From c82a3b79d6c071113a7410fb9fd54aa61d1f44eb Mon Sep 17 00:00:00 2001
From: Joseph Ferano <joseph@ferano.io>
Date: Sat, 26 Sep 2026 18:50:13 +0700
Subject: [PATCH] CLAUDE.md caps every compiled program's memory and time.

---
 CLAUDE.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 56286bea..0d10e0ed 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,6 +31,10 @@ has lied. `@checks` (`@page`, `@x86`, `@cells`), `@sanitize` and `@valgrind` are
 slow and run only with the author's permission. ASan misses uninitialised stack
 reads; `@valgrind` catches them.
 
+Run any compiled program under a memory cap and a timeout, one at a time:
+`timeout 60 systemd-run --user --scope -p MemoryMax=1G -q <cmd>`. A runaway once
+pushed the author's machine 10 GB into swap.
+
 ## Evidence
 
 Read the source, do not recall it — this repository and the reference clones