Function purge_name_keyed_keys 

pub(super) fn purge_name_keyed_keys(
    conn: &Connection,
    id: &str,
    wan: Option<&WanIdentityStore>,
) -> Result<usize, StoreError>

Delete the signing keys filed under every name id may have signed as — its jekt HMAC key and its LAN and WAN keypairs, which are keyed by name, not UID. M4a-3 (spec §6.5.4) deleted them under the slug; M4d-1 (§6.5.10) also under the display name, instance_name and the fallback ids (key_names_of). Without this a later agent that takes a name is handed the dead agent’s keys by ensure’s INSERT OR IGNORE, and signs as it. Read before the row is deleted; a name another row may sign under (key_name_used_by_another) is that agent’s key and is left alone. Folded as the key tables fold (to_lowercase). A template row is skipped, as in tombstone_key_names. Idempotent.

W3-S (SPEC_WAN_JEKT_VERIFICATION_2026_09_24.md §2.2): agent WAN keys now live in the channel-wide wan.db, so the same names are deleted there too — otherwise a new agent of the name would inherit the key across an upgrade. A wan.db failure fails the delete rather than being skipped: every statement here is idempotent, so a retry converges, whereas a skipped purge would hand the key to the next agent of that name. Lock order is objects.db (held by the caller) → wan.db, as wan_identity.rs documents.