feat: an operation says it amends the target it names (greenhouse decisions/0596)

[rodrigoteamx]

An operation can declare that it amends the target it names. Nothing in this package acts on it: it is a contract, and the session's floor in milpa/app-runtime is who reads it (greenhouse decisions/0596, decided by Rod on 2026-10-07).

Why

The intent contract asks a person before an operation touches a target the request does not name. createsNamedTarget drew its line by the verb: an operation that creates its named target is not asked, one that selects an existing target is. The record of the lab's houses drew it elsewhere: of 34 times a house asked a person to confirm an edit, 28 were about a class that same session had brought into the house a moment before, and not one about a class the record shows in the house from before the session. Nothing the person already had was being selected.

So the target of an operation that declares amendsNamedTarget is named when the session's own record says where it came from: the session brought it into the house and it is still what the session left, or the call repairs a proposal of that same session. What the record does not say keeps being asked.

What it does

• Operation::$amendsNamedTarget, false by default — fail-closed: silence keeps the question.
• It is the last constructor parameter, so no positional caller moves.
• Two contradictions are refused where they are written: declaring it with no namedTarget, and declaring it beside createsNamedTarget.
• A host that rebuilds the contract from its public properties keeps the declaration.

How it was checked

• Tests written first and seen red: AnOperationSaysItAmendsItsNamedTargetTest (7).
• Hand mutants: 5 of 5 red (greenhouse scripts/lab/edit-1143/mutants.py command).
• 236 tests, line coverage 100 %, PHPStan, style, DocBlocks, attribution.
• The framework's and greenhouse's suites pass the same with this branch laid over the published family (greenhouse evidence/1143).

Landing

This goes first: getmilpa/devtools declares it on edit and getmilpa/app-runtime reads it. Both read it defensively and are green on the published milpa/command, so nothing breaks while it waits.