diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index d5b3f0e..32e1cd8 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -461,8 +461,20 @@ search cannot find a *schedule*.
   clean past 200 s. A large probability improvement, **not a fix**. Practical
   rule: run, check the witness, discard frozen runs (**3 clean of 5** now: clean
   210/240/300, frozen 60/90).
-* 🚧 **BLOCKER (2026-08-24): route entries t=210 and t=240 are UNREACHABLE in one
-  turn.** 595 s shell cap − ~220 s boot (a ~190 s title movie that cannot be
+* ✅ **BLOCKER REMOVED (2026-08-24): the emulator survives BETWEEN Bash calls in
+  a turn** (checked: 611 s elapsed, still running after the launching call
+  returned), so observation is not capped by one call.
+  `tools/re-capture/attach_session.sh` attaches pilot+probe to a live mission and
+  attaches CHAIN. Cumulative **435 s verified-live on one mission** (300 s clean +
+  135 s of an attach before it froze), craft **300→258** (42 destroyed),
+  **0 confirmed arrivals** — covering route entries t=90/120/170/**210**; t=240
+  missed by one second. 🟡 Coverage assumes the 55 % wall→game factor; the witness
+  has measured 8–24/s across runs, and at the low end the same window covers only
+  ~117 game-s (t=90 only). **Pinning the tick rate would make this sharp.**
+  🔴 `SYLPH_HZ=3` refuted as a lever: it gave the LOWEST frame rate (8/s) with the
+  most kills, so pilot polling is not the throttle.
+* ~~🚧 BLOCKER: t=210/240 unreachable in one turn~~ — **superseded, see above**;
+  it rested on an untested assumption that a turn is one shell call. 595 s shell cap − ~220 s boot (a ~190 s title movie that cannot be
   tapped through) − ~25 s startup = **~350 s observation ≈ 193 game-seconds**.
   t=90 needs 164 s wall ✅, t=120 → 218 s ✅, t=170 → 309 s ✅ (only on a
   non-frozen run), **t=210 → 382 s ❌, t=240 → 436 s ❌**. No number of runs fixes
diff --git a/docs/re/mission-arrival-watch.md b/docs/re/mission-arrival-watch.md
index 31e15e0..3477abc 100644
--- a/docs/re/mission-arrival-watch.md
+++ b/docs/re/mission-arrival-watch.md
@@ -434,3 +434,63 @@ frozen), lower than the 3-of-4 quoted last iteration.
 **0 confirmed arrivals over 300 s of verified-live flight (~165 game-seconds)**,
 covering the t = 90 and t = 120 route entries. That is unchanged, and it is the
 strongest statement this harness can currently support.
+
+---
+
+# ✅ BLOCKER REMOVED: the emulator survives between calls (2026-08-24)
+
+The previous entry declared t = 210 and t = 240 unreachable because a shell call
+is capped at 595 s. **That was wrong, and it rested on an assumption I never
+tested:** `launch_mission.sh` leaves the emulator running, and it survives
+*between* Bash calls within a turn — checked directly, 611 s elapsed and still
+running after the launching call had returned.
+
+So observation is not capped by one call. `tools/re-capture/attach_session.sh`
+attaches a pilot and probe to an already-running mission, and attaches can be
+chained.
+
+## The result on one continuous mission
+
+| segment | window | stalls |
+|---|---|---|
+| initial run | 300 s | none |
+| attach | 540 s, first stall at t = 135 s | frozen after |
+
+**Cumulative verified-live: 435 s of wall-clock**, during which the craft
+population fell **300 → 258** (42 destroyed) and `deployed` fell 41 → 38.
+
+```
+TOTAL candidate-up=0 down=8 CONFIRMED arrivals=0
+```
+
+**0 confirmed arrivals**, across the longest verified-live observation yet.
+
+| route entry | wall needed | covered? |
+|---|---|---|
+| t = 90 | 164 s | ✅ |
+| t = 120 | 218 s | ✅ |
+| t = 170 | 309 s | ✅ |
+| **t = 210** | **382 s** | ✅ |
+| t = 240 | 436 s | ✗ (one second short) |
+
+Four of five phase-1 arrival times passed with nothing arriving while 42 craft
+were destroyed.
+
+## 🟡 The coverage claim is sensitive to an assumption
+
+The wall→game conversion uses 55 %, from a ~16.5 /s frame rate against an assumed
+30 Hz tick. But the witness has measured **8, 11, 11, 21 and 24 /s** across runs —
+a 3× spread. At the low end the factor is 0.27, and the same 435 s covers only
+~117 game-seconds, which would reach **t = 90 only**.
+
+So the honest statement is: **nothing arrived in 435 s of verified-live Stage 02
+phase-1 flight with 42 kills**, which covers the first four route entries *if*
+the game runs at ~55 % of real-time and only the first *if* it runs at the
+slowest rate observed. Pinning the tick rate is now the thing that would make
+this result sharp.
+
+## 🔴 Refuted: the pilot's poll rate is not what limits frame rate
+
+`SYLPH_HZ=3` (down from 8) produced the **lowest** calibrated rate of any run,
+8 /s, alongside the most kills (26). So the pilot's polling is not the throttle,
+and lowering it is not a way to buy game time. n = 1.
diff --git a/tools/re-capture/attach_session.sh b/tools/re-capture/attach_session.sh
new file mode 100755
index 0000000..5718585
--- /dev/null
+++ b/tools/re-capture/attach_session.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Attach to an ALREADY-RUNNING mission. launch_mission.sh leaves the emulator
+# running and it survives between Bash calls within a turn, so observation is no
+# longer capped by one call's timeout -- chain attaches to extend the window.
+set -u
+export HOME=/sylph-home/re SDL_AUDIODRIVER=dummy DISPLAY=:98
+export PYTHONPATH=/sylph-home/.local/lib/python3.12/site-packages
+SD="$(cd "$(dirname "$0")" && pwd)"
+SECS="${1:-540}"; EVERY="${2:-15}"
+CFG=/tmp/nav-attach.json
+pgrep -x xenia_canary >/dev/null || { echo "NO EMULATOR RUNNING"; exit 1; }
+PILOT=""
+for try in 1 2 3; do
+  python3 "$SD/pad.py" set "rt=1" >/dev/null 2>&1 || true
+  sleep 3
+  python3 "$SD/pad.py" clear >/dev/null 2>&1 || true
+  if python3 "$SD/entities2.py" self 0x130 "$CFG" >/dev/null 2>&1; then
+    SYLPH_HUNT=1 SYLPH_KILL_TURRETS=1 SYLPH_KEEPOUT=1400 \
+      nohup python3 "$SD/pilot.py" "$CFG" "$SECS" </dev/null >/tmp/attach-pilot.log 2>&1 &
+    PILOT=$!; echo "--- pilot re-attached"; break
+  fi
+  echo "--- bind attempt $try failed"
+done
+[ -z "$PILOT" ] && echo "--- no pilot; observing unattended (still valid for the clock model)"
+python3 "$SD/wave7_probe.py" "$SECS" "$EVERY"; rc=$?
+[ -n "$PILOT" ] && kill "$PILOT" 2>/dev/null
+echo "ATTACH DONE rc=$rc"
diff --git a/tools/re-capture/pilot.py b/tools/re-capture/pilot.py
index d1e9c48..dd4bcda 100644
--- a/tools/re-capture/pilot.py
+++ b/tools/re-capture/pilot.py
@@ -131,7 +131,11 @@ class Pilot:
         "SYLPH_KEEPOUT", "1400" if HUNT else "2500"))
     EVADE_QUIET = 5.0         # seconds without damage before re-engaging
     RETIRE_FRAC = 0.30        # hull fraction that sends us home
-    HZ = 8.0
+    # Poll rate. The pilot re-scans entity state every tick, and under lavapipe
+    # that competes with the emulator for cores -- the same effect that made the
+    # memory probe stall the guest. Tunable so its cost can be measured against
+    # the achieved frame rate, which sets how much GAME time a turn can observe.
+    HZ = float(os.environ.get("SYLPH_HZ", "8.0"))
     # --- escort ---
     ASSET_GUARD = 9000.0      # hostiles this close to the asset count as its attackers
     ASSET_QUIET = 20.0        # s of no asset damage before dropping out of DEFEND
diff --git a/tools/re-capture/wave7_session.sh b/tools/re-capture/wave7_session.sh
index ec495a6..e100655 100755
--- a/tools/re-capture/wave7_session.sh
+++ b/tools/re-capture/wave7_session.sh
@@ -22,7 +22,7 @@ for try in 1 2 3; do
   echo "--- bind attempt $try failed, retrying"; sleep 5
 done
 if [ "$BOUND" = 1 ]; then
-  SYLPH_HUNT="$HUNT" SYLPH_KILL_TURRETS=1 SYLPH_KEEPOUT="${SYLPH_KEEPOUT:-1400}" nohup python3 "$SD/pilot.py" "$CFG" "$SECS" \
+  SYLPH_HUNT="$HUNT" SYLPH_KILL_TURRETS=1 SYLPH_KEEPOUT="${SYLPH_KEEPOUT:-1400}" SYLPH_HZ="${SYLPH_HZ:-8.0}" nohup python3 "$SD/pilot.py" "$CFG" "$SECS" \
       </dev/null >/tmp/live-pilot.log 2>&1 &
   PILOT=$!; echo "--- pilot (SYLPH_HUNT=$HUNT)"
 else echo "BIND FAILED after 3 attempts -- aborting, an unattended run tests nothing"; exit 4; fi