docs(adr): ADR-033 amended for SIGTERM handling and the recorded deploy limitation (#50, #47)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-03 21:00:55 +02:00
parent 253aa567aa
commit 3e69c00a64
1 changed files with 10 additions and 0 deletions
@@ -1447,6 +1447,16 @@ an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
   re-uploads. The single-replica assumption gains a second dependent (the semaphore is
   process-local) and is recorded here.
   *Amended 2026-10-03 (#50, #47).* The process now handles SIGTERM (what Kubernetes sends on
   every deploy; only SIGINT was handled, so shutdown code never ran). On shutdown the running job
   is recorded `interrupted` at once and the process waits, bounded to 10 s each, for in-flight
   requests and for that write; the start-up sweep stays the backstop for a kill. **Known
   limitation, deliberately not built: a deploy still loses a job in flight** (finishing it needs
   a drain of up to the job time, a ~330 s termination grace and `strategy: Recreate`, i.e.
   downtime on every deploy; a 90-minute file takes ~4.5 min and a deploy lands on a running job
   perhaps one time in five at current volume). Jobs still queued at shutdown stay `queued` until
   the next start's sweep. The user re-uploads, with an honest message.
 8. **Chat reuses `chat.Service`; it is not forked.** The uploaded-transcript chat handlers
   look the row up through the RLS-scoped store, so a non-owner gets 404 by the same mechanism
   as ADR-027's summary gate, **before any model is called**. ADR-027's decisions (ephemeral,