fix(acp): steer edited mentions with lifecycle fencing

[loganj]

🤖

Summary

Once edit mentions are active, an edit arriving during an agent turn should steer that live turn when the ACP client supports native steering. Asynchronous preparation and channel membership changes make that path lifecycle-sensitive; this final stack slice adds native steering with explicit ownership and generation fences.

• Resolves and reserves eligible edit steers without blocking the relay loop, then acknowledges only after native delivery is accepted.
• Falls back exactly once to queued delivery when native steering is unavailable or preparation fails.
• Preserves the original-message/thread routing established by fix(acp): preserve routing for edited messages #4741 for steer acknowledgements, failures, and later turn output.
• Fences prepared, in-flight, and fallback work by membership generation so removal and re-addition cannot revive stale edits.
• Releases reservations and ownership across cancellation, supersession, shutdown, and failed delivery paths.

Stack position

3 of 3 — native steer and lifecycle fencing, based on #6131 (larry/pr-4741-activation).

Previous: #6131, which is based on #4741.

Related issue

None found. Split from #4741's original combined scope.

Testing

• cargo test -p buzz-acp --all-targets — 816 unit tests and 9 lifecycle tests passed
• cargo check -p buzz-acp

[jedwards27]

Verdict: APPROVE

Reviewed 681ae2c4d34dccf1adb9fb82908fd9eb88fcf3d1..82e041561d5a5cf04b54ec983fd208202c8ae2f6 at exact head 82e041561d5a5cf04b54ec983fd208202c8ae2f6.

Risk: high — this changes messaging correctness and the ACP agent-runtime lifecycle across asynchronous preparation, live-turn steering, acknowledgements, membership changes, and fallback delivery.

Findings: no blocking or non-blocking defect found.

Behavior/contracts traced:

• Prepared edits carry membership generation, originating turn ID, and the exact queue reservation; all three must still match before native steering is sent (crates/buzz-acp/src/lib.rs:1550-1582,3504-3555). Mutation-removing the turn-ID fence caused prepared_edit_is_stale_after_replacement_turn_starts to fail, then the tree was restored clean.
• Membership removal/re-add drains or invalidates old work, advances generation, and prevents stale acknowledgements from mutating queue state, reactions, deadlines, fallback, or the delivery ledger (crates/buzz-acp/src/lib.rs:1614-1631,2745-2862,3585-3597,4445-4482; crates/buzz-acp/src/queue.rs:764-812).
• Result/ack ordering is loss-averse: a reservation is marked sent before watcher spawn, completion remains fenced until the sent acknowledgement settles, and failure/unknown outcomes release to ordinary delivery or cancel-and-merge rather than dropping the edit (crates/buzz-acp/src/lib.rs:3602-3750,4150-4193; crates/buzz-acp/src/queue.rs:440-469,932-1012).
• Edit enrichment resolves the signed original and thread before formatting; reactions and failure notices remain attached to the original visible message rather than exposing the auxiliary edit as a reply anchor (crates/buzz-acp/src/pool.rs:3470-3506,3526-3591; crates/buzz-acp/src/queue.rs:1704-1724; crates/buzz-acp/src/lib.rs:1634-1649,3721-3727).
• The exact diff is confined to buzz-acp Rust and does not alter Desktop rendering, focus, keyboard, or accessibility surfaces.

Validation at exact clean head:

• cargo test -p buzz-acp --all-targets — PASS: 856 library tests plus 9 lifecycle integration tests, 0 failures.
• cargo fmt --all -- --check — PASS.
• cargo clippy -p buzz-acp --all-targets -- -D warnings — PASS.
• git diff --check — PASS.
• Targeted mutation of the replacement-turn fence — expected regression test failure; restored tree clean at the reviewed head.
• Fresh GitHub state: head remains pinned, merge state CLEAN, 26 checks successful and 4 intentionally skipped.

Manual/native evidence: no real Goose, Claude, or Codex process was observed accepting an edited mention end to end through relay enrichment, native steer, visible reply, and reaction cleanup. Deterministic transport/lifecycle tests cover the changed seams, but do not prove real-adapter timing.

Residual risk: acp.rs retains an existing reader-first biased select that can defer a ready steer while stdout remains continuously ready; its pre-select deadline check bounds the delay, but fairness was not live-probed. That mechanism is outside this PR's exact diff, so it is a pre-existing follow-up risk rather than author rework.

Author action: none.

Verification owner: reviewer/tooling for optional live-adapter observation and a separate fairness probe; CI/release gate for normal post-merge artifact validation.