diff --git a/docs/architecture-overview.md b/docs/architecture-overview.md
index d0da03f..54a8491 100644
--- a/docs/architecture-overview.md
+++ b/docs/architecture-overview.md
@@ -6,8 +6,8 @@
 ## Dependency graph
 
 ```mermaid
-flowchart TD
-    Internet(["Internet"]) --> Edge["Edge Firewall<br/>NAT · public reverse proxy · NTP · DHCP"]
+flowchart LR
+    Internet(["Internet"]) --> Edge["Edge Firewall"]
     Edge --> LAN["LAN"]
 
     LAN --> DNS["Internal DNS"]
@@ -15,44 +15,46 @@ flowchart TD
     DNS --> Vault
 
     Vault --> Apps["App Host<br/>~40 stacks"]
+    Vault --> Automation["Automation Host"]
     LAN --> FileServer["File Server"]
     DNS --> FileServer
-    Vault --> Automation["Automation Host"]
     LAN --> Automation
 
-    Apps --> InternalProxy["Internal reverse-proxy zone"]
+    Apps --> InternalProxy["Internal Proxy Zone"]
     Apps --> SSO["SSO"]
+    Automation --> GitHost["Git Hosting"]
 
-    Automation --> Gitea["Git hosting<br/>internal + public mirror"]
-
-    Vault --> EdgeProxy["User-facing reverse proxy<br/>mTLS"]
+    Vault --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
     DNS --> EdgeProxy
-    Apps -.proxied by.-> EdgeProxy
-    SSO -.auth gate via.-> EdgeProxy
+    Apps -.proxied.-> EdgeProxy
+    SSO -.auth.-> EdgeProxy
 
-    Apps -.reports to.-> Monitoring["Monitoring"]
-    Automation -.reports to.-> Monitoring
-    FileServer -.reports to.-> Monitoring
-    EdgeProxy -.reports to.-> Monitoring
-    Vault -.reports to.-> Monitoring
-    DNS -.reports to.-> Monitoring
+    Apps -.-> Monitoring["Monitoring"]
+    Automation -.-> Monitoring
+    FileServer -.-> Monitoring
+    Vault -.-> Monitoring
+    DNS -.-> Monitoring
+    EdgeProxy -.-> Monitoring
 
-    Apps -.reports to.-> Wazuh["Security Monitoring"]
-    Automation -.reports to.-> Wazuh
-    FileServer -.reports to.-> Wazuh
-    EdgeProxy -.reports to.-> Wazuh
-    Vault -.reports to.-> Wazuh
-    DNS -.reports to.-> Wazuh
+    Apps -.-> SecMon["Security Monitoring"]
+    Automation -.-> SecMon
+    FileServer -.-> SecMon
+    Vault -.-> SecMon
+    DNS -.-> SecMon
+    EdgeProxy -.-> SecMon
 ```
 
+> [!TIP]
+> Solid arrows are real dependencies — the target has to be reachable and healthy for the source to function. Dotted arrows into Monitoring and Security Monitoring are the one exception: every host reports telemetry to both, but per the Observability Independence Law below, that reporting is asynchronous and non-blocking — nothing here actually depends on Monitoring or Security Monitoring being up. The line style carries that distinction instead of repeating "reports to" twelve times. Full detail on what's actually collected: [`docs/observability.md`](observability.md) and [`docs/security-monitoring.md`](security-monitoring.md).
+
 ## Four trust boundaries, not two
 
 ```mermaid
 flowchart LR
-    WAN["WAN"] -->|public application boundary| EdgeFW["Edge Firewall / public proxy"]
+    WAN["WAN"] -->|public| EdgeFW["Edge Firewall<br/>public proxy"]
     Browser["LAN browsers"] -->|mTLS + SSO| UserProxy["User-facing proxy"]
-    Service["App-to-app"] -->|IP-allowlist + SSO| InternalProxy["Internal proxy"]
-    Infra["LAN infra-to-infra"] -->|explicit per-flow rules| HostFW["Host firewall rules"]
+    Service["App-to-app"] -->|allowlist + SSO| InternalProxy["Internal proxy"]
+    Infra["LAN infra-to-infra"] -->|per-flow rule| HostFW["Host firewall"]
 ```
 
 Backend services trust proxy headers, not raw client IP, on every path.