diff --git a/tools/re-capture/README.md b/tools/re-capture/README.md
index c19506cd..a177fd05 100644
--- a/tools/re-capture/README.md
+++ b/tools/re-capture/README.md
@@ -33,3 +33,30 @@ Findings produced with these: [`docs/re/weapon-datasheet-runtime.md`](../../docs
 
 Snapshot first — `cp --sparse=always /dev/shm/xenia_memory_* snap.bin` (~2 s) — and
 point `$GMEM_FILE` at the copy; the running emulator pegs every core under lavapipe.
+
+## 🔴 `pgrep -f` / `pkill -f` match YOUR OWN shell
+
+An agent driving this toolkit runs its commands through a wrapper shell whose
+**command line contains the pattern being searched for**. So
+
+```bash
+pgrep -f 'pilot\.py'        # matches the wrapper running this very command
+pkill -f 'fly_session|pilot\.py'   # kills that wrapper — the script dies mid-way
+```
+
+This has cost four separate mistakes in one session: two scripts killed
+mid-execution, and twice a "is it already running?" guard that answered *yes*
+because it had found itself. The `[p]ilot` bracket trick does **not** help when
+the literal invocation (`python3 pilot.py …`) also appears on the wrapper's
+command line.
+
+What works:
+
+```bash
+pgrep -x xenia_canary                       # exact NAME match, no -f
+ps -eo pid,args | grep 'python3 pilot.py' | grep -v snapshot-bash
+kill -9 <explicit pid>                      # look it up first, then kill by pid
+```
+
+The `snapshot-bash` filter is the reliable tell: the wrapper's command line
+always contains the shell-snapshot path.