Document the completed Seriatim remediation

docs/conventions.md

@@ -37,6 +37,15 @@
 - Trust Ansible's abstraction boundary. A module that manages state owns the
   checks necessary to manage that state. Inspect it beforehand only when the
   observed state is independently required.
+- State inspection is justified when its result is necessary to decide whether
+  an imperative operation must run, such as checking whether an arbitrary
+  build command's output exists.
+- Production role tasks establish required application state; they do not test
+  the role's own implementation. Put implementation verification in
+  repository-local tests unless the specification explicitly requires runtime
+  validation during convergence.
+- Apply `become: true` to individual tasks that require elevated privileges.
+  Do not require callers to escalate an entire play merely to use a role.
 - Complexity requires a requirement. Every additional task, conditional,
   registered variable, or state probe must correspond to behavior the role is
   required to provide.