diff --git a/BACKLOG.md b/BACKLOG.md
index dc9784f..ab8eff1 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -2100,6 +2100,13 @@ lent, partition`); the leader tells each named node's agent (root) what to be, t
   /shared inside and nproc 1; a two-node sbatch ran a rank on each. Seen once: a node's pull timed out
   reaching auth.docker.io and the job failed (network, not pyxis). Not tried: GPUs in a container
   (cuda01's agent is an older build; needs the peer protocol), Red Hat.
+- AD end to end, tried 2026-11-14 (decided: one AD per install, the existing auth.ldap group mapping, no
+  tree from AD, no sssd unless a site asks): the VMs' auth.ldap against Samba DC VM 165 (ldaps by IP,
+  CA in the settings, ml-team -> team:Test/arge). ada signed in on the portal with her AD password: an
+  account, in Test/arge, Slurm user ada UID 200003; her key added in the portal's Profile, ssh to the
+  controller ~20 s later, sbatch ran on n1 as ada. Disabled in AD: suspended in 56 s, the Linux user
+  gone in 89 s, ssh refused, home kept. Enabled: back in 32 s, same UID, key kept. Taken out of
+  ml-team: out of the team in 11 s; put back: in again in 56 s.
 - P6, Slurm's jobs in llmgw's accounting (written 2026-11-12, not started). The tenancy tree to Slurm:
   each project an account (`sacctmgr add account`, parent its team and organization), each member a user
   of it, kept by the leader from the store; `sbatch --account=PROJECT`. The records back: the leader reads