hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence

hub/internal/store/host_delete_test.go

@@ -281,3 +281,40 @@ func TestCountHostArtifacts(t *testing.T) {
 		t.Errorf("unknown host artifacts = %+v, want zero value", empty)
 	}
 }
+
+// D31 (R-1205): the F-14 gate's row is the newest deletion of a host that HELD A KEY; a later keyless install's
+// un-acked deletion is skipped. RED-PROOF (2026-10-22 night): with the `AND escrow_acked = 1` filter removed, this
+// fails (it returns the keyless gen2-host).
+func TestLatestKeyHoldingHostDeletion_SkipsAKeylessInstall(t *testing.T) {
+	s := newTestStore(t)
+	seedHostWithArtifacts(t, s, "gen1-host", "cust-d31")
+	if err := s.DeleteHost("gen1-host", true); err != nil { // held a key → acked
+		t.Fatal(err)
+	}
+	if err := s.UpsertHost(&Host{HostID: "gen2-host", CustomerID: "cust-d31", APIKey: "k2"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.DeleteHost("gen2-host", true); err != nil { // never made a key → un-acked even with the box ticked
+		t.Fatal(err)
+	}
+	rec, err := s.LatestKeyHoldingHostDeletion("cust-d31")
+	if err != nil || rec == nil {
+		t.Fatalf("LatestKeyHoldingHostDeletion = %+v, %v", rec, err)
+	}
+	if rec.HostID != "gen1-host" || !rec.EscrowAcked {
+		t.Errorf("row = %+v, want the key-holding gen1-host", rec)
+	}
+	if rec, err := s.LatestKeyHoldingHostDeletion("cust-never"); err != nil || rec != nil {
+		t.Errorf("no deletions → nil, got %+v, %v", rec, err)
+	}
+	s2 := newTestStore(t)
+	if err := s2.UpsertHost(&Host{HostID: "only-keyless", CustomerID: "cust-k", APIKey: "k"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := s2.DeleteHost("only-keyless", true); err != nil {
+		t.Fatal(err)
+	}
+	if rec, err := s2.LatestKeyHoldingHostDeletion("cust-k"); err != nil || rec != nil {
+		t.Errorf("only a keyless deletion → nil (the manual path stays), got %+v, %v", rec, err)
+	}
+}