diff --git a/.agent/skills/network-throughput/SKILL.md b/.agent/skills/network-throughput/SKILL.md
index 55a86ca..a682b05 100644
--- a/.agent/skills/network-throughput/SKILL.md
+++ b/.agent/skills/network-throughput/SKILL.md
@@ -44,6 +44,7 @@ Terminology:
 - Use one test download only. Do not run Firefox/browser downloads in parallel.
 - On FreeBSD/Clawdie, use project-local scratch directories, not system `/tmp` or `/var/tmp`.
 - On Linux/debby/Hermes, prefer `~/.local/state/hermes/net-tests/`; project-root `tmp/` is also acceptable when running inside a specific repo.
+- On Linux/debby/Hermes, root `tcpdump` may stage in `/tmp/osa-pcap-$TEST_ID` when direct writes into user-owned artifact dirs are awkward; move/chown the captures into `CLIENT_DIR` after the run.
 - On FreeBSD, run root commands in the visible tmux root window when one is available.
 - Do not leave large pcaps or duplicate downloaded images behind after analysis.
 - Do not change PF during the measurement unless the purpose of the test is explicitly PF comparison.
@@ -181,7 +182,7 @@ sudo /usr/bin/timeout 900 tcpdump -ni "$CLIENT_IF" \
 Staged form, if root tcpdump cannot write directly to `CLIENT_DIR`:
 
 ```sh
-CAPTURE_TMP="$HOME/.local/state/hermes/net-tests/root-pcap-staging-$TEST_ID"
+CAPTURE_TMP="/tmp/osa-pcap-$TEST_ID"
 mkdir -p "$CAPTURE_TMP"
 date -u '+client_pcap_start_utc=%Y-%m-%dT%H:%M:%SZ' | tee -a "$CLIENT_DIR/timestamps.txt"
 sudo /usr/bin/timeout 900 tcpdump -ni "$CLIENT_IF" \