Add six-month domain and broker monitoring

docs/architecture.md

@@ -105,6 +105,21 @@ to `OU=Laboratorio`; it suppresses first-logon/privacy/diagnostic prompts,
 disables location, and enforces always-on display, sleep, and hibernation
 settings for managed clients.
 
+The domain controller is also the source-initiated Windows Event Collector for
+managed laboratory computers. Kerberos-authenticated WEF sends only selected
+logon/logoff, failed-logon, reconnect/disconnect, and operating-system power
+events to `ForwardedEvents`. Daily EVTX archives are retained for 183 days, and
+a five-minute server-side inventory records WinRM reachability and AD last-logon
+metadata. Session-duration reports correlate Windows logon IDs; no password or
+SGU HTTP payload is included in this monitoring path.
+
+Broker diagnostics use the dedicated `SGU Auth Broker` Windows log with stable
+event IDs for authorization outcomes, SGU network/timeout failures, unexpected
+profile HTML, partial enrichment, and AD synchronization warnings. The same
+daily maintenance task archives that log for 183 days. Messages identify the
+institutional user and role but never include passwords, password verifiers, or
+raw SGU HTML.
+
 Per-user synchronization is serialized inside the broker to prevent concurrent
 create/reset races. Production deployments should run the broker as a gMSA with
 delegated create-user, move-user, write-property, enable-account, and reset-password