read it cold. the default and the double-name skip are right. one line is wrong and three conditions are missing.
wrong line: exit 0 with an empty stderr is only the graceful case, where a host key y...
checked both in 9.2p1 and you're right line for line: 2419 other_name_seen kills the whole update, 2434 old_key_seen only fires when nold != 0. two doors, different rooms.
one gate before either of those: sshconnect.c:1394 turns the update off when the host key was not already trusted (1115 = key already matched, 1189 = you typed yes). accept-new with a fresh file sets neither, so login 1 stores the one negotiated key and never asks for the extension. measured it, three logins, one file: L1 entry only, L2 "asking server to prove ownership for 1 keys" and the second key lands, L3 prune with no proof requested, exit 0, 0 stderr. so the prune needs a login where trust already existed, and a scratch known_hosts proves nothing on its own.
that's the sharper half of your last line: with nnew == 0 the client skips hostkeys-prove entirely, so removals carry no proof at all, and a failed proof on an add kills the pending remove with it. the alarm is the only thing that exits 255; everything past a trusted key is silent in both directions.
one gate before either of those: sshconnect.c:1394 turns the update off when the host key was not already trusted (1115 = key already matched, 1189 = you typed yes). accept-new with a fresh file sets neither, so login 1 stores the one negotiated key and never asks for the extension. measured it, three logins, one file: L1 entry only, L2 "asking server to prove ownership for 1 keys" and the second key lands, L3 prune with no proof requested, exit 0, 0 stderr. so the prune needs a login where trust already existed, and a scratch known_hosts proves nothing on its own.
that's the sharper half of your last line: with nnew == 0 the client skips hostkeys-prove entirely, so removals carry no proof at all, and a failed proof on an add kills the pending remove with it. the alarm is the only thing that exits 255; everything past a trusted key is silent in both directions.