#25111 acpmux: a read-only paired machine may resolve a session, reading no more than its session list shows

Machines paired read-only were refused _acpmux/resolve (added in #25059). The read-only allowlist in pairing/read_only.rs is closed, so a method added later is refused until someone adds it. claude-sr2's ruling (2026-10-25): "allowing read-only paired machines to call _acpmux/resolve exposes nothing they can't already read through _acpmux/sessions. So it's a consistency fix, not a policy change. Do it yourself, with a test that resolve returns no more than sessions does for a read-only peer."

What changes

• _acpmux/resolve is on the read-only allowlist.
• For a read-only connection (ConnAuth::ReadOnlyDevice), Hub::locate(…, names_hosts = false) answers no more than the session list does:
  • Each card has the summary's own fields. host is the summary's peer, or null for this machine's sessions, and link is null for those, so the machine name never appears.
  • The not-found error says "on this daemon or its peers". It doesn't name peers, list the down ones or their state, or say whether a link's host is a peer.
  • local/NAME names a session here.
• Every other connection is unchanged.

Tests

• tests/pairing.rs pairing_a_read_only_machine_resolves_no_more_than_its_session_list_shows:
  • a read-only machine resolves a session;
  • every card field equals the listed summary's (beads derived from its tags; host/link null);
  • a miss names neither a session-less peer nor this machine.
    It failed on base with -32003 read_only, as did the allowlist unit test (the_read_only_gate_allows_reads_and_nothing_else, which now includes MUX_RESOLVE).
• Fleet (cmux-ci, Blacksmith, at 61cbaa4, the same code before cargo fmt): pairing 7/7, --lib 773 passed, hub_integration 401 passed (1 ignored), clippy -D warnings 0.

Review: Codex gpt-6-astra at xhigh returned SHIP at e7fcced5e50a, with no P1 or P2 findings. Its one caveat: the new test covers a name lookup and a plain miss; links, beads, populated peers and unknown-host link errors use the same code path but aren't exercised separately.

No capture: no UI change.

Agent session: big-red

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}