diff --git a/documentation/PROMPT-TEMPLATE.md b/documentation/PROMPT-TEMPLATE.md
index f31acc8..9513726 100644
--- a/documentation/PROMPT-TEMPLATE.md
+++ b/documentation/PROMPT-TEMPLATE.md
@@ -279,7 +279,9 @@ Then:  [exact refusal — HTTP status, error, and the proven non-effect, e.g. "m
 **DO:** [explicit positive instructions; tricky code snippets only — CC fills the obvious parts]
 **DO NOT:** [the specific anti-pattern for THIS task]
 **Crash-safety (if stateful):** journal-before-mutate; atomic tmp+fsync+rename; `Recover` on startup;
-guaranteed cleanup via `defer`; single-flight mutex; `ListLXC`-style ground truth in recovery.
+guaranteed cleanup via `defer` **for graceful exits only** — a `defer` does NOT run on SIGKILL, so a
+crash-safe cleanup needs an on-disk marker plus a startup `Recover()` (Campaign 8 fault 10 proved
+this on live hardware); single-flight mutex; `ListLXC`-style ground truth in recovery.
 
 **Green gate:** `go build ./... && go vet ./... && go test ./internal/<pkg>/`