TEMP: test with a clean tree, no crossing/rejoining edges

7 nodes, strictly tree-shaped, no diamond merges (removed DNS-->Vault
and the EdgeProxy/SSO/InternalProxy branch entirely). If gap is gone,
the rejoining-path topology is the trigger, not raw node count.

README.md

@@ -83,21 +83,10 @@ flowchart LR
 
     LAN --> DNS["Internal DNS<br/>two zones"]
     LAN --> Vault["Vault<br/>PKI + secrets"]
-    DNS --> Vault
 
     Vault --> Apps["App Host<br/>41 stacks"]
     Vault --> Automation["Automation VM<br/>Git + orchestration"]
     LAN --> FileServer["File Server"]
-    DNS --> FileServer
-    LAN --> Automation
-
-    Apps --> InternalProxy["Internal Proxy Zone"]
-    Apps --> SSO["SSO"]
-
-    Vault --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
-    DNS --> EdgeProxy
-    Apps -.proxied.-> EdgeProxy
-    SSO -.auth.-> EdgeProxy
 ```
 Solid arrows are real dependencies; dotted arrows are asynchronous telemetry reporting, not a blocking dependency. Full breakdown of all 8 traffic laws (ingress, east-west, secrets, DNS, observability, notifications, CI/CD, management) with the actual trust-boundary reasoning: [docs/architecture-overview.md](docs/architecture-overview.md).