hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence

hub/internal/web/pbsdr.go

@@ -235,11 +235,13 @@ func (s *Server) pbsdrProvisionAtom(ctx context.Context, customerID string, host
 		// half-torn earlier attempt, or the F-14 shape: host deleted, tenancy survived).
 		//
 		// F-14 gate (operator ruling 2026-07-13): auto-re-issue is permitted ONLY when the
-		// hub's own deletion record shows the tenancy's owning host — the customer's most
-		// recent host deletion — was removed through the escrow-ack flow. Acknowledged
-		// destruction is not silent re-keying; the old secret went down with the acked host.
-		// No record / un-acked record → the refusal below, byte-unchanged (manual path).
-		rec, derr := s.store.LatestHostDeletion(customerID)
+		// hub's own deletion record shows the tenancy's owning host was removed through the
+		// escrow-ack flow. Acknowledged destruction is not silent re-keying; the old secret went
+		// down with the acked host. D31 (operator 2026-10-22, R-1205): the owning host is the
+		// newest deleted host that HELD A KEY — a later install deleted before it made a key
+		// (an un-acked record) owned nothing and no longer blocks this. No key-holding record →
+		// the refusal below, byte-unchanged (manual path).
+		rec, derr := s.store.LatestKeyHoldingHostDeletion(customerID)
 		if derr != nil {
 			return "", fmt.Errorf("pbsdr: deletion-provenance lookup for %s: %w", customerID, derr)
 		}

hub/internal/web/pbsdr_test.go

@@ -457,7 +457,7 @@ func TestPBSDR_F14AutoReissueOnAckedDeletion(t *testing.T) {
 }
 
 // F-14 scenario B (the never-silently-re-key law): a surviving tenancy WITHOUT an acked
-// deletion record — none at all, or the latest one un-acked — keeps the current refusal and
+// deletion record — none at all, or only un-acked ones (D31: a keyless install) — keeps the current refusal and
 // records ZERO re-issue calls (the exact non-effect).
 // RED-PROOF (§10 B): removing the record check in pbsdrProvisionAtom (auto-reissue
 // unconditionally) → the zero-reissue assertions here fail.
@@ -499,6 +499,40 @@ func TestPBSDR_F14NoRecordNeverRekeys(t *testing.T) {
 	})
 }
 
+// D31 (operator 2026-10-22, R-1205 — seen live 2026-10-21): the tenancy's owning host was deleted through the escrow-ack
+// flow, then a SECOND install was deleted before it made a key. The re-issue for the third install proceeds.
+// RED-PROOF (2026-10-22 night): with the gate reading LatestHostDeletion again (the newest row, un-acked), this fails
+// with the 502 refusal and zero re-issue calls.
+func TestPBSDR_D31_AKeylessInstallBetweenDoesNotBlockTheReissue(t *testing.T) {
+	fake := &fakeTenancy{provisionErr: tenantsync.ErrTokenExists, secret: "REISSUED-SECRET"}
+	s, st, _ := newPBSDRServer(t, fake)
+	if err := st.UpsertHost(&store.Host{HostID: "peti-00-dead", CustomerID: "peti", APIKey: "oldkey"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := st.SaveHostEscrow("peti-00-dead", []byte("opaque"), "fp", "posture", "2026-07-01T00:00:00Z", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.DeleteHost("peti-00-dead", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.UpsertHost(&store.Host{HostID: "peti-00-short", CustomerID: "peti", APIKey: "shortkey"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.DeleteHost("peti-00-short", true); err != nil { // no escrow row → an un-acked record
+		t.Fatal(err)
+	}
+	rr := postUpdate(t, s, url.Values{"dr_tier": {"on"}})
+	if rr.Code != 303 {
+		t.Fatalf("enable = %d (%s), want 303 — a keyless install between must not block the re-issue", rr.Code, rr.Body.String())
+	}
+	if fake.reissueCalls != 1 {
+		t.Errorf("reissue calls = %d, want 1", fake.reissueCalls)
+	}
+	if desc, _, _ := hostState(t, st); desc == nil || !desc.Enabled {
+		t.Fatalf("descriptor after the re-issue = %+v", desc)
+	}
+}
+
 func TestPBSDR_Reissue(t *testing.T) {
 	fake := &fakeTenancy{secret: "OLD-SECRET"}
 	s, st, logBuf := newPBSDRServer(t, fake)