diff --git a/DECISIONS.md b/DECISIONS.md
index 2db1b68..5f95e34 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -1447,6 +1447,16 @@ an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
    re-uploads. The single-replica assumption gains a second dependent (the semaphore is
    process-local) and is recorded here.
 
+   *Amended 2026-10-03 (#50, #47).* The process now handles SIGTERM (what Kubernetes sends on
+   every deploy; only SIGINT was handled, so shutdown code never ran). On shutdown the running job
+   is recorded `interrupted` at once and the process waits, bounded to 10 s each, for in-flight
+   requests and for that write; the start-up sweep stays the backstop for a kill. **Known
+   limitation, deliberately not built: a deploy still loses a job in flight** (finishing it needs
+   a drain of up to the job time, a ~330 s termination grace and `strategy: Recreate`, i.e.
+   downtime on every deploy; a 90-minute file takes ~4.5 min and a deploy lands on a running job
+   perhaps one time in five at current volume). Jobs still queued at shutdown stay `queued` until
+   the next start's sweep. The user re-uploads, with an honest message.
+
 8. **Chat reuses `chat.Service`; it is not forked.** The uploaded-transcript chat handlers
    look the row up through the RLS-scoped store, so a non-owner gets 404 by the same mechanism
    as ADR-027's summary gate, **before any model is called**. ADR-027's decisions (ephemeral,