diff --git a/SKILL.md b/SKILL.md
index dc532c9..62f15ad 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -377,7 +377,11 @@ nothing is pasted or paraphrased. The brief says:
   TypeScript, mutmut for Python. The tool generates the mutants and nobody
   writes an anchor. cargo-mutants runs through `tools/cargo-mutants.sh` (per-file
   scoped tests, survivors confirmed against the full suite, sharded over
-  Yggdrasil slots), once per Hands pass. Every survivor is a finding about the tests, triaged by
+  Yggdrasil slots), once per Hands pass. Each mutant runs under its own memory and time
+  cap (a container `--memory`, `systemd-run --scope -p MemoryMax= -p RuntimeMaxSec=`, or
+  `prlimit`): a mutant that deletes a size guard grows without bound, and on 2026-11-07/08
+  such mutants of Bifrost's media reader took Yggdrasil to global OOM four times.
+  Every survivor is a finding about the tests, triaged by
   name: a behavioural test is missing, a fixture is degenerate (see below),
   or the mutant is equivalent and gets a one-line reason. Boundary flips on
   float thresholds are equivalent by default and are not chased. The score is
diff --git a/references/changelog.md b/references/changelog.md
index 8b572bc..c6949f1 100644
--- a/references/changelog.md
+++ b/references/changelog.md
@@ -21,6 +21,14 @@ What changed. `tools/recall.py dispatch`: a `PreToolUse` command hook on `Agent|
 Fix pass (Soul s2): dispatch driver D16 pins the mixed deadline (one anchor out of time gets its CheckFailed line while another answers; silent only when no anchor answered) and D17 pins the hard stop (payload written, stdin held open: exit 0, silent, at the deadline; the mutant with the `os._exit` timer neutered hangs and fails D17). Docs say the same.
 Fix pass (Soul s1): recall is per anchor. One cited id failing or refused no longer silences the rest: the other anchors' neighbours still reach the subagent and the failed id gets a status line naming it and the failure kind (`CheckFailed`, `Refused`, `NotHeld`); nothing prints only when no anchor could be checked. Every cited id, not just the first six, is kept out of the neighbours. D8's deadline check is bounded by the fake's own sleep, so a loaded host no longer fails it.
 
+## 2026-11-08: every mutant runs under its own memory and time cap
+
+Self, session `self-2026-11-04-eureka`.
+
+Evidence. Eyes pass `eureka-body:research:heimdall-self-failures.*`: four global OOM kills of Heimdall's Self runs (2026-11-07 20:49 to 2026-11-08 06:03) came from mutation testing: a mutant removed the 5 MiB guard in Bifrost's media reader while the test fed an endless stream, and a CultLib mutation script ran tsc and node --test uncapped; each grew to ~60 GB and pressured every service on Yggdrasil.
+
+What changed. `SKILL.md` step 3: each mutant runs under its own memory and time cap. Separately, every Self unit is capped (MemoryMax 24G, the Self slice 40G; gamecult-ops PR 59).
+
 ## 2026-11-07: authority follows stewardship between peers
 
 Self, session `self-2026-11-04-eureka`.