diff --git a/README.md b/README.md
index 3c06858..9b7b18f 100644
--- a/README.md
+++ b/README.md
@@ -81,12 +81,12 @@ flowchart LR
     Internet(["Internet"]) --> Edge["Edge Firewall"]
     Edge --> LAN["LAN"]
 
-    LAN --> DNS["Internal DNS"]
-    LAN --> Vault["Vault"]
+    LAN --> DNS["Internal DNS<br/>two zones"]
+    LAN --> Vault["Vault<br/>PKI + secrets"]
     DNS --> Vault
 
     Vault --> Apps["App Host<br/>41 stacks"]
-    Vault --> Automation["Automation VM"]
+    Vault --> Automation["Automation VM<br/>Git + orchestration"]
     LAN --> FileServer["File Server"]
     DNS --> FileServer
     LAN --> Automation
@@ -94,13 +94,27 @@ flowchart LR
     Apps --> InternalProxy["Internal Proxy Zone"]
     Apps --> SSO["SSO"]
 
-    Vault --> EdgeProxy["User-Facing Proxy"]
+    Vault --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
     DNS --> EdgeProxy
     Apps -.proxied.-> EdgeProxy
     SSO -.auth.-> EdgeProxy
 
-    Automation -.-> Monitoring["Monitoring"]
-    Automation -.-> SecMon["Security Monitoring"]
+    Apps -.-> Monitoring["Monitoring"]
+    Automation -.-> Monitoring
+    FileServer -.-> Monitoring
+    EdgeProxy -.-> Monitoring
+
+    Apps -.-> SecMon["Security Monitoring"]
+    Automation -.-> SecMon
+    FileServer -.-> SecMon
+    EdgeProxy -.-> SecMon
+
+    classDef edge fill:#f8cecc,stroke:#b85450,color:#333
+    classDef core fill:#dae8fc,stroke:#6c8ebf,color:#333
+    classDef obs fill:#fff2cc,stroke:#d6b656,color:#333
+    class Internet,Edge edge
+    class LAN,DNS,Vault,Apps,Automation,FileServer,InternalProxy,SSO,EdgeProxy core
+    class Monitoring,SecMon obs
 ```
 Solid arrows are real dependencies; dotted arrows are asynchronous telemetry reporting, not a blocking dependency. Full breakdown of all 8 traffic laws (ingress, east-west, secrets, DNS, observability, notifications, CI/CD, management) with the actual trust-boundary reasoning: [docs/architecture-overview.md](docs/architecture-overview.md).