container and is not the machine's.
+		parts := strings.Split(mapping, ":")
+		if len(parts) < 2 {
+			continue
+		}
+		port, err := strconv.Atoi(strings.TrimSpace(parts[len(parts)-2]))
+		if err != nil {
+			continue
+		}
+		out = append(out, port)
+	}
+	return out
+}