diff --git a/assets/dist/delivery-flow.svg b/assets/dist/delivery-flow.svg
index 3cf459e..26906ff 100644
--- a/assets/dist/delivery-flow.svg
+++ b/assets/dist/delivery-flow.svg
@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once, pushes the image to Azure Container Registry, the zot pull-through mirror caches it, and the node pulls by digest so the mirror catches the traffic. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
+<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once and pushes to Azure Container Registry; a central pull-through mirror in the cloud fronts upstream, per-site mirrors pull from the centre, and each node pulls by digest - the load fans out in tiers so no thundering herd ever reaches upstream. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
   <defs>
     <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
       <path d="M 0 0 L 10 5 L 0 10 z" fill="#64748b"></path>
@@ -67,26 +67,31 @@
   <!-- ARTEFACT lane -->
   <text x="60" y="392" font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="11" letter-spacing="2" fill="#c026d3">ARTEFACT</text>
   <g font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="12" fill="#0e1726">
-    <rect x="60" y="406" width="150" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
-    <text x="135" y="428" text-anchor="middle">CI builds</text>
-    <text x="135" y="445" text-anchor="middle" font-size="10" fill="#64748b">once, only once</text>
-    <rect x="270" y="406" width="180" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
-    <text x="360" y="428" text-anchor="middle">ACR upstream</text>
-    <text x="360" y="445" text-anchor="middle" font-size="10" fill="#64748b">tag@sha256 minted</text>
-    <rect x="510" y="406" width="180" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
-    <text x="600" y="428" text-anchor="middle">zot mirror</text>
-    <text x="600" y="445" text-anchor="middle" font-size="10" fill="#64748b">the fleet pulls once</text>
-    <rect x="750" y="406" width="150" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
-    <text x="825" y="428" text-anchor="middle">node pulls</text>
-    <text x="825" y="445" text-anchor="middle" font-size="10" fill="#64748b">by digest</text>
+    <rect x="60" y="406" width="130" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
+    <text x="125" y="428" text-anchor="middle">CI builds</text>
+    <text x="125" y="445" text-anchor="middle" font-size="10" fill="#64748b">once, only once</text>
+    <rect x="228" y="406" width="150" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
+    <text x="303" y="428" text-anchor="middle">ACR upstream</text>
+    <text x="303" y="445" text-anchor="middle" font-size="10" fill="#64748b">tag@sha256 minted</text>
+    <rect x="416" y="406" width="160" height="48" rx="10" fill="#c026d3" fill-opacity="0.06" stroke="#c026d3" stroke-width="2"></rect>
+    <text x="496" y="428" text-anchor="middle">central mirror</text>
+    <text x="496" y="445" text-anchor="middle" font-size="10" fill="#64748b">one cloud cache, fronts upstream</text>
+    <rect x="614" y="406" width="150" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
+    <text x="689" y="428" text-anchor="middle">site mirror</text>
+    <text x="689" y="445" text-anchor="middle" font-size="10" fill="#64748b">zot at the edge</text>
+    <rect x="802" y="406" width="118" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
+    <text x="861" y="428" text-anchor="middle">node pulls</text>
+    <text x="861" y="445" text-anchor="middle" font-size="10" fill="#64748b">by digest</text>
   </g>
   <g stroke="#64748b" stroke-width="1.5" marker-end="url(#arr)">
-    <line x1="210" y1="430" x2="264" y2="430"></line>
-    <line x1="450" y1="430" x2="504" y2="430"></line>
-    <line x1="690" y1="430" x2="744" y2="430"></line>
-    <line x1="900" y1="430" x2="944" y2="430"></line>
+    <line x1="190" y1="430" x2="222" y2="430"></line>
+    <line x1="378" y1="430" x2="410" y2="430"></line>
+    <line x1="576" y1="430" x2="608" y2="430"></line>
+    <line x1="764" y1="430" x2="796" y2="430"></line>
+    <line x1="920" y1="430" x2="944" y2="430"></line>
   </g>
   <text x="60" y="480" font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="11" fill="#64748b">promotion is a copy of the same digest - if the digest changed, it is a new candidate, not a promotion</text>
+  <text x="60" y="498" font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="11" fill="#64748b">the tiers layer the load: upstream sees one consumer, each site sees one hop, nodes never leave the LAN</text>
 
   <!-- SECRET lane -->
   <text x="60" y="522" font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="11" letter-spacing="2" fill="#8a6414">SECRET</text>
diff --git a/content/course-VII-supply-chain.md b/content/course-VII-supply-chain.md
index 4d7fd4c..57621a8 100644
--- a/content/course-VII-supply-chain.md
+++ b/content/course-VII-supply-chain.md
@@ -42,6 +42,11 @@ from Move 1 is what makes the mirror actually catch the traffic.
 FIELD NOTE: a mirror can also serve a STALE tag->digest mapping while upstream moved the
 tag. Pin by digest and the whole chain becomes content-addressed - the mirror cannot be
 wrong about a hash.
+TIERING (added 2026-08-17, owner ask): at real fleet scale the mirror itself tiers - a
+central pull-through in the cloud fronts upstream once; per-site mirrors pull from the
+centre; nodes pull from their site over the LAN. The load fans out in layers instead of
+every site hammering upstream at once. Say it: mirrors tier - the load fans out in
+layers, never all at once.
 
 ## Move 3 - Build once, promote by copy
 The anti-pattern: rebuild the image for each environment ("the prod build"). Every
diff --git a/pilot/arc.tpl.html b/pilot/arc.tpl.html
index 5cdb2da..70389c4 100644
--- a/pilot/arc.tpl.html
+++ b/pilot/arc.tpl.html
@@ -237,6 +237,13 @@
       image mirror rules, and carries a sharp edge: digest-mirror rules rewrite <b>digest pulls
       only</b>, so a by-tag pull silently skips the mirror. The pinning habit is what makes the
       mirror actually catch the traffic.</p>
+    <p>At real fleet scale the mirror itself tiers: a <b>central mirror in the cloud</b> fronts
+      upstream once, and every site's mirror pulls from the centre rather than from upstream
+      directly. A new image ripples outward in layers - upstream to the centre, centre to each
+      site as it asks, site to its nodes over the LAN - instead of every site hammering upstream
+      at the same moment. Upstream sees one consumer; each site sees one hop; the nodes never
+      leave the building.</p>
+    <p class="sayit">Mirrors tier: the load fans out in layers, never all at once.</p>
     <h3>Build once, promote by copy</h3>
     <p>Every rebuild is a different artefact - different digest, untested by the stages before it.
       So build <b>once</b>, then promote the same digest through environments by copying, registry
@@ -353,7 +360,8 @@
     <article class="card">
       <h3>zot</h3>
       <p class="what">Where the fleet pulls from - a pull-through mirror between the cluster and the
-        internet, and the control point for what enters.</p>
+        internet, and the control point for what enters. At fleet scale it tiers: one central
+        mirror in the cloud fans out to per-site mirrors, layering the load.</p>
       <p class="leans"><b>Leans on it:</b> every image pull on every node - boot, reschedule,
         scale-up, recovery.</p>
       <p class="down"><b>When it is down:</b> the sharpest edge. Upstream down + mirror up = nobody