fix(acp): overlay kind:40003 edits into agent thread context

[avi-zloof]

Summary

Agents were reading the original kind:9 body, not later kind:40003 edits. Desktop already overlays edits; ACP thread/DM context did not.

This is the Tamir/Atrium-Agent case: a message was edited to add point 7, the UI showed 7 points, the agent still swore there were only 6.

Change

• After fetching thread/DM context, query the latest kind:40003 per visible message and replace content.
• Use the edit event id so a follow-up turn re-includes the new body instead of treating the original as already delivered.
• One file: crates/buzz-acp/src/pool.rs. No relay change.

Test plan

• cargo test -p buzz-acp --lib apply_latest_message_edits
• cargo test -p buzz-acp --lib conversation_context_delta
• cargo test -p buzz-acp --lib test_fetch_thread_context

INT-1437

Made with Cursor

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 00e61eafa917d296104006576b7a2ddbfd58bb5a...46732740baed0c3fb18ab472901d82522b22b66d.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 46732740baed0c3fb18ab472901d82522b22b66d to authorize a new review.
Any previous review applies only to its recorded range.

[Silentpartnercoding]

One authorization edge case seems worth pinning before this lands: validate_edit_ownership authorizes only the first valid e tag, while apply_latest_message_edits applies the same kind:40003 event to every e tag. An author could submit an edit whose first target is their own message and whose second target is someone else's; relay ingest accepts it, then ACP can overwrite both messages in agent context.

I'd either require exactly one valid edit target at ingest or validate every target independently, and add a negative test where [["e", own], ["e", victim]] leaves the victim unchanged.