test: harden TCS root freshness and ZCode entry

server-tools/tcs-mother-root-agent/tcs_mother_root_agent.test.py

@@ -36,6 +36,23 @@ class RootAgentTest(unittest.TestCase):
             again = MODULE.refresh(ROOT, output, pointer, 'test')
             self.assertEqual(again['state'], 'CURRENT_IDEMPOTENT')
 
+    def test_unadmitted_numbered_source_drift_preserves_previous_current(self):
+        with tempfile.TemporaryDirectory() as temp:
+            base = Path(temp)
+            output, pointer = base / 'state', base / 'TCS-ROOT.json'
+            snapshot = MODULE.build(ROOT)
+            snapshot['registered_source_hashes']['identity/fifth-domain-subject-registry.json'] = '0' * 64
+            previous_for_hash = dict(snapshot)
+            previous_for_hash.pop('freshness_token')
+            snapshot['freshness_token'] = MODULE.digest(MODULE.stable(previous_for_hash))
+            output.mkdir(parents=True)
+            current = output / 'CURRENT.json'
+            current.write_text(json.dumps(snapshot), encoding='utf-8')
+            before = current.read_bytes()
+            with self.assertRaisesRegex(MODULE.RootError, 'UNADMITTED_NUMBERED_SOURCE_DRIFT'):
+                MODULE.refresh(ROOT, output, pointer, 'negative-test')
+            self.assertEqual(current.read_bytes(), before)
+
 
 if __name__ == '__main__':
     unittest.main()