Storing a recipient-side edit/retraction history is the only reasonable
way to cover harmful / abusive messages - once they were delivered to at
least one of the recipient's clients, that is. In fact, that would
actually be an argument for keeping the original message in MAM, instead
of replacing it with a tombstone.

There is obviously a highly important design trade-off between the
interest of the sender (oops, I disclosed a secret to the wrong person)
and the recipient (I don't want abusive messages to disappear, leaving
behind no evidence). I think that LMC (or, well, AMC) is a very
reasonable resolution to that trade-off.

For sure it is a much better trade-off than allowing the sender to
delete an abusive message right after it was seen by the recipient, and
I guess it is also a better trade-off than leaving an inadvertently
disclosed secret visible for all time (but still accessible with a few
clicks). In fact, given that there is no *guarantee* that '424 will
delete the message (as clearly stated in the XEP), any secrets need to
be considered as compromised anyway.

The '424/'308 use case is distinctly different from the '425 Moderated
Message Retraction use case, where the moderation decision was made by a
third party, which is supposed to not be collaborating with an abusive
sender.

Ultimately, I think that the same business rules should apply to both
'308 and '424 - it doesn't make UX sense to give a longer period for
retractions than for edits, and vice versa.

As an author of the XEP, I'm strongly against this, because it privileges
the recipient over the sender.

Imagine sending a nude photograph of  yourself by mistake and then
having it kept on record after you've removed it. I understand that
client and server incompatibility means that deletions aren't
guaranteed, but to me that's quite different from the XEP mandating
that records of retracted messages be kept.

I also don't see how LMC is a reasonable solution to that trade-off.

To me, part of the distinction between corrected and retracted
messages is that with the former you can (in some clients) view the
history and with the latter you can't.

JC