diff --git a/.gitignore b/.gitignore
index adddbd7..c1e3ba0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,5 @@ signup_draft.json
 *.png
 *.jpg
 *.jpeg
+# Exceptions — keep bundled assets that are already tracked
+!proxy_chain_manager/world_map.png
diff --git a/docs/OPERATOR_RUNBOOK.md b/docs/OPERATOR_RUNBOOK.md
index 2a8b508..68dce5d 100644
--- a/docs/OPERATOR_RUNBOOK.md
+++ b/docs/OPERATOR_RUNBOOK.md
@@ -36,6 +36,15 @@ Restart-Service -Name MpsSvc -Force
 This resets all runtime firewall state (not persistent rules).  You may still
 need to remove the `PCM_*` rules afterward with Option 1.
 
+### How the application handles this automatically
+
+`firewall.py` exposes `emergency_disengage()`, which is registered via
+`atexit` and `signal.SIGTERM`/`SIGINT` in `service.py`.  A clean exit or
+SIGTERM will call `emergency_disengage()` automatically, removing all
+`PCM_*` rules and restoring `allowoutbound` before the process terminates.
+Only a hard kill (`SIGKILL`, power loss, BSOD) can bypass this handler —
+in those cases use Option 1 or Option 2 above.
+
 ### Verify rules are gone
 
 ```powershell