An unknown WebSocket policy value passes the event through unredacted

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: fixed-value. Today: rung 0. Device reaches: rung 1 (Control). Silent.

The mistake available

Add a wsPolicy constant and miss one switch.

internal/api/ws_policy.go:120:

default:
    return ev, true      // pass the event through, unredacted

What happens

A read-scoped token receives the admin shape of an event — the redaction
that the policy exists to apply is skipped entirely. Silent: the socket works,
the event arrives, and it carries more than it should.

This is the same shape as requireScope treating an unrecognised scope string
as read-only, which the code gets right and documents:

A value that arrived from a newer schema or a hand-edited row should narrow
what a credential can do, never widen it.

The policy switch does the opposite.

Today

Rung 0. There is no .golangci.yml, so none of the 62 switch-without-default
sites has a linter behind it.

Device → rung 1, Control here

default: drops the event — fail closed. One arm, and it makes the
widening impossible rather than conventional.

Repo-wide, exhaustive in golangci-lint is the Warning that catches the
next one at the moment it is written.

[rainmanjam]

Device built — PR #722. Rung 1, Control.

eventView's default fails closed, so a policy constant added without a case
here withholds the event rather than sending a read-scoped socket the admin
shape — the one direction a widening must never take.

It caused a regression on the way in, recorded rather than quietly fixed,
because it is the general lesson.

Making the switch fail closed dropped every passthrough event — Log, Status,
Levels, Stats, Loudness — because wsPassthrough is iota, the zero value, and
had no case of its own: it had always reached the sender through the default
arm being replaced. The opening burst on a fresh install delivered nothing.
TestTheWebSocketOpeningBurstSurvivesZeroSources caught it.

That hazard is now a comment at the case: the arm being replaced has to be
enumerated first, and a zero-valued constant is the member most likely to be
sitting in it unnoticed.

Both fail-closed arms are now watched: the unclassified type, and a policy
constant with no case — reached by planting one in the table and taking it back
out. Reaching it is the point; a guard nobody has watched fail is a guard nobody
should trust.