Improve domain enrollment and desktop personalization

docs/architecture.md

@@ -23,13 +23,15 @@ is forced because NTLM authentication is connection-bound.
 The authoritative logical GET is sent to `/psulsa/`, a lightweight route that
 returns the NTLM challenge without waiting for the slow application pages. A
 `401` or `403` rejects the credential; an allowed `2xx` or `3xx` proves that IIS
-accepted it. The broker then makes a separately bounded, best-effort GET to the
-administrative incident overview for `AD`, the student information page for
-`AL`, or the portal menu for `DO`. After the incident page confirms an `AD`
-employee number, two additional GETs in the same in-memory session read the
-structured name from `datos/personales.aspx` and the address from
-`datos/ubicacion.aspx`. Docentes keep the menu name as a base and attempt those
-same two shared staff modules without requiring them to exist. A supplemental
+accepted it. The broker then makes separately bounded, best-effort profile GETs.
+It uses the administrative incident overview for `AD`, the student information
+page for `AL`, and the portal menu as a conservative base for `DO`. After the
+incident page confirms an `AD` employee number, two additional GETs in the same
+in-memory session read the structured name from `datos/personales.aspx` and the
+address from `datos/ubicacion.aspx`. Docentes request
+`nomina/consultanomina.aspx` for a matching employee number, email, employee
+type and job title, then attempt the same two shared staff modules without
+requiring any optional route to exist. A supplemental
 404, changed/missing element ID, other failure, or timeout preserves fields
 already collected, and a profile timeout does not invalidate an already
 authenticated credential. NTLM may still require its normal
@@ -62,9 +64,10 @@ updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
 `postalCode` attributes. Administrative and student numbers must match the six
 numeric digits of the requested identity before any role-specific metadata is
 trusted. Administrative personal and location pages are accepted only after
-that incident-page match. A docente's supplemental fields remain tied to the
-fresh NTLM-authenticated portal session and are optional; the menu display name
-remains usable if neither shared page is available. Student faculty/department
+that incident-page match. Docente payroll metadata must match the requested
+six-digit number; all docente supplemental fields remain tied to the fresh
+NTLM-authenticated portal session and are optional. The menu display name
+remains usable if the payroll or shared staff pages are unavailable. Student faculty/department
 is deliberately left unset because the verified page does not expose it.
 Missing metadata does not clear existing AD values and never changes the
 password outcome.
@@ -105,6 +108,13 @@ to `OU=Laboratorio`; it suppresses first-logon/privacy/diagnostic prompts,
 disables location, and enforces always-on display, sleep, and hibernation
 settings for managed clients.
 
+That computer GPO also owns the base lock-screen image and a per-logon command
+for the personalized desktop wallpaper. The client-side renderer reads the
+authenticated user's `displayName` plus the computer object's `location` and
+immediate parent OU, then composes those values over the bundled dark-blue
+background with the bundled Indivisa fonts. Missing directory attributes degrade
+to deterministic text and never block the interactive session.
+
 The domain controller is also the source-initiated Windows Event Collector for
 managed laboratory computers. Kerberos-authenticated WEF sends only selected
 logon/logoff, failed-logon, reconnect/disconnect, and operating-system power