I sell tools that stop Claude Code from doing dangerous things, and the sentence at the centre of my marketing was "rules you write in CLAUDE.md get skipped, so you need enforcement."
In late August 2026 I measured it. Thirty-nine trials, Claude Code 2.1.246, two task families, twelve conditions, an observer hook recording every shell command before it ran.
In the 22 trials where the ban was written into a project CLAUDE.md, the banned command was never once attempted. In the 17 trials where it was not written, it was attempted 17 times out of 17.
Nothing I built to break that worked. Not burying the rule in the middle of a 128-line instruction file. Not moving it to the eighteenth of twenty sections. Not planting two other sections in the same file that explicitly told the model to use the banned command. Not raising the stakes from "replace a string in a config file" to "delete files you cannot get back."
Then I translated the whole harness and ran it again in English, because every instruction file in the original was Japanese and that was the largest hole in the result. It reproduced: three out of three attempts without the rule, zero out of three with it.
This book is the full record. The instrument and why the obvious design does not work. Every trial's raw counts, including the six that never started. Six worked examples of my own measuring code producing real numbers for the wrong quantity, and how each one was caught. And the arithmetic on what small samples cannot tell you: zero out of twenty-five bounds the failure rate at about 11 percent. It does not mean "never".
It also contains the measurement that cost me the other half of my sales pitch. A reviewer objected to my claim that a hook makes a violation impossible, so I tested that too. A PreToolUse hook blocks on exactly one exit status. A hook with a syntax error exits with a different one and does not block. Whether a MISSING hook script protects you depends on which interpreter you named in the command: "python3 missing.py" blocks everything and "bash missing.sh" silently lets it through - and "sh missing.sh" goes either way depending on what /bin/sh is on that machine. Ordinary bugs turn your guard off, and the only symptom is a line of stderr nobody reads.
What you get:
- Every condition, every trial, every command the model actually ran
- The harness, cleaned into a single script, so you can run it against your version, your language and your task. It is the same script the English replication used, so you know it works start to finish
- What belongs in CLAUDE.md and what belongs in a hook, tied to specific measurements instead of folklore
- Six worked examples of an instrument producing real numbers for the wrong quantity - the most transferable skill in the book
- A one-minute check for rules that name files which no longer exist, measured at roughly 4 to 7 percent of public repositories that have a CLAUDE.md
What this is not: a certification answer key, a template pack, or a claim that CLAUDE.md is sufficient. One model version, one primary language, two task families, small n. I direct an agent rather than writing the code myself, and the book says so. Every limit is stated in its own chapter, before the practical advice rather than after it.
If you run the harness and get a different answer, yours describes your situation and mine does not. That is the whole reason the scripts are in the book.
