• forensics (L28) + jq (L24) now graded on real command output, not text-match — extract the flag/IOCs from a real sample binary
• endgame gauntlet + daily gain forensic ioc-extraction chains over a deterministic sample (daily stays identical everywhere)
• 2 new privesc scenarios: wildcard backup (tar checkpoint injection) + path hijack — real exploit, graded on the artifact it produces
• main menu: numbers-only 1-9, quit via q/esc/ctrl-d