Let foreground user follow-ups revise paused Goals safely

[ByBrawe]

Problem

A paused Goal only treats a narrow devam et/continue message as lifecycle control. A substantial foreground user follow-up (including long multi-item requirements) remains ordinary chat, so work can move forward while the durable Goal contract stays paused/stale.

Historical user session snapshots show this repeatedly: completed/newly requested work remains behind a paused Goal, stale Todo state, or a manual /goal resume//goal edit boundary.

Design

• Capture only the exact latest foreground human message as a short-lived, one-shot revision authorization.
• Add opencode_goal_revise_from_user with extend and replace modes; the model cannot supply replacement text of its own.
• extend preserves the current objective and appends the exact human follow-up; replace uses that exact message as the new objective.
• Increment Goal revision, reactivate eligible active/paused/blocked Goals, preserve cumulative usage/budgets/evidence history, and reset stale native Todo telemetry so the next revision replans.
• Treat revision as a turn boundary: block additional workspace mutations in the stale pre-revision assistant turn and continue on the next Goal-owned turn.
• Give the revision-boundary turn a one-shot stall exemption.
• Keep short natural resume on the existing same-revision /goal resume path.
• Do not implicitly bypass budget_limited or usage_limited states.
• Foreign/plugin slash-command traffic remains outside revision authorization because the existing foreign-command guard wraps this bridge.

Coverage

Adds regressions for a 100-line exact user follow-up, extend/replace behavior, single-use authorization, fresh Todo planning, stale-turn mutation blocking, natural resume staying same-revision, and budget/provider limit fail-closed behavior.

Rationale

This follows the stronger parts of current agent UX: user follow-ups can redirect task execution, while queue/steer/replace semantics remain explicit and plans are rebuilt when scope materially changes. The host—not the model—remains authoritative for which exact user text can alter the Goal contract.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.