docs: capture PD future-state architecture

docs/architecture/ARCHITECTURE_OVERVIEW.md

@@ -1,6 +1,6 @@
 # Architecture Overview
 
-Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and deployed.
+Current live homelab stack plus the planned direction for the upgraded PD platform.
 
 ## Servers
 
@@ -74,3 +74,12 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
 4. **NFS for Immich** — photo library lives on Serenity's large array; PD mounts on demand (not at boot)
 5. **TrueNAS manages Docker** — never use `systemctl restart docker` on PD; use `docker compose` or `docker restart` for individual containers
 6. **Credential hygiene** — Gitea pushes from PD/NOMAD use internal SSH (`ssh://git@10.5.30.6:2222/<owner>/<repo>.git`); GitHub remote uses SSH key (`/root/.ssh/id_gitea`)
+
+## Planned Direction — upgraded PD + Serenity retirement
+
+- **PD stays on bare-metal TrueNAS Scale** and becomes the long-term production center of gravity for storage, Docker, shared databases, media, identity, monitoring, and the primary DNS source node.
+- **PD may also host cybersecurity VMs**, but only inside a dedicated lab VLAN / policy lane with default-deny access into production.
+- **N.O.M.A.D. remains the trusted secondary lane** for offline knowledge, game hosting, and the backup Technitium resolver.
+- **Rocinante becomes optional** if PD receives the 4090; otherwise it stays the heavy inference specialist.
+- **Serenity is transitional**: as long as it owns the storage, qBittorrent/ARR locality can remain there; once PD directly owns the storage, that path-locality argument flips and the remaining torrent/media-ingest stack should move to PD before Serenity is retired.
+- See [../planning/PD_FUTURE_STATE_ARCHITECTURE.md](../planning/PD_FUTURE_STATE_ARCHITECTURE.md) for the full target-state plan and [pd-future-state-topology.html](pd-future-state-topology.html) for the visual operator map.