docs(TASK-D): R-51/R-52 SHIPPED + new R-54 row; capability-map row; seam-discipline rider

R-51's roadmap diagnosis is corrected at the source: aggregation returned StateRunning
("partial") for a running/stopped mix, so the stack read RUNNING and IsDownState was never
consulted about  at all — the constraint that row protects was never in tension
with the fix.

New R-54 row closes the INCIDENT-guest-dhclient-killed-2026-07-20 §5 OPEN RISK, and records
the design fact that makes it work: liveness of the DHCP client is itself a probe, because
the damage is timed and the address outlives its cause by 1-2 hours. The static-guest leg is
deliberately deferred to R-50.

New capability-map row is IMPLEMENTED, not PROVEN-LIVE: one leg is live (the watchdog's
healthy cycle on felhom-pve), the three that matter are destructive and operator-present and
have not run.

PROMPT-TEMPLATE §10 gains the seam-discipline row, including that a strings.Contains source
assertion is NOT sufficient — a commented-out call still contains the string.

documentation/PROMPT-TEMPLATE.md

@@ -226,6 +226,15 @@ Then:  [exact refusal — HTTP status, error, and the proven non-effect, e.g. "m
   `copier` interface so tests don't shell out to docker/rsync).
 - **Generation/idempotency:** assert the negative (e.g. "fetch count does NOT increment on an
   unchanged heartbeat"; "a re-run finds its own prior `(N)` and adds no `(1)(1)`").
+- **Seam discipline — every seam added gets ONE test through the PRODUCTION wiring path.** An
+  injected-seam test proves the component, never the caller. Three shipped defects in three days
+  make this non-negotiable: controller v0.154.0 (the wizard read a flag the handler never sets),
+  agent v0.91.0 (`main.go` never called `SetAuthSink`, so the whole auth-honesty leg was inert), and
+  agent v0.92.0 (the watchdog had no sudoers grant for three of its four probes). **Every one of
+  them was fully green.** Where the caller is `func main()` and cannot be invoked from a test, walk
+  its AST for the call — and note that a `strings.Contains` on the source is NOT sufficient: a
+  commented-out call still contains the string, which is how the controller's first version of that
+  test passed its own red-proof (2026-07-21).
 
 ---