Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

The confirmation review of 2026-10-09 found D-root and DA writing one key, machine.<m>.agent-root, from
two probes with different words, so it flapped every run; D-root is now root-not-free. D-root raised the
urgent condition after every node-engine restart while the first setuid search ran; it now keeps the
same quiet window as DA, and the root-free verb still answers that machine not free. agentConfined
takes the judging clock.

cmd/mesh-controller/probe_agent_root_test.go

@@ -50,7 +50,7 @@ func TestTheRootReaderFailsClosed(t *testing.T) {
 		return &rootReader{
 			entries: []inventory.Entry{{Manifest: shell, On: []string{"anchor"}}},
 			heard:   map[string]map[string]map[string]bool{},
-			confined: func(context.Context, string) (bool, bool, string, error) {
+			confined: func(context.Context, string, time.Time) (bool, bool, string, error) {
 				return true, true, "the agent account agents cannot become root without a person", nil
 			},
 			settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil },
@@ -62,17 +62,17 @@ func TestTheRootReaderFailsClosed(t *testing.T) {
 	}
 	cases := map[string]func(*rootReader){
 		"no agent account named, no coding-agent module there": func(r *rootReader) {
-			r.confined = func(context.Context, string) (bool, bool, string, error) {
+			r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
 				return false, false, "anchor names no agent account: agents run as the operator account (ops)", nil
 			}
 		},
 		"the node-engine's verdict not read": func(r *rootReader) {
-			r.confined = func(context.Context, string) (bool, bool, string, error) {
+			r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
 				return false, false, "", errors.New("the store did not answer")
 			}
 		},
 		"a stale verdict": func(r *rootReader) {
-			r.confined = func(context.Context, string) (bool, bool, string, error) {
+			r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
 				return true, false, "the agent account agents is not judged: the machine's newest statement was heard at …", nil
 			}
 		},
@@ -119,12 +119,12 @@ func TestTheProbeSaysEachMachineThatIsNotRootFree(t *testing.T) {
 		t.Fatalf("trusted %v", trusted)
 	}
 	r := &rootReader{entries: entries, heard: map[string]map[string]map[string]bool{},
-		confined: func(_ context.Context, node string) (bool, bool, string, error) {
+		confined: func(_ context.Context, node string, _ time.Time) (bool, bool, string, error) {
 			return false, false, node + " names no agent account: agents run as the operator account (ops)", nil
 		},
 		settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil }}
 	got := rootObservations(context.Background(), r, trusted, rootNow)
-	if len(got) != 1 || got[0].Machine != "anchor" || got[0].Kind != kindAgentRoot || got[0].Severity != conditions.Urgent ||
+	if len(got) != 1 || got[0].Machine != "anchor" || got[0].Kind != kindRootNotFree || got[0].Severity != conditions.Urgent ||
 		!strings.Contains(got[0].Summary, "messenger, telegram") || !strings.Contains(got[0].Summary, "names no agent account") {
 		t.Fatalf("said %+v", got)
 	}
@@ -133,7 +133,9 @@ func TestTheProbeSaysEachMachineThatIsNotRootFree(t *testing.T) {
 		Needs: o.Needs, Resolved: o.Resolved}, o.Machine); !ok {
 		t.Errorf("not plain: %s", why)
 	}
-	r.confined = func(context.Context, string) (bool, bool, string, error) { return true, true, "confined", nil }
+	r.confined = func(context.Context, string, time.Time) (bool, bool, string, error) {
+		return true, true, "confined", nil
+	}
 	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 0 {
 		t.Errorf("said of a free machine: %+v", got)
 	}
@@ -225,3 +227,39 @@ func TestAMachineWaitingForItsFirstSetuidSearchIsNotRootFree(t *testing.T) {
 		t.Errorf("a machine whose first setuid search is pending was judged root-free: %+v", v)
 	}
 }
+
+// The confirmation review of 2026-10-09, on #154 beside ADR 0266: D-root keeps ADR 0266's quiet window — nothing
+// raised while the one thing unjudged is the first setuid search, within its bound — while the root-free verb
+// still answers the machine not free; and D-root's condition has a key of its own, apart from DA's.
+func TestRootNotFreeIsQuietWhileTheFirstSearchRunsAndKeyedApartFromDA(t *testing.T) {
+	entries := []inventory.Entry{{Manifest: catalogue.Manifest{Module: "telegram", RunsAs: "telegram"}, On: []string{"anchor"}}}
+	r := &rootReader{entries: entries, heard: map[string]map[string]map[string]bool{},
+		confined: func(context.Context, string, time.Time) (bool, bool, string, error) {
+			return true, false, "the agent account agents is not judged: the search for setuid programs runs", nil
+		},
+		settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil },
+		quiet:    func(context.Context, string, time.Time) bool { return true }}
+	trusted := trustedMachines(entries)
+	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 0 {
+		t.Errorf("raised while the first search runs: %+v", got)
+	}
+	if v := judgeRootFree(context.Background(), r, []string{"anchor"}, rootNow)[0]; v.Free || !v.Quiet {
+		t.Errorf("root-free while the first search runs: %+v", v)
+	}
+	// Quiet hides nothing else: the login shell served as well is said.
+	r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
+	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 1 {
+		t.Errorf("a second failure was kept quiet: %+v", got)
+	}
+	// Past its bound, said.
+	r.heard, r.quiet = map[string]map[string]map[string]bool{}, func(context.Context, string, time.Time) bool { return false }
+	got := rootObservations(context.Background(), r, trusted, rootNow)
+	if len(got) != 1 {
+		t.Fatalf("a search past its bound was not said: %+v", got)
+	}
+	// One key per judgement: DA's is machine.<m>.agent-root, this one its own.
+	da := conditions.Observation{Scope: conditions.ScopeMachine, ID: "anchor", Token: "agent-root", Machine: "anchor"}
+	if got[0].Key() == da.Key() {
+		t.Errorf("D-root and DA share the key %s", da.Key())
+	}
+}