diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 790720c..204e469 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -20,7 +20,7 @@ Don't substitute a regular hyphen between words where an em-dash would have gone
 
 ### No jargon acronyms
 
-Don't use programming-culture acronyms like YAGNI, DRY, KISS, SOLID, TDD, BDD, DDD, MVP, SOA, NBO. Applies in chat, code comments, commit messages, and docs. Even when the reader knows them, they read as in-group shorthand and force a mental expansion step. Say what you mean: "don't build it until a second caller exists" instead of "YAGNI", "extract this once it's duplicated three times" instead of "DRY", "network byte order" or "big-endian" instead of "NBO", and so on.
+Don't use programming-culture acronyms like YAGNI, DRY, KISS, SOLID, TDD, BDD, DDD, MVP, SOA, NBO, TOCTOU. Applies in chat, code comments, commit messages, and docs. Even when the reader knows them, they read as in-group shorthand and force a mental expansion step. Say what you mean: "don't build it until a second caller exists" instead of "YAGNI", "extract this once it's duplicated three times" instead of "DRY", "network byte order" or "big-endian" instead of "NBO", and so on.
 
 Common technical abbreviations that name a thing (HTTP, JSON, SQL, API, CLI, TCP, MAC) are fine. The rule targets acronyms that encode a *principle*, *opinion*, or piece of jargon, not those that name a protocol or format.