Restore stale Goal Acceptance Todo edits without a lease-acquisition deadlock

[huangruiteng]

Problem

In a promoted Goal with handoff_mode=hard_lease and an enabled, owner-confirmed Goal Acceptance binding, an Agent can make an unintended work-field edit while holding the lease (for example, clear an existing resume_when). The edit correctly makes the binding stale. After the lease is released, the documented recovery advice says the Agent may restore an unintended edit, but the current control plane has no executable route: todo update requires an active lease, while task-lease acquire rejects the stale binding. The original Todo cannot be completed or settled, and a same-Turn blocker writeback cannot consume quota while completion validation remains pending.

This is distinct from #4957 (validator revisions and append-only successor links), #4962 (previously absent wait added), and #4935 (deferred-to-open lease recovery). It does not justify auto-rebinding an owner criterion or bypassing Goal Acceptance.

Minimal synthetic reproduction

1. Create a disposable promoted File and SQLite Goal with hard leases, one owner-confirmed advancement Todo, and a valid existing resume_when plus a runnable successor.
2. Acquire the Todo lease; call the supported Todo update to clear that existing wait; release the lease.
3. Observe goal-acceptance inspect reports the Todo stale; todo update to restore the exact previous wait returns Todo update requires the current active lease execution proof; task-lease acquire returns the stale acceptance error.
4. Confirm the owner binding, criterion checks, and original Todo identity have not changed.

Acceptance

Provide an explicit, CAS-guarded restoration or replan path for the same claimed Agent that can reconstruct and restore the exact prior work declaration without granting a new lease over arbitrary stale work. Preserve foreign-owner/excluded-Agent rejection, exact idempotent retries, owner criterion authority, and File/SQLite parity. If the previous declaration cannot be reconstructed, project a concrete owner-rebind requirement rather than a loop that tells the Agent to restore an edit it cannot restore. Add CLI and managed-Turn regression coverage for release/reacquire and no double settlement. Do not rewrite historical receipts or silently treat a true scope/text change as harmless.

Observed against a current local release including merged #4957/#4962; no private Goal state or credentials are included in this report.