diff --git a/docs/re/title-crash-stl-tree.md b/docs/re/title-crash-stl-tree.md
index 138085d8..a8566ac8 100644
--- a/docs/re/title-crash-stl-tree.md
+++ b/docs/re/title-crash-stl-tree.md
@@ -189,3 +189,36 @@ bisection plan in the handoff is written as "one build + one Ready-Room run" per
 suspect. If this title-screen crash is the same defect, each suspect costs **40
 seconds** instead, and suspect #1 (`--mem_watch=false`) is already measured here:
 it removes the crash.
+
+## It also fires on the way into a mission — which is what blocks the ship capture
+
+**2026-08-19.** Driving the game toward a mission for the second capital-ship
+capture (`tutorial_launch.sh`: boot → title → Ⓐ → main menu → two d-pad steps →
+Ⓐ) reaches two screens nobody had captured, and then dies:
+
+```
+main menu → DIFFICULTY (EASY / NORMAL / HARD / BACK)   captures/difficulty-screen.png
+          → SELECT DATA (save slots, "Current Storage: Dummy HDD")
+          → CRASH: PC 0x82307128, guest thread 9, 537 stacked dumps
+                                                   captures/select-data-crash.png
+```
+
+`0x82307128` is the **same** `std::map`/`set` erase as the boot-time throw. So
+the cache-flush defect is not a boot curiosity: it fires again when the game
+enumerates save data on the way into every mission, and it paused the emulator
+for good — dismissing one dialog only reveals the next of 537.
+
+Three things this pins:
+
+* **The blocker for the second capital-ship capture is this crash, not
+  navigation.** Navigation works; the game gets as far as the save-slot screen
+  and dies there. `BACKLOG`'s ship item should be read that way.
+* **`mem_watch` stays eliminated**: this run had `--mem_watch=false`.
+* **The save/cache path is the common factor** across both firings — the
+  boot-time one followed `HostPathDevice::ResolvePath(\aab216c3\…)`, and this one
+  follows the save-slot enumeration.
+
+Not settled: whether a warm cache prevents *this* firing the way it prevents the
+boot-time one. The cache was warm here (the 6-file `aab216c3` restored earlier),
+so the answer looks like **no** — but that is one run, and the cold/warm A/B was
+only ever run against the boot-time throw.