The returned error in the signature is left over from previous implementations and was only returning nil. If we know NewFlow will succeed we can fire a create hook (implemented in a future commit) before NewFlow, which will prevent a remove hook for a flow from firing before the create hook for the same flow. Updates tailscale/corp#38630 Signed-off-by: Michael Ben-Ami <mzb@tailscale.com>