Give a channel's verified sender back when the root-free judgement passes again, and say when it is dropped (issue 930)

A push composed during a failed judgement issued the router a membership without the verified sender and nothing composed it again, so every approval was refused. The self-check now issues it again within one run; a composition says which kind lost it and why.

cmd/mesh-controller/probe_agent_root.go

@@ -320,7 +320,11 @@ func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, e
 		quiet, err := searchStillRunning(ctx, inv, node, n.AgentAccount, h, had, now)
 		return err == nil && quiet
 	}
-	return rootObservations(ctx, r, trustedMachines(r.entries), time.Now()), nil
+	obs := rootObservations(ctx, r, trustedMachines(r.entries), time.Now())
+	// A membership that lost its verified sender to a judgement that failed at a push gets it back here, once
+	// the machines pass (issue 930); the bound is one self-check.
+	giveVerifiedSendersBack(ctx, d)
+	return obs, nil
 }
 
 // rootObservations judges the machines and says each that fails.
@@ -365,14 +369,3 @@ func rootFreeAnswer(ctx context.Context, machines string, now time.Time) (any, e
 	}
 	return map[string]any{"machines": judgeRootFree(ctx, newRootReader(ctx, d.open.inventory, conn), names, now)}, nil
 }
-
-// rootFreeNow is the machines judged root-free, for composing a push's memberships: only those that pass.
-func rootFreeNow(ctx context.Context, r *rootReader, machines []string, now time.Time) map[string]bool {
-	free := map[string]bool{}
-	for _, v := range judgeRootFree(ctx, r, machines, now) {
-		if v.Free {
-			free[v.Machine] = true
-		}
-	}
-	return free
-}