Kerberos SSO across a trust broke after patching. The updates were not the cause

Two Active Directory domains with a trust between them. User accounts and workstations live in one of them, an internal web service lives in the other. Throughout this article I call them the user domain and the service domain, and cat full-post.md