A machine says which ports it already holds

novox/hq ADR 0038 and 04-ISSUES/028. The substrate is not a module: a
node raises it from the bundle it carries before any mesh exists, so the
control plane has never heard of the store, the broker, or the control
plane's own container. A module assigned afterwards is handed a port one
of them holds, and finds out from a container runtime three layers down.

The host already recorded which resources it carried and which the mesh
sent — that distinction exists so the two never remove each other. It
now also records what each one binds, and reports the carried ones.

What the declaration binds, not what is open. A machine's open ports are
a moving target — something a person started, a connection the kernel
handed out — and assigning around those would mean a port that was free
when it was asked for and taken when it was used. What a resource
declares is stable, and it is the half the mesh can be responsible for.

Only the carried ones are reported. What the mesh put here it already
knows, and reporting it back would make the machine an authority on the
mesh's own bookkeeping.

internal/link/messages.go

@@ -56,4 +56,15 @@ type Report struct {
 
 	// Refused is set when the declaration was rejected whole rather than applied in part.
 	Refused string `json:"refused,omitempty"`
+
+	// Carried are the machine's ports held by what this host raised from its own bundle.
+	//
+	// **So the mesh can assign around what it did not put here** (novox/hq ADR 0038). A node
+	// raises its substrate before any mesh exists, so the control plane has never heard of the
+	// store or the broker — and would hand a module a port one of them holds, discovering it only
+	// when a container runtime refused to start.
+	//
+	// A node *states* and the mesh writes, which is the whole shape of this message: this is the
+	// machine saying what is true of it, not asking for anything.
+	Carried []int `json:"carried,omitempty"`
 }