The sandboxing note is the part I'd want spelled out further. Blocking outbound network calls and file deletion closes the two failure modes people usually worry about with agent-written code, but the subprocess still shares the notebook's CPU and memory, so a generated turn that's just buggy rather than malicious, an accidental O(n^2) join across 1.5M rows, or a recursive call that never converges, can still eat the capacity's resources for as long as it runs, network-isolated or not. Is there a per-turn CPU or memory cap the harness enforces on its own, separate from the overall 600-second timeout in the example, or does a runaway turn simply run until that outer timeout kills it?