hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence

hub/internal/api/host_tunnel_test.go

@@ -76,3 +76,32 @@ func TestR1204_WhatIsJudged(t *testing.T) {
 		}
 	}
 }
+
+// D30 (R-1204): after the agent re-keys, the box reports a restarted tunnel with no handshake yet (nothing to judge),
+// then the new key's first handshake — which clears the alarm once, and raises nothing new.
+// RED-PROOF (2026-10-22 night): with the `!stale && wasStale` case removed from checkWGTunnel, this fails (no ok event).
+func TestD30_TheAlarmClearsWhenTheNewKeyShakesHands(t *testing.T) {
+	h, st, _ := newTestHandler(t)
+	st.SaveCustomerConfig(&store.CustomerConfig{CustomerID: "c1", APIKey: "ckey", RetrievalPassword: "p"})
+	st.UpsertHost(&store.Host{HostID: "h1", CustomerID: "c1", APIKey: "HKEY"})
+	post := func(wg string) {
+		t.Helper()
+		if rr := do(h, http.MethodPost, "/host-report", "HKEY", tunnelReportBody("h1", wg)); rr.Code != http.StatusOK {
+			t.Fatalf("host-report = %d %s", rr.Code, rr.Body.String())
+		}
+	}
+	count := func(typ string) int {
+		evs, _ := st.GetEventsByType("c1", typ, time.Time{})
+		return len(evs)
+	}
+	post(`{"pubkey":"OLD","registered":true,"active":true,"last_handshake_age_s":0,"handshake_future_s":10800}`) // 3 h ahead
+	post(`{"pubkey":"NEW","registered":true,"active":true}`)                                                     // re-keyed, no handshake yet
+	if count(eventWGTunnelStale) != 1 || count(eventWGTunnelOK) != 0 {
+		t.Fatalf("stale %d ok %d, want 1 / 0 before the new key shakes hands", count(eventWGTunnelStale), count(eventWGTunnelOK))
+	}
+	post(`{"pubkey":"NEW","registered":true,"active":true,"last_handshake_age_s":20}`)
+	post(`{"pubkey":"NEW","registered":true,"active":true,"last_handshake_age_s":110}`)
+	if count(eventWGTunnelOK) != 1 || count(eventWGTunnelStale) != 1 {
+		t.Fatalf("stale %d ok %d, want 1 / 1 — the new key's handshake clears the alarm once", count(eventWGTunnelStale), count(eventWGTunnelOK))
+	}
+}