diff --git a/machine-docs/DECISIONS.md b/machine-docs/DECISIONS.md
index 949810c..729d7bc 100644
--- a/machine-docs/DECISIONS.md
+++ b/machine-docs/DECISIONS.md
@@ -198,7 +198,16 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
 
 **V8a gap noted:** cc-ci-upgrader session self-terminates after run completion (Claude exits, tmux session closes). Plan requires "stays idle (does NOT self-terminate)." For weekly cron automation the behavior is correct (fresh start on each invocation). Operator UX gap: run summary not viewable at claude.ai/code after completion; summary is written to disk (`/srv/cc-ci/.cc-ci-logs/upgrades/upgrade-all-*.md`). Not fixed; tracked as known gap.
 
-**T0 fire verification:** pending (T0 = 23:04Z, ~55 min from cron install). Record result here once observed.
+**T0 fire verification:** PASS — T0 fired 23:04Z, Adversary-verified §4 cron PASS @23:20Z (build complete).
+
+**⚠️ SUPERSEDED 2026-06-02 — mechanism migrated to a NixOS systemd timer.** The CronCreate / busybox
+approaches above are both retired. The weekly upgrade now runs via a reboot-safe systemd timer
+(`cc-ci-upgrade-all.{service,timer}`) declared in the orchestrator flake
+(`nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix`), **OnCalendar=Sun *-*-* 02:00:00 UTC,
+Persistent=true** (operator moved the schedule from Mon 23:04 → Sun 02:00 UTC). It runs
+`launch-upgrader.py start` → `/upgrade-all` DEFAULT, timer-triggered only. This closes the boot/
+restart-durability gap noted above (the CronCreate job was in-memory/session-scoped and evaporated
+when the Builder session ended at sequence-complete). Next run: Sun 2026-06-07 02:00 UTC.
 
 ## Dead-ends
 - (none yet)