Document the completed Seriatim remediation

docs/decisions/0001-minimal-module-driven-ansible.md

@@ -29,8 +29,10 @@ requirement falls outside that module contract. In particular:
 - Do not use `stat`, package queries, content comparisons, or account lookups
   merely to decide whether to invoke an idempotent module.
 - Gather state when it is genuinely needed to control application behavior,
-  such as determining whether a locally built executable is missing or has
-  the wrong application version.
+  such as determining whether an imperative build command's output is missing.
+- Treat a successful module invocation as establishing its documented
+  postcondition. Verify the role's implementation in repository-local tests
+  rather than adding production tasks that immediately re-prove it.
 - Do not introduce fingerprints, checksums, sidecar state, staged replacement,
   custom drift recovery, or abstractions without an explicit acceptance
   criterion and rationale.