A machine says which ports it already holds

novox/hq ADR 0038 and 04-ISSUES/028. The substrate is not a module: a
node raises it from the bundle it carries before any mesh exists, so the
control plane has never heard of the store, the broker, or the control
plane's own container. A module assigned afterwards is handed a port one
of them holds, and finds out from a container runtime three layers down.

The host already recorded which resources it carried and which the mesh
sent — that distinction exists so the two never remove each other. It
now also records what each one binds, and reports the carried ones.

What the declaration binds, not what is open. A machine's open ports are
a moving target — something a person started, a connection the kernel
handed out — and assigning around those would mean a port that was free
when it was asked for and taken when it was used. What a resource
declares is stable, and it is the half the mesh can be responsible for.

Only the carried ones are reported. What the mesh put here it already
knows, and reporting it back would make the machine an authority on the
mesh's own bookkeeping.

internal/store/store.go

@@ -43,6 +43,18 @@ type Applied struct {
 	// Empty means carried, for state written before this field existed: everything a host had
 	// applied at that point came from its bundle.
 	Origin string `json:"origin,omitempty"`
+
+	// Holds are the machine's own ports this resource occupies.
+	//
+	// **So the mesh can assign around what it did not put here** (novox/hq ADR 0038). A node
+	// raises its substrate from the bundle before any mesh exists, so the control plane has never
+	// heard of the store, the broker or the control plane's own container — and a module assigned
+	// afterwards would be given a port one of them already holds, and would be told so by a
+	// container runtime rather than by anything that could have prevented it.
+	//
+	// Recorded per resource rather than counted per machine, because what a machine happens to
+	// have open right now is a moving target, and what its declaration binds is not.
+	Holds []int `json:"holds,omitempty"`
 	// Target is what was changed — a path, a unit — so removal knows what to undo without
 	// re-reading a declaration that may no longer exist.
 	Target    string    `json:"target"`