Development record

update.Plan dispatch switch has no default case, so an unrecognised UpdateTargetKind falls through the return nil permissive branch of a mutating refusal gate to fetch-and-swap, against unrecognized-input-never-writes; UpdateTargetFile is now an explicit case and any other kind a named refusal