- prompts now name every literal, filename, and variable the answer needs (l9 format strings, l19 array/map names, l20 skeleton placeholders) — no more grading on text you were never shown
- playground rebuilt as an isolated compromised-box sandbox: 3 planted flags, dotfiles/ssh/incident logs/crackable hashes/hidden tarball, state that persists between commands, reset, and a mission card