[teamleaderleo]

Base-red fix (fix-forward): #28182 (49c648c) merged after #28386 (13134a8) lowered the acpmux row of the Rust panic ratchet to indexing_slicing 686, string_slice 94, unwrap_used 143. Its own ratchet ran against the old baseline (731). It added six indexing_slicing hits in production code, which put feat-cmux-next over the baseline. This PR rewrites them without panics and with the same behaviour. The baseline is not raised.

file	hit (from #28182)	now
client.rs whole_list	rest["cursor"] = …, reply["nextCursor"] = …	JsonSet::set. Params that are not an object, which used to panic here, are now an error, never a cursorless re-ask for the first page
hub/list_guard.rs bounded page	picked["sessions"], key["at"]	get with the same defaults (no rows, 0)
hub/list_guard.rs bounded page	row(&rows[n]) in the byte_page row closure	rows.get(n); an index past the end reads as null, like a key with no span already does (byte_page only asks for indexes below rows.len())
hub/list_guard.rs too_large_stub	stub[k] = …	JsonSet::set (the stub is an object literal)

Tests

The existing tests cover the changed paths, so this PR adds none: hub::list_guard tests check the stub's peer, omitted and bounded pages, and server tests check the paged whole_list and cursor errors.

Observed / Not run

• At bb04f92 (cmux-ci run 41091973428, with GHOSTTY_ZIG_SOURCE=ghostty-next), gated:
  • The workspace clippy and the ratchet pass with no RED line. acpmux counts are indexing_slicing 686, string_slice 94, unwrap_used 143, expect_used 18, all at or under the baseline.
  • cargo clippy --locked --keep-going -p acpmux --all-targets -- -D warnings passes.
  • cargo test -p acpmux --lib -- list_guard session_list client:: session_pages: 24 passed, 0 failed.
• Review (Sol, gpt-6.1-sol high fast): at 26c76d6, BLOCK, because whole_list silently dropped a cursor it could not set. Fixed in bb04f92. Then SHIP at bb04f92.
• Not run: macOS builds (no Swift change).

Changelog

none

risk:low (panic-free rewrites with the same output).

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review bb04f92: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28429 -f ref=lane/acpmux-ratchet-28182 -f platform=macos -f backend_mode=local

[teamleaderleo]

Review (the owner lane's independent review, at its land request): SHIP at bb04f92

Recorded by lane-gh-broker from this PR's owner lane, which asked to land this exact head after its independent review. next-autoland lands it once every red is the base's; a BLOCK at this head, a HOLD line or a hold label still stops it.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4110084161401 (92b6fe2118)
• cmux NEXT nightly 1.0.0-nightly.4110335000301 (abe139dc5a)
• cmux NEXT nightly 1.0.0-nightly.4110516029701 (b7196082e9)
• cmux NEXT nightly 1.0.0-nightly.4110699040101 (723153fb7a)