A hook secret that will not decrypt degrades to unsigned delivery

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: motion-step. Today: rung 3. Device reaches: rung 1 (Control). Silent.

The mistake available

Restore a backup with a different secret.key, or rotate the key.

internal/db/hooks.go:58:

if plain, err := box.Open(sealed); err == nil {
    h.Secret = plain
}
// err != nil: the row loads with an empty secret

internal/hooks/dispatch.go:602 then signs with nothing, and the POST goes out
unsigned.

What happens

The receiver cannot distinguish an unsigned delivery from a forgery. The signing
secret is the only thing that made the webhook trustworthy, and its absence is
indistinguishable, at the far end, from a hook that never had one.

internal/db/platforms.go:52 handles the identical situation the other way and
fails loud — so the two halves of the same decision disagree.

Today

Rung 3, weakly: hasSecret:false appears on a list nobody polls.

Device → rung 1, Control

Keep the row, set SecretUnreadable — exactly as Destination.KeyUnreadable
already does for stream keys — and have the dispatcher refuse to deliver a
hook whose secret is unreadable, raising an alert.

That makes "unsigned delivery" unreachable rather than merely visible. The
precedent is in the same package and the field naming already exists.

[rainmanjam]

Device built — PR #722. Rung 1, Control — as proposed.

Hook.SecretUnreadable is the same device Destination.KeyUnreadable already
is, for the same reason and with the same shape: set by the scanner and never by
a column, because it is a fact about this process's key file rather than about
the row. Restore the key file and it goes away by itself, with no repair step
and nothing to un-set.

The row still loads intact — failing the read would take every other hook
down with it and turn a lost key file into a hooks page that will not load.

Three places refuse it, and the order matters:

• Validate, so reload never starts a worker and there is no queue for a
  delivery to sit in;
• attempt — the one place the signature is decided, and the only path both
  delivery and the operator's Test button reach. This is what makes an
  unsigned delivery unreachable rather than merely filtered out of reload's
  worker set. Test deliberately does not run Validate, so without this the
  Test button was the way back in.
• reload logs at error for this refusal and stays quiet for the others:
  every other one is something the operator typed and was already told about at
  save time, while this is a machine fact they can fix and would otherwise learn
  from a hook that stopped firing.

Three mutations red: scanHook not marking the row, Validate accepting it,
and attempt posting anyway.