From 2ce19e7075fb8bd8f95f3917e729322ea11262e4 Mon Sep 17 00:00:00 2001
From: Jean-Pierre Bergamin <james@ractive.ch>
Date: Tue, 11 Aug 2026 14:51:16 +0200
Subject: [PATCH 1/4] =?UTF-8?q?feat(iter-142):=20session=20hygiene=20?=
 =?UTF-8?q?=E2=80=94=20daemon=20stop=20pid=20honesty,=20disk=20GC,=20eval?=
 =?UTF-8?q?=20ASI=20fix,=20wait=20sleep?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root-causes the daemon-stop false-negative (dogfooding session 63, 3/3
reproducible) to launch-record.json being a single global file clobbered by
concurrent launches on different ports; scopes it per port and makes the
proxy-registry fallback path kill the real Firefox pid instead of the
daemon's own. Adds immediate (age-independent) reclamation of dead-owner
temp profiles, GC for stale throttle-state files, and GC for the legacy
port-less spawn lock. Fixes eval's async-IIFE wrapper to detect
ASI-separated statement boundaries (not just `;`) and to auto-return a
trailing bare expression instead of silently dropping it as undefined.
Adds `wait --sleep-ms` (with a `--time` legacy alias) as a plain-delay form
that skips the Firefox connection entirely.

Defers Theme C (auto-consent honesty + BBC CMP coverage), Theme D
(full-page screenshot header dedup), and the console-locale item to
iteration-144 — see that plan's "why these were deferred" section.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/ff-rdp-cli/src/cli/args.rs             |  32 +-
 crates/ff-rdp-cli/src/commands/eval.rs        | 323 ++++++++++++++++--
 crates/ff-rdp-cli/src/commands/launch.rs      |  15 +
 crates/ff-rdp-cli/src/commands/wait.rs        |  67 +++-
 crates/ff-rdp-cli/src/daemon/client.rs        |  65 +++-
 crates/ff-rdp-cli/src/daemon/registry.rs      |  99 ++++++
 .../ff-rdp-cli/src/daemon/throttle_state.rs   | 130 +++++++
 crates/ff-rdp-cli/src/daemon_record.rs        | 150 ++++++--
 crates/ff-rdp-cli/src/dispatch.rs             |   2 +
 crates/ff-rdp-cli/src/script/runner.rs        |   4 +
 crates/ff-rdp-cli/src/util/profile_dir.rs     |  75 +++-
 crates/ff-rdp-cli/tests/e2e/eval.rs           |  46 +++
 crates/ff-rdp-cli/tests/e2e/wait.rs           |  93 +++++
 .../live/live_142_daemon_stop_pid_honesty.rs  | 139 ++++++++
 .../tests/live/live_142_disk_growth.rs        | 243 +++++++++++++
 .../tests/live/live_142_eval_asi_await.rs     |  69 ++++
 crates/ff-rdp-cli/tests/live/main.rs          |   3 +
 .../iteration-142-session-hygiene.md          |  60 +++-
 .../iteration-144-session-hygiene-followup.md | 114 +++++++
 19 files changed, 1627 insertions(+), 102 deletions(-)
 create mode 100644 crates/ff-rdp-cli/tests/live/live_142_daemon_stop_pid_honesty.rs
 create mode 100644 crates/ff-rdp-cli/tests/live/live_142_disk_growth.rs
 create mode 100644 crates/ff-rdp-cli/tests/live/live_142_eval_asi_await.rs
 create mode 100644 kb/iterations/iteration-144-session-hygiene-followup.md

diff --git a/crates/ff-rdp-cli/src/cli/args.rs b/crates/ff-rdp-cli/src/cli/args.rs
index 740ed7a..e01bd36 100644
--- a/crates/ff-rdp-cli/src/cli/args.rs
+++ b/crates/ff-rdp-cli/src/cli/args.rs
@@ -742,16 +742,24 @@ other. On success, the output gains {\"match_count\": N, \"chosen_index\": N}.
 
 Output: {\"results\": {\"typed\": true, \"tag\": \"INPUT\", \"value\": \"...\"}, \"total\": 1, \"meta\": {...}}")]
     Type(TypeArgs),
-    /// Wait for a condition to become true (polls every 100ms).
-    /// Exactly one of --selector, --text, --eval, or --ref must be specified.
-    #[command(long_about = "Wait for a condition to become true (polls every 100ms).
+    /// Wait for a condition to become true (polls every 100ms), or sleep for a fixed duration.
+    /// Exactly one of --selector, --text, --eval, --ref, or --sleep-ms must be specified.
+    #[command(
+        long_about = "Wait for a condition to become true (polls every 100ms), or sleep for a fixed duration.
 
-Exactly one of --selector, --text, --eval, or --ref must be specified.
+Exactly one of --selector, --text, --eval, --ref, or --sleep-ms must be specified.
 
 Use --ref <id> to wait for an element identified by its ARIA-tree ref ID
 (daemon mode only). Equivalent to --selector but uses a stable ref handle.
 
-Output: {\"results\": {\"matched\": true, \"elapsed_ms\": N, \"condition\": \"selector|text|eval\"}, \"total\": 1, \"meta\": {...}}")]
+Use --sleep-ms <N> for a plain delay with no condition and no Firefox
+connection at all — e.g. `ff-rdp wait --sleep-ms 2000`. Prefer a real
+condition (--selector/--text/--eval/--ref) whenever one exists; a fixed
+sleep is always a guess about how long something takes. --timeout-ms does
+not apply to --sleep-ms, which always runs for exactly its own duration.
+
+Output: {\"results\": {\"matched\": true, \"elapsed_ms\": N, \"condition\": \"selector|text|eval|sleep\"}, \"total\": 1, \"meta\": {...}}"
+    )]
     Wait(WaitArgs),
     /// List cookies via the Firefox StorageActor (includes httpOnly, secure, sameSite, etc.)
     #[command(
@@ -1695,8 +1703,22 @@ pub struct WaitArgs {
     /// ARIA-tree ref ID from a previous dom/snapshot call (daemon mode only, e.g. 'e3')
     #[arg(long = "ref", value_name = "REF_ID", group = "condition")]
     pub ref_id: Option<String>,
+    /// Plain sleep for this many milliseconds — no condition, no Firefox
+    /// connection, just a delay. For when you need to pace commands rather
+    /// than wait for a specific page state (use --selector/--text/--eval/--ref
+    /// instead whenever a real condition exists — a fixed sleep is always a
+    /// guess). The legacy spelling `--time` is also accepted as a hidden
+    /// alias (iter-142: this was the flag dogfooders reached for first).
+    #[arg(
+        long = "sleep-ms",
+        alias = "time",
+        value_name = "MS",
+        group = "condition"
+    )]
+    pub sleep_ms: Option<u64>,
     /// Timeout in milliseconds before giving up (canonical flag — use this one).
     /// The legacy spelling `--wait-timeout` is also accepted as a hidden alias.
+    /// Not used by --sleep-ms, which always runs for exactly its own duration.
     #[arg(long = "timeout-ms", alias = "wait-timeout", default_value_t = 5000)]
     pub wait_timeout: u64,
 }
diff --git a/crates/ff-rdp-cli/src/commands/eval.rs b/crates/ff-rdp-cli/src/commands/eval.rs
index f15e07c..a04fb37 100644
--- a/crates/ff-rdp-cli/src/commands/eval.rs
+++ b/crates/ff-rdp-cli/src/commands/eval.rs
@@ -104,6 +104,17 @@ pub(crate) fn load_script(
 /// `evaluateJSAsync` already knows how to await. `eval_path` stays
 /// `"page-await"` either way; from the caller's perspective only the
 /// previously-broken await scripts start working, nothing else changes.
+///
+/// iter-142 Theme E fixed two follow-on defects in the same wrap: (1) the
+/// single-vs-multi-statement heuristic (used to decide whether the wrap
+/// synthesizes a `return`) only recognized `;` as a statement separator, so
+/// an ASI-separated (newline-only) multi-statement script like
+/// `await Promise.resolve(1)\n42` was misclassified as one expression and
+/// wrapped into invalid JS — a syntax error reported past the end of the
+/// user's input; (2) even when correctly classified as multi-statement, the
+/// wrap never returned anything, so a trailing bare expression silently
+/// became `{"type":"undefined"}` instead of its real value. See
+/// [`top_level_statement_boundaries`] and [`wrap_top_level_await`].
 pub(crate) fn build_script(user_script: &str, stringify: bool, _isolate: bool) -> String {
     // The stringify helper: if the value is already a string, return it as-is;
     // otherwise JSON.stringify it. This prevents double-encoding when the JS
@@ -148,13 +159,15 @@ const STATEMENT_LEADING_KEYWORDS: &[&str] = &[
 /// Best-effort (not a JS parser) check for whether `script` is a single
 /// expression, safe to wrap as `return (<script>)` without a syntax error.
 ///
-/// Two simplifications, both fail *safe* (degrade to the no-auto-return
-/// wrap path in [`wrap_top_level_await`], which still evaluates — it just
-/// won't surface a value unless the script has an explicit `return`):
+/// Simplifications, all fail *safe* (degrade to the no-auto-return wrap
+/// path in [`wrap_top_level_await`], which still evaluates — it just won't
+/// surface a value unless the script has an explicit `return`):
 ///
-/// - A `;` inside a string/template literal (e.g. `await foo("a;b")`) is
-///   indistinguishable here from a real statement separator, so such
-///   scripts are treated as multi-statement even though they are not.
+/// - A `;`/newline inside a string/template literal is tracked (see
+///   [`top_level_statement_boundaries`]) so those don't false-positive as
+///   statement separators, but the tracking is char-based, not a real
+///   tokenizer — it does not understand regex literals or escaped quotes,
+///   so a regex containing `;`/newline-adjacent punctuation could misfire.
 /// - Only a fixed, common prefix list is checked against statement-leading
 ///   keywords; more obscure statement forms (labelled statements, etc.)
 ///   are not recognized and would be (harmlessly) treated as expressions,
@@ -169,12 +182,160 @@ fn looks_like_single_expression(script: &str) -> bool {
     if body.is_empty() {
         return false;
     }
-    !body.contains(';')
+    !looks_like_multi_statement(body)
         && !STATEMENT_LEADING_KEYWORDS
             .iter()
             .any(|kw| body_starts_with_keyword(body, kw))
 }
 
+/// Whether `c` can end a complete JS statement/expression on its own —
+/// identifiers, numbers, closing brackets, and string terminators all
+/// qualify. Used by [`top_level_statement_boundaries`] to judge whether a
+/// newline might be an Automatic Semicolon Insertion (ASI) boundary.
+fn is_statement_end_char(c: char) -> bool {
+    c.is_ascii_alphanumeric()
+        || c == '_'
+        || c == '$'
+        || matches!(c, ')' | ']' | '}' | '\'' | '"' | '`')
+}
+
+/// Whether `c` can only appear as a *continuation* of the previous line's
+/// expression — a binary operator, member-access `.`, comma, or another
+/// closing/continuation character. Seeing one of these as the first
+/// character on a new line means the preceding newline is NOT an ASI
+/// boundary (real JS ASI famously glues a leading `.`/`+`/`-`/etc. onto the
+/// previous statement rather than inserting a semicolon).
+fn is_continuation_start_char(c: char) -> bool {
+    matches!(
+        c,
+        '.' | ')'
+            | ']'
+            | '}'
+            | ','
+            | '+'
+            | '-'
+            | '*'
+            | '/'
+            | '%'
+            | '<'
+            | '>'
+            | '='
+            | '!'
+            | '&'
+            | '|'
+            | '^'
+            | '?'
+            | ':'
+            | ';'
+    )
+}
+
+/// Scan `body` (best-effort — see [`looks_like_single_expression`]'s doc
+/// comment for the acknowledged gaps) and return, in order, the byte
+/// offsets where a new top-level JS statement appears to begin: one past
+/// each top-level `;`, or the first non-whitespace character after each
+/// top-level newline that looks like an ASI boundary
+/// ([`is_statement_end_char`] before it, NOT [`is_continuation_start_char`]
+/// after).
+///
+/// iter-142 Theme E: the pre-existing `;`-only check missed ASI-separated
+/// statements entirely — `await Promise.resolve(1)\n42` has no `;` at all,
+/// so it was misclassified as a single expression and wrapped as
+/// `return (\nawait Promise.resolve(1)\n42\n)`, which is itself a syntax
+/// error (`missing ) in parenthetical`) pointing past the end of the user's
+/// input. Newlines are now a statement-separator signal too, gated by
+/// [`is_statement_end_char`]/[`is_continuation_start_char`] so common
+/// multi-line *single*-expression styles (method chains starting each
+/// continuation line with `.`) are not misclassified as multi-statement.
+///
+/// Tracks single/double-quote and template-literal string state (a `;` or
+/// newline *inside* a string is never mistaken for a separator — the old
+/// `;`-only check did not do this either) and `(`/`[`/`{` nesting depth (a
+/// multi-line object/array literal or argument list is never split).
+fn top_level_statement_boundaries(body: &str) -> Vec<usize> {
+    #[derive(Clone, Copy, PartialEq)]
+    enum Str {
+        None,
+        Single,
+        Double,
+        Template,
+    }
+
+    let mut boundaries = Vec::new();
+    let mut state = Str::None;
+    let mut depth: i32 = 0;
+    let mut prev_significant: Option<char> = None;
+    let chars: Vec<(usize, char)> = body.char_indices().collect();
+    let n = chars.len();
+    let mut i = 0;
+
+    while i < n {
+        let (byte_idx, c) = chars[i];
+        match state {
+            Str::Single => {
+                if c == '\'' {
+                    state = Str::None;
+                    prev_significant = Some(c);
+                }
+                i += 1;
+                continue;
+            }
+            Str::Double => {
+                if c == '"' {
+                    state = Str::None;
+                    prev_significant = Some(c);
+                }
+                i += 1;
+                continue;
+            }
+            Str::Template => {
+                if c == '`' {
+                    state = Str::None;
+                    prev_significant = Some(c);
+                }
+                i += 1;
+                continue;
+            }
+            Str::None => {}
+        }
+
+        match c {
+            '\'' => state = Str::Single,
+            '"' => state = Str::Double,
+            '`' => state = Str::Template,
+            '(' | '[' | '{' => depth += 1,
+            ')' | ']' | '}' => depth = depth.saturating_sub(1),
+            ';' if depth == 0 => boundaries.push(byte_idx + c.len_utf8()),
+            '\n' if depth == 0 => {
+                let mut j = i + 1;
+                while j < n && chars[j].1.is_whitespace() {
+                    j += 1;
+                }
+                if let (Some(prev), Some(&(next_byte, next))) = (prev_significant, chars.get(j))
+                    && is_statement_end_char(prev)
+                    && !is_continuation_start_char(next)
+                {
+                    boundaries.push(next_byte);
+                }
+            }
+            _ => {}
+        }
+
+        if depth == 0 && state == Str::None && !c.is_whitespace() {
+            prev_significant = Some(c);
+        }
+        i += 1;
+    }
+
+    boundaries
+}
+
+/// Whether `body` looks like more than one top-level JS statement — see
+/// [`top_level_statement_boundaries`].
+fn looks_like_multi_statement(body: &str) -> bool {
+    !top_level_statement_boundaries(body).is_empty()
+}
+
 /// Whether `body` starts with the statement-leading keyword `kw`, at a real
 /// word boundary rather than as a bare substring prefix.
 ///
@@ -234,19 +395,47 @@ fn contains_await_keyword(script: &str) -> bool {
 /// (see [`build_script`]'s "Top-level `await`" doc section).
 ///
 /// When `base` is a single expression, the wrap preserves the pre-await
-/// completion-value contract exactly: `return (<base>)`. When it is not
-/// (multiple statements), the raw statements run as the function body with
-/// no implicit return — any explicit `return` inside now works (it would
-/// have been a `SyntaxError: Illegal return statement` in top-level script
-/// context), but a script relying on completion-value auto-return of its
-/// last expression gets `undefined` instead. That is strictly better than
-/// the pre-fix behavior (a `SyntaxError` on the `await` token itself).
+/// completion-value contract exactly: `return (<base>)`.
+///
+/// When it is not (multiple statements), a function body has no
+/// script-style completion-value semantics — only an explicit `return`
+/// inside it produces a value, so the naive wrap (all statements verbatim,
+/// no synthesized `return`) silently turned a trailing expression into
+/// `undefined` even though the exact same statements evaluated directly (no
+/// `await`, no wrap) would have surfaced it as the completion value. This
+/// was flagged as the worst failure mode in Theme E: an agent gets
+/// `{"type":"undefined"}` with no indication anything went wrong.
+///
+/// iter-142 fix: if the *last* top-level statement
+/// ([`top_level_statement_boundaries`]) is itself a bare expression, split
+/// it off and wrap only that part in `return (…)` — every earlier statement
+/// still runs unwrapped, so an explicit `return` earlier in the script (a
+/// `SyntaxError: Illegal return statement` in top-level script context, so
+/// this only appears in scripts that already relied on the `await` wrap)
+/// keeps working exactly as before. When the last statement is NOT a bare
+/// expression (a declaration, a control-flow construct, an explicit
+/// `return` a user already wrote), there is nothing safe to auto-return —
+/// the wrap falls back to the no-auto-return form, same as before this
+/// iteration.
 fn wrap_top_level_await(base: &str, base_is_single_expression: bool) -> String {
     if base_is_single_expression {
-        format!("(async function(){{return (\n{base}\n);}})()")
-    } else {
-        format!("(async function(){{\n{base}\n}})()")
+        return format!("(async function(){{return (\n{base}\n);}})()");
     }
+
+    if let Some(split_at) = top_level_statement_boundaries(base).last().copied() {
+        let prefix = base[..split_at].trim_end();
+        let last = base[split_at..].trim();
+        if !last.is_empty() && looks_like_single_expression(last) {
+            let last_expr = last.strip_suffix(';').unwrap_or(last).trim();
+            return if prefix.is_empty() {
+                format!("(async function(){{return (\n{last_expr}\n);}})()")
+            } else {
+                format!("(async function(){{\n{prefix}\nreturn (\n{last_expr}\n);}})()")
+            };
+        }
+    }
+
+    format!("(async function(){{\n{base}\n}})()")
 }
 
 /// Build the final JavaScript source, exposed for use by the script runner.
@@ -777,20 +966,110 @@ mod tests {
         assert!(!s.contains("eval("), "must not contain eval(): {s}");
     }
 
-    /// A multi-statement script with top-level await must still evaluate
-    /// (no SyntaxError) even though it forgoes the auto-return optimization.
+    /// iter-142 Theme E: a multi-statement script with top-level `await`
+    /// whose *last* statement is a bare expression now has that trailing
+    /// expression auto-returned — matching the non-await path's native
+    /// eval-completion-value semantics — instead of silently discarding it
+    /// as `undefined` (the "worst failure mode" flagged in the iteration
+    /// plan). The earlier statement (`let x = await foo();`) still runs
+    /// unwrapped, ahead of the synthesized `return`.
     #[test]
-    fn build_script_wraps_top_level_await_multi_statement_no_auto_return() {
+    fn build_script_wraps_top_level_await_multi_statement_honors_trailing_expression() {
         let s = build_script("let x = await foo(); x + 1", false, false);
         assert!(
             s.starts_with("(async function(){"),
             "expected async-IIFE wrap, got: {s}"
         );
-        assert!(!s.contains("return ("), "must not force a return: {s}");
-        assert!(s.contains("let x = await foo(); x + 1"));
+        assert!(
+            s.contains("let x = await foo();"),
+            "earlier statement must still run: {s}"
+        );
+        assert!(
+            s.contains("return (\nx + 1\n)"),
+            "trailing bare expression must be auto-returned: {s}"
+        );
+        assert!(!s.contains("eval("), "must not contain eval(): {s}");
+    }
+
+    /// When the last statement is NOT a bare expression (here: a
+    /// declaration with no completion value of its own), there is nothing
+    /// safe to auto-return — the wrap must fall back to the no-auto-return
+    /// form rather than guessing.
+    #[test]
+    fn build_script_wraps_top_level_await_multi_statement_no_auto_return_for_declaration_tail() {
+        let s = build_script("await foo(); let x = 1", false, false);
+        assert!(
+            s.starts_with("(async function(){"),
+            "expected async-IIFE wrap, got: {s}"
+        );
+        assert!(
+            !s.contains("return ("),
+            "a trailing declaration has no completion value to auto-return: {s}"
+        );
+        assert!(s.contains("await foo(); let x = 1"));
         assert!(!s.contains("eval("), "must not contain eval(): {s}");
     }
 
+    /// AC `e2e_eval_asi_await_script` (unit half — the exact dogfooding
+    /// session 63 repro): an ASI-separated (no `;` at all) two-line script
+    /// must not leak the async-IIFE wrapper as a syntax error pointing past
+    /// the end of the user's input, AND the trailing expression's value
+    /// must be honored (not silently `undefined`) — both symptoms shared
+    /// the same root cause (see `top_level_statement_boundaries`'s doc
+    /// comment).
+    #[test]
+    fn build_script_asi_separated_await_script_wraps_without_leaking_and_returns_tail() {
+        let s = build_script("await Promise.resolve(1)\n42", false, false);
+        assert!(
+            s.starts_with("(async function(){"),
+            "expected async-IIFE wrap, got: {s}"
+        );
+        assert!(
+            s.contains("await Promise.resolve(1)"),
+            "the await statement must still run: {s}"
+        );
+        assert!(
+            s.contains("return (\n42\n)"),
+            "the ASI-separated trailing expression must be auto-returned: {s}"
+        );
+        // The old bug wrapped the whole two-line body as a single
+        // `return (…)` expression, which is itself invalid JS — assert the
+        // await statement is NOT inside the returned parenthetical.
+        assert!(
+            !s.contains("return (\nawait Promise.resolve(1)\n42\n)"),
+            "must not reproduce the pre-fix leaky wrap: {s}"
+        );
+        assert!(!s.contains("eval("), "must not contain eval(): {s}");
+    }
+
+    /// `looks_like_multi_statement` (via `looks_like_single_expression`)
+    /// must recognize ASI-separated statements even with zero `;`
+    /// characters anywhere in the script.
+    #[test]
+    fn looks_like_single_expression_rejects_asi_separated_statements() {
+        assert!(!looks_like_single_expression(
+            "await Promise.resolve(1)\n42"
+        ));
+        assert!(!looks_like_single_expression("foo()\nbar()"));
+    }
+
+    /// A common legitimate multi-line style — a method chain whose
+    /// continuation lines start with `.` — must still be recognized as a
+    /// single expression, not misclassified as ASI-separated statements.
+    #[test]
+    fn looks_like_single_expression_accepts_multiline_method_chain() {
+        assert!(looks_like_single_expression(
+            "document\n  .querySelector('a')\n  .click()"
+        ));
+    }
+
+    /// A multi-line object literal (newlines inside `{}`/`()` at non-zero
+    /// bracket depth) must not be split into fake statements.
+    #[test]
+    fn looks_like_single_expression_accepts_multiline_object_literal() {
+        assert!(looks_like_single_expression("({\n  a: 1,\n  b: 2\n})"));
+    }
+
     /// Scripts without `await` must be completely unaffected by the new
     /// wrap logic (no behavior change for the common case).
     #[test]
diff --git a/crates/ff-rdp-cli/src/commands/launch.rs b/crates/ff-rdp-cli/src/commands/launch.rs
index 26b6aaa..568ed93 100644
--- a/crates/ff-rdp-cli/src/commands/launch.rs
+++ b/crates/ff-rdp-cli/src/commands/launch.rs
@@ -441,6 +441,21 @@ pub fn run(
     let port = debug_port.unwrap_or(cli.port);
     let host = &cli.host;
 
+    // iter-142 Theme B: opportunistically sweep `~/.ff-rdp/` housekeeping
+    // files on every `launch`, not just the rare daemon-autostart path
+    // (`resolve_connection_target`'s spawn branch, which only runs when no
+    // daemon is already up for the target port). Dogfooding session 63
+    // observed stale spawn locks and throttle-state files accumulate for
+    // exactly this reason: a session that reuses an already-running daemon
+    // across every command never takes the spawn path at all, so the
+    // existing iter-132 sweep never fires. `launch` is the one command every
+    // session actually runs, so anchoring the sweep here gives it real
+    // coverage. Each call is independently best-effort (see their own doc
+    // comments) and must never fail or slow down the launch.
+    crate::daemon::registry::gc_stale_spawn_locks();
+    crate::daemon::registry::gc_legacy_spawn_lock();
+    crate::daemon::throttle_state::gc_stale_throttle_states();
+
     // iter-133 Theme A: parse --window-size up front so a malformed value
     // fails fast, before any port-collision check or Firefox spawn.
     let window_size: Option<(u32, u32)> = window_size
diff --git a/crates/ff-rdp-cli/src/commands/wait.rs b/crates/ff-rdp-cli/src/commands/wait.rs
index b007f8a..e3f5dfb 100644
--- a/crates/ff-rdp-cli/src/commands/wait.rs
+++ b/crates/ff-rdp-cli/src/commands/wait.rs
@@ -13,6 +13,11 @@ pub struct WaitOptions<'a> {
     pub selector: Option<&'a str>,
     pub text: Option<&'a str>,
     pub eval: Option<&'a str>,
+    /// iter-142 Theme F: a plain sleep, in milliseconds — no condition, no
+    /// Firefox connection. Mutually exclusive with `selector`/`text`/`eval`
+    /// at the CLI layer (the `condition` ArgGroup); `run_core` also treats
+    /// it as taking priority if a caller somehow sets more than one.
+    pub sleep_ms: Option<u64>,
     pub wait_timeout: u64,
 }
 
@@ -37,9 +42,21 @@ fn warn_if_timeout_alias_used() {
 ///
 /// Called by the script runner, which handles its own NDJSON output.
 pub fn run_core(cli: &Cli, opts: &WaitOptions<'_>) -> Result<serde_json::Value, AppError> {
+    // iter-142 Theme F: --sleep-ms is a plain delay — no condition to poll,
+    // no Firefox connection needed at all. Takes priority over the other
+    // fields so a caller that somehow sets both never falls through to the
+    // (meaningless, since sleep_ms doesn't describe a JS condition)
+    // condition-polling path below.
+    if let Some(ms) = opts.sleep_ms {
+        std::thread::sleep(std::time::Duration::from_millis(ms));
+        return Ok(
+            json!({"matched": true, "elapsed_ms": ms, "condition": format!("sleep={ms}ms")}),
+        );
+    }
+
     if opts.selector.is_none() && opts.text.is_none() && opts.eval.is_none() {
         return Err(AppError::User(
-            "wait: specify at least one of --selector, --text, or --eval".into(),
+            "wait: specify at least one of --selector, --text, --eval, --ref, or --sleep-ms".into(),
         ));
     }
 
@@ -144,6 +161,7 @@ mod tests {
             selector: Some("button.submit"),
             text: None,
             eval: None,
+            sleep_ms: None,
             wait_timeout: 5000,
         };
         let js = build_wait_js(&opts).unwrap();
@@ -157,6 +175,7 @@ mod tests {
             selector: None,
             text: Some("Success"),
             eval: None,
+            sleep_ms: None,
             wait_timeout: 5000,
         };
         let js = build_wait_js(&opts).unwrap();
@@ -169,12 +188,58 @@ mod tests {
             selector: None,
             text: None,
             eval: Some("document.readyState === 'complete'"),
+            sleep_ms: None,
             wait_timeout: 5000,
         };
         let js = build_wait_js(&opts).unwrap();
         assert!(js.contains("document.readyState === 'complete'"));
     }
 
+    // iter-142 Theme F: plain sleep form
+
+    /// AC `e2e_wait_sleep_form` (unit half): `run_core` with `sleep_ms` set
+    /// sleeps for approximately that duration and returns a `matched: true`
+    /// result without requiring any condition field — it must never reach
+    /// `connect_and_get_target` (which would fail with no live Firefox in a
+    /// unit test), proving the sleep path really does skip the connection.
+    #[test]
+    fn run_core_sleep_form_does_not_require_a_connection() {
+        use clap::Parser as _;
+        let cli = Cli::try_parse_from(["ff-rdp", "wait", "--sleep-ms", "5"])
+            .expect("should parse --sleep-ms 5");
+        let opts = WaitOptions {
+            selector: None,
+            text: None,
+            eval: None,
+            sleep_ms: Some(5),
+            wait_timeout: 5000,
+        };
+        let started = std::time::Instant::now();
+        let result = run_core(&cli, &opts).expect("sleep form must succeed with no connection");
+        let elapsed = started.elapsed();
+
+        assert_eq!(result["matched"], true);
+        assert_eq!(result["elapsed_ms"], 5);
+        assert!(
+            elapsed >= std::time::Duration::from_millis(5),
+            "must actually sleep for the requested duration, elapsed={elapsed:?}"
+        );
+    }
+
+    /// `--time` is accepted as a hidden legacy alias for `--sleep-ms` —
+    /// this is the exact flag name dogfooding session 63 reached for first.
+    #[test]
+    fn wait_args_time_alias_parses_as_sleep_ms() {
+        use crate::cli::args::Command;
+        use clap::Parser as _;
+        let cli = Cli::try_parse_from(["ff-rdp", "wait", "--time", "6000"])
+            .expect("should parse --time 6000");
+        let Command::Wait(args) = cli.command else {
+            panic!("expected Command::Wait");
+        };
+        assert_eq!(args.sleep_ms, Some(6000));
+    }
+
     // iter-85 Theme K-followup: deprecation warning for --timeout alias
 
     /// The deprecation message must contain the word "deprecat" (lowercase) so
diff --git a/crates/ff-rdp-cli/src/daemon/client.rs b/crates/ff-rdp-cli/src/daemon/client.rs
index 5d5569e..212efcb 100644
--- a/crates/ff-rdp-cli/src/daemon/client.rs
+++ b/crates/ff-rdp-cli/src/daemon/client.rs
@@ -939,13 +939,13 @@ pub(crate) fn run_daemon_stop(cli: &Cli, port: u16) -> Result<(), AppError> {
     //    not address. `read()` already filters out stale (dead-PID)
     //    records, so we don't need to recheck liveness here.
     // ----------------------------------------------------------------
-    match crate::daemon_record::read()
+    match crate::daemon_record::read(port)
         .map_err(|e| AppError::Internal(anyhow::anyhow!("reading daemon record: {e}")))?
     {
         Some(rec) if rec.port == port => {
             // Live instance found via DaemonRecord and matches --port — kill it.
             let (stopped, port_free, escalation_msg) = kill_pid_and_wait_port(rec.pid, rec.port);
-            crate::daemon_record::remove().ok();
+            crate::daemon_record::remove(rec.port).ok();
 
             if !port_free {
                 let msg = if escalation_msg.is_empty() {
@@ -1025,7 +1025,24 @@ pub(crate) fn run_daemon_stop(cli: &Cli, port: u16) -> Result<(), AppError> {
         return OutputPipeline::from_cli(cli)?.finalize(&envelope);
     }
 
-    // 1. Try graceful shutdown via RPC first.
+    // iter-142 Theme A: `info.pid` is the *proxy daemon's own* PID
+    // (`std::process::id()`, set in `daemon/server.rs`), not Firefox's — the
+    // daemon connects to an already-running Firefox as an RDP client, it
+    // never spawns one. Killing only `info.pid` stops the proxy but leaves
+    // Firefox (and the listening debug port callers actually care about)
+    // untouched — exactly the "port still listening" false-negative
+    // dogfooding session 63 reproduced 3/3, and the reason the error
+    // reported the daemon's PID as if it were Firefox's. Resolve the real
+    // Firefox process via the same ownership-verified port-owner lookup
+    // `stop_prior_instance` uses, so both the kill and the reported `pid`
+    // target the process that is actually holding the port.
+    let firefox_pid = crate::port_owner::find_listener(firefox_port)
+        .ok()
+        .flatten()
+        .filter(|owner| crate::util::profile_dir::pid_is_ff_rdp_spawned(owner.pid))
+        .map(|owner| owner.pid);
+
+    // 1. Try graceful shutdown via RPC first (asks the proxy daemon to exit).
     let rpc_ok = daemon_rpc(
         cli,
         firefox_port,
@@ -1047,24 +1064,35 @@ pub(crate) fn run_daemon_stop(cli: &Cli, port: u16) -> Result<(), AppError> {
         }
     }
 
-    // 2. If still alive, SIGTERM the Firefox process group (not just the daemon PID).
-    //    Firefox spawns GPU/RDD child processes in the same group; killing only the
-    //    daemon leaves those children alive and holding the port open.
+    // 2. If the proxy daemon is still alive, SIGTERM then SIGKILL it directly
+    //    — this only stops the proxy, not Firefox (see note above).
     if process::is_process_alive(info.pid) {
         process::kill_process_group(info.pid);
-        // Wait up to 2 s for the process group to exit.
         let deadline = std::time::Instant::now() + Duration::from_secs(2);
         while process::is_process_alive(info.pid) && std::time::Instant::now() < deadline {
             std::thread::sleep(Duration::from_millis(100));
         }
     }
-
-    // 3. If SIGTERM was not enough, SIGKILL the group as a last resort.
     if process::is_process_alive(info.pid) {
         process::kill_process_group_force(info.pid);
         std::thread::sleep(Duration::from_millis(300));
     }
 
+    // 3. Independently stop the actual Firefox process (if one was found and
+    //    verified as ff-rdp-owned) — this is the process actually holding
+    //    `firefox_port` open. Mirrors the SIGTERM→wait→SIGKILL ladder above.
+    if let Some(pid) = firefox_pid {
+        process::kill_process_group(pid);
+        let deadline = std::time::Instant::now() + Duration::from_secs(2);
+        while process::is_process_alive(pid) && std::time::Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(100));
+        }
+        if process::is_process_alive(pid) {
+            process::kill_process_group_force(pid);
+            std::thread::sleep(Duration::from_millis(300));
+        }
+    }
+
     // 4. Clean up the daemon registry regardless of process state.
     registry::remove_registry(firefox_port).ok();
 
@@ -1072,15 +1100,22 @@ pub(crate) fn run_daemon_stop(cli: &Cli, port: u16) -> Result<(), AppError> {
     //    (max PORT_FREE_WAIT_BOUND with SIGTERM+SIGKILL escalation on timeout).
     //    This confirms that the OS has reclaimed the socket, so a subsequent
     //    `launch` on the same port will succeed immediately without a "port in use" error.
-    let (port_free, escalation_msg) = wait_port_free_with_escalation(info.pid, firefox_port);
+    //    Escalate against the real Firefox PID when known — escalating
+    //    against the daemon PID (the pre-iter-142 behaviour) can never free
+    //    the port, since the daemon never held it.
+    let escalation_target = firefox_pid.unwrap_or(info.pid);
+    let (port_free, escalation_msg) =
+        wait_port_free_with_escalation(escalation_target, firefox_port);
 
     if !port_free {
         return Err(AppError::User(escalation_msg));
     }
 
-    let stopped = !process::is_process_alive(info.pid);
+    let daemon_stopped = !process::is_process_alive(info.pid);
+    let firefox_stopped = firefox_pid.is_none_or(|pid| !process::is_process_alive(pid));
+    let stopped = daemon_stopped && firefox_stopped;
     let meta = json!({});
-    let envelope = output::envelope(&json!({"stopped": stopped}), 1, &meta);
+    let envelope = output::envelope(&json!({"stopped": stopped, "pid": firefox_pid}), 1, &meta);
     OutputPipeline::from_cli(cli)?.finalize(&envelope)
 }
 
@@ -1095,12 +1130,12 @@ pub(crate) fn run_daemon_stop(cli: &Cli, port: u16) -> Result<(), AppError> {
 /// 3. Fall back to port-owner lookup.
 pub(crate) fn stop_prior_instance(cli: &Cli, port: u16) -> Result<(), AppError> {
     // 1. Check shared DaemonRecord first (covers instances started via `launch`).
-    match crate::daemon_record::read()
+    match crate::daemon_record::read(port)
         .map_err(|e| AppError::Internal(anyhow::anyhow!("reading daemon record: {e}")))?
     {
         Some(rec) if rec.port == port && process::is_process_alive(rec.pid) => {
             let (_stopped, port_free, _escalation_msg) = kill_pid_and_wait_port(rec.pid, rec.port);
-            crate::daemon_record::remove().ok();
+            crate::daemon_record::remove(rec.port).ok();
             if !port_free {
                 return Err(AppError::User(format!(
                     "port {port} is still in use after stopping the prior instance (pid {}). \
@@ -1112,7 +1147,7 @@ pub(crate) fn stop_prior_instance(cli: &Cli, port: u16) -> Result<(), AppError>
         }
         Some(rec) if rec.port == port => {
             // Record exists but PID is dead — clean up and proceed (port may already be free).
-            crate::daemon_record::remove().ok();
+            crate::daemon_record::remove(rec.port).ok();
         }
         _ => {}
     }
diff --git a/crates/ff-rdp-cli/src/daemon/registry.rs b/crates/ff-rdp-cli/src/daemon/registry.rs
index 12f2f49..1e1cca6 100644
--- a/crates/ff-rdp-cli/src/daemon/registry.rs
+++ b/crates/ff-rdp-cli/src/daemon/registry.rs
@@ -398,6 +398,45 @@ pub(crate) fn gc_stale_spawn_locks() {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Legacy (port-less) spawn-lock GC (iter-142 Theme B)
+// ---------------------------------------------------------------------------
+
+/// The port-less spawn-lock name a pre-iter-123 ff-rdp build wrote, before
+/// the registry was scoped per Firefox port. [`parse_spawn_lock_port`]
+/// requires a `daemon.<PORT>.spawn.lock` shape, so this exact filename can
+/// never match it and [`gc_stale_spawn_locks_in`] never touches it — it sits
+/// forever on any host that ever ran a pre-123 build (dogfooding session 63,
+/// item 30). No current build writes this file, so unlike the per-port
+/// locks there is no registry entry to consult for liveness; the
+/// `try_lock_exclusive` gate below is the only safety check available, and
+/// is sufficient — nothing in the current codebase acquires this name, so
+/// the only way the lock is exclusive-lockable-but-still-needed is if some
+/// other pre-123 process is mid-flight, which the flock check catches.
+const LEGACY_SPAWN_LOCK_FILENAME: &str = "daemon.spawn.lock";
+
+/// Remove `<dir>/daemon.spawn.lock` if present and not currently
+/// flock-held by another process. Idempotent; every error is swallowed —
+/// this is opportunistic housekeeping riding along the same path as
+/// [`gc_stale_spawn_locks_in`].
+pub(crate) fn gc_legacy_spawn_lock_in(dir: &Path) {
+    let path = dir.join(LEGACY_SPAWN_LOCK_FILENAME);
+    let Ok(file) = fs::OpenOptions::new().write(true).open(&path) else {
+        return;
+    };
+    if file.try_lock_exclusive().is_ok() {
+        let _ = fs::remove_file(&path);
+        let _ = fs2::FileExt::unlock(&file);
+    }
+}
+
+/// [`gc_legacy_spawn_lock_in`] against the real `~/.ff-rdp/` directory.
+pub(crate) fn gc_legacy_spawn_lock() {
+    if let Ok(dir) = registry_dir() {
+        gc_legacy_spawn_lock_in(&dir);
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -847,4 +886,64 @@ mod tests {
         let missing = dir.path().join("does-not-exist");
         gc_stale_spawn_locks_in(&missing);
     }
+
+    // -----------------------------------------------------------------
+    // iter-142 Theme B: legacy (port-less) spawn-lock GC
+    // -----------------------------------------------------------------
+
+    /// AC `unit_legacy_spawn_lock_collected`: the pre-iter-123 port-less
+    /// `daemon.spawn.lock` name — which `parse_spawn_lock_port` can never
+    /// match, so `gc_stale_spawn_locks_in` never touches it — is removed by
+    /// the dedicated legacy sweep.
+    #[test]
+    fn unit_legacy_spawn_lock_collected() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        fs::write(dir.path().join(LEGACY_SPAWN_LOCK_FILENAME), []).expect("write legacy lock");
+
+        // Confirm the per-port GC really does leave it alone — that's the
+        // defect this dedicated sweep exists to close.
+        gc_stale_spawn_locks_in(dir.path());
+        assert!(
+            dir.path().join(LEGACY_SPAWN_LOCK_FILENAME).exists(),
+            "sanity: the per-port GC must not collect the legacy name"
+        );
+
+        gc_legacy_spawn_lock_in(dir.path());
+        assert!(
+            !dir.path().join(LEGACY_SPAWN_LOCK_FILENAME).exists(),
+            "the legacy port-less lock must be collected"
+        );
+    }
+
+    /// A legacy lock file currently flock-held by another process must
+    /// survive the sweep — same non-negotiable safety property as the
+    /// per-port GC.
+    #[test]
+    fn unit_legacy_spawn_lock_held_lock_survives() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(LEGACY_SPAWN_LOCK_FILENAME);
+        let file = fs::OpenOptions::new()
+            .create(true)
+            .truncate(true)
+            .write(true)
+            .open(&path)
+            .expect("create legacy lock");
+        file.lock_exclusive().expect("hold the lock");
+
+        gc_legacy_spawn_lock_in(dir.path());
+
+        assert!(
+            path.exists(),
+            "a legacy lock currently held by someone else must never be deleted"
+        );
+    }
+
+    /// GC against a directory with no legacy lock, or a nonexistent
+    /// directory, must be a silent no-op.
+    #[test]
+    fn unit_legacy_spawn_lock_noop_when_absent() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        gc_legacy_spawn_lock_in(dir.path());
+        gc_legacy_spawn_lock_in(&dir.path().join("does-not-exist"));
+    }
 }
diff --git a/crates/ff-rdp-cli/src/daemon/throttle_state.rs b/crates/ff-rdp-cli/src/daemon/throttle_state.rs
index 9df3dc6..5a5033b 100644
--- a/crates/ff-rdp-cli/src/daemon/throttle_state.rs
+++ b/crates/ff-rdp-cli/src/daemon/throttle_state.rs
@@ -95,6 +95,65 @@ pub(crate) fn read_throttle_state_in(dir: &Path, port: u16) -> Result<Option<Thr
     Ok(Some(state))
 }
 
+// ---------------------------------------------------------------------------
+// Stale throttle-state GC (iter-142 Theme B)
+// ---------------------------------------------------------------------------
+//
+// iter-132 Theme E swept stale `daemon.<port>.spawn.lock` files but
+// deliberately left `daemon.<port>.throttle.json` alone (see
+// `registry::parse_spawn_lock_port`'s doc comment) — the file was never in
+// scope for that GC. Dogfooding session 63 observed 5 throttle files for
+// dead daemon pids accumulate with no cleanup path at all. Mirrors the
+// spawn-lock GC's shape: parse the port out of the filename, check the
+// recorded `daemon_pid` for liveness, remove if dead.
+
+/// Parse the Firefox port out of a `daemon.<PORT>.throttle.json` filename.
+///
+/// Returns `None` for anything else in the registry directory —
+/// `daemon.<port>.json`, `daemon.<port>.spawn.lock`, `daemon.log`, etc.
+fn parse_throttle_state_port(filename: &str) -> Option<u16> {
+    filename
+        .strip_prefix("daemon.")?
+        .strip_suffix(".throttle.json")?
+        .parse()
+        .ok()
+}
+
+/// Sweep `<dir>/daemon.*.throttle.json` files whose recorded `daemon_pid` is
+/// no longer alive.
+///
+/// Deliberately narrow: only exact `daemon.<PORT>.throttle.json` filenames
+/// are touched; a corrupt/unparsable file is left alone rather than removed
+/// (an I/O or parse error is not proof of staleness). Every error is
+/// swallowed — this is opportunistic housekeeping that must never fail the
+/// caller's real operation.
+pub(crate) fn gc_stale_throttle_states_in(dir: &Path) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let Ok(name) = entry.file_name().into_string() else {
+            continue;
+        };
+        let Some(port) = parse_throttle_state_port(&name) else {
+            continue;
+        };
+        let Ok(Some(state)) = read_throttle_state_in(dir, port) else {
+            continue;
+        };
+        if !super::process::is_process_alive(state.daemon_pid) {
+            let _ = fs::remove_file(entry.path());
+        }
+    }
+}
+
+/// [`gc_stale_throttle_states_in`] against the real `~/.ff-rdp/` directory.
+pub(crate) fn gc_stale_throttle_states() {
+    if let Ok(dir) = registry::registry_dir() {
+        gc_stale_throttle_states_in(&dir);
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Public convenience wrappers that use the real `~/.ff-rdp/` directory.
 // ---------------------------------------------------------------------------
@@ -178,4 +237,75 @@ mod tests {
         fs::write(dir.path().join(state_filename(6000)), b"not json").expect("write garbage");
         assert!(read_throttle_state_in(dir.path(), 6000).is_err());
     }
+
+    // -----------------------------------------------------------------
+    // iter-142 Theme B: stale throttle-state GC
+    // -----------------------------------------------------------------
+
+    #[test]
+    fn unit_parse_throttle_state_port_matches_exact_suffix_only() {
+        assert_eq!(
+            parse_throttle_state_port("daemon.6000.throttle.json"),
+            Some(6000)
+        );
+        assert_eq!(parse_throttle_state_port("daemon.6000.json"), None);
+        assert_eq!(parse_throttle_state_port("daemon.6000.spawn.lock"), None);
+        assert_eq!(parse_throttle_state_port("daemon.log"), None);
+        assert_eq!(
+            parse_throttle_state_port("daemon.6000.throttle.json.tmp"),
+            None
+        );
+    }
+
+    /// AC `live_142_throttle_json_gc` (unit half): a throttle state whose
+    /// `daemon_pid` is dead is removed by the sweep; one whose `daemon_pid`
+    /// is alive (the current test process) is left alone.
+    #[test]
+    fn unit_gc_stale_throttle_states_removes_dead_keeps_live() {
+        let dir = tempfile::tempdir().expect("tempdir");
+
+        // Dead daemon pid (spawn+reap a trivial child for a portable dead PID).
+        #[cfg(unix)]
+        let mut child = std::process::Command::new("true")
+            .spawn()
+            .expect("spawn `true`");
+        #[cfg(windows)]
+        let mut child = std::process::Command::new("cmd")
+            .args(["/C", "exit", "0"])
+            .spawn()
+            .expect("spawn cmd exit");
+        let dead_pid = child.id();
+        child.wait().expect("child exits");
+        std::thread::sleep(std::time::Duration::from_millis(50));
+
+        write_throttle_state_in(dir.path(), 6000, &sample_state(dead_pid)).expect("write dead");
+        write_throttle_state_in(dir.path(), 6001, &sample_state(std::process::id()))
+            .expect("write live");
+
+        gc_stale_throttle_states_in(dir.path());
+
+        assert!(
+            !dir.path().join(state_filename(6000)).exists(),
+            "dead-pid throttle state must be collected"
+        );
+        assert!(
+            dir.path().join(state_filename(6001)).exists(),
+            "live-pid throttle state must survive"
+        );
+    }
+
+    /// GC on a directory with no throttle-state files is a silent no-op —
+    /// mirrors `daemon.<port>.json` / `daemon.<port>.spawn.lock` files must
+    /// never be touched by this sweep.
+    #[test]
+    fn unit_gc_stale_throttle_states_ignores_other_registry_files() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        fs::write(dir.path().join("daemon.6000.json"), b"{}").expect("write registry file");
+        fs::write(dir.path().join("daemon.6000.spawn.lock"), []).expect("write lock file");
+
+        gc_stale_throttle_states_in(dir.path());
+
+        assert!(dir.path().join("daemon.6000.json").exists());
+        assert!(dir.path().join("daemon.6000.spawn.lock").exists());
+    }
 }
diff --git a/crates/ff-rdp-cli/src/daemon_record.rs b/crates/ff-rdp-cli/src/daemon_record.rs
index b1abb9f..e9c49c0 100644
--- a/crates/ff-rdp-cli/src/daemon_record.rs
+++ b/crates/ff-rdp-cli/src/daemon_record.rs
@@ -7,12 +7,26 @@
 //!
 //! ## File location
 //!
-//! `~/.ff-rdp/launch-record.json` on all platforms — shares the same parent
-//! directory as the per-port proxy-daemon registry files
+//! `~/.ff-rdp/launch-record.<port>.json` on all platforms — shares the same
+//! parent directory as the per-port proxy-daemon registry files
 //! (`~/.ff-rdp/daemon.<port>.json`, iter-123 Theme B) so a single
 //! `FF_RDP_HOME` cleanup wipes all ff-rdp state. The file name differs to
 //! avoid colliding with the existing registry files.
 //!
+//! ## Per-port scoping (iter-142 Theme A)
+//!
+//! Prior to iter-142 this was a single global `launch-record.json` shared by
+//! every `launch`/`daemon start` invocation on the machine. Two concurrent
+//! agents launching Firefox on different ports (e.g. 6100 and 6101) would
+//! clobber each other's record: the second `launch` overwrote the first's
+//! entry, so a subsequent `daemon stop --port 6100` read back port 6101's
+//! PID, found it didn't match, and fell through to the proxy-daemon registry
+//! path — which reports the *daemon's own* PID, not Firefox's (see
+//! `daemon/client.rs::run_daemon_stop`). Dogfooding session 63 reproduced
+//! this 3/3 with four parallel agents on separate ports. Scoping the record
+//! filename by port (mirroring the iter-123 Theme B fix for the proxy
+//! registry) makes concurrent instances independent.
+//!
 //! The `FF_RDP_HOME` env-var overrides the home directory (same convention as
 //! `daemon/registry.rs`): when set, the file is written to
 //! `$FF_RDP_HOME/.ff-rdp/launch-record.json`.
@@ -60,9 +74,12 @@ pub struct DaemonRecord {
 // Directory resolution
 // ---------------------------------------------------------------------------
 
-/// Filename used for the launch record, sharing `~/.ff-rdp/` with the
-/// per-port proxy-daemon registry files (`daemon.<port>.json`).
-const RECORD_FILENAME: &str = "launch-record.json";
+/// Return the per-port filename used for the launch record
+/// (e.g. `launch-record.6100.json`), sharing `~/.ff-rdp/` with the per-port
+/// proxy-daemon registry files (`daemon.<port>.json`).
+fn record_filename(port: u16) -> String {
+    format!("launch-record.{port}.json")
+}
 
 /// Return the directory that contains the launch-record file.
 ///
@@ -82,13 +99,13 @@ pub fn record_base_dir() -> Result<PathBuf> {
 // Test-injectable base-dir variants
 // ---------------------------------------------------------------------------
 
-/// Read the daemon record from `<dir>/launch-record.json`.
+/// Read the daemon record for `port` from `<dir>/launch-record.<port>.json`.
 ///
 /// Returns `None` if the file is absent or if the recorded PID is no longer
 /// alive (stale entry). When a stale entry is detected the file is removed
 /// so it cannot interfere with future launches.
-pub fn read_in(dir: &Path) -> Result<Option<DaemonRecord>> {
-    let path = dir.join(RECORD_FILENAME);
+pub fn read_in(dir: &Path, port: u16) -> Result<Option<DaemonRecord>> {
+    let path = dir.join(record_filename(port));
     if !path.exists() {
         return Ok(None);
     }
@@ -107,13 +124,15 @@ pub fn read_in(dir: &Path) -> Result<Option<DaemonRecord>> {
     Ok(Some(rec))
 }
 
-/// Write `rec` to `<dir>/launch-record.json` atomically (write-to-tmp + rename).
+/// Write `rec` to `<dir>/launch-record.<rec.port>.json` atomically
+/// (write-to-tmp + rename).
 pub fn write_in(dir: &Path, rec: &DaemonRecord) -> Result<()> {
     fs::create_dir_all(dir)
         .with_context(|| format!("creating daemon record directory {}", dir.display()))?;
 
-    let record_path = dir.join(RECORD_FILENAME);
-    let tmp_path = dir.join(format!("{RECORD_FILENAME}.tmp"));
+    let filename = record_filename(rec.port);
+    let record_path = dir.join(&filename);
+    let tmp_path = dir.join(format!("{filename}.tmp"));
 
     let json = serde_json::to_string_pretty(rec).context("serializing DaemonRecord to JSON")?;
 
@@ -147,9 +166,9 @@ pub fn write_in(dir: &Path, rec: &DaemonRecord) -> Result<()> {
     Ok(())
 }
 
-/// Remove `<dir>/launch-record.json` if it exists (idempotent).
-pub fn remove_in(dir: &Path) -> Result<()> {
-    let path = dir.join(RECORD_FILENAME);
+/// Remove `<dir>/launch-record.<port>.json` if it exists (idempotent).
+pub fn remove_in(dir: &Path, port: u16) -> Result<()> {
+    let path = dir.join(record_filename(port));
     if path.exists() {
         fs::remove_file(&path)
             .with_context(|| format!("removing daemon record {}", path.display()))?;
@@ -161,21 +180,23 @@ pub fn remove_in(dir: &Path) -> Result<()> {
 // Public convenience wrappers using the real cache directory
 // ---------------------------------------------------------------------------
 
-/// Read the daemon record from the default cache location.
+/// Read the daemon record for `port` from the default cache location.
 ///
 /// Returns `None` if absent or if the recorded PID is dead (stale).
-pub fn read() -> Result<Option<DaemonRecord>> {
-    read_in(&record_base_dir()?)
+pub fn read(port: u16) -> Result<Option<DaemonRecord>> {
+    read_in(&record_base_dir()?, port)
 }
 
-/// Write the daemon record to the default cache location atomically.
+/// Write the daemon record to the default cache location atomically, keyed
+/// by `rec.port`.
 pub fn write(rec: &DaemonRecord) -> Result<()> {
     write_in(&record_base_dir()?, rec)
 }
 
-/// Remove the daemon record from the default cache location (idempotent).
-pub fn remove() -> Result<()> {
-    remove_in(&record_base_dir()?)
+/// Remove the daemon record for `port` from the default cache location
+/// (idempotent).
+pub fn remove(port: u16) -> Result<()> {
+    remove_in(&record_base_dir()?, port)
 }
 
 // ---------------------------------------------------------------------------
@@ -206,7 +227,7 @@ mod tests {
 
         write_in(dir.path(), &rec).expect("write_in");
 
-        let read_back = read_in(dir.path())
+        let read_back = read_in(dir.path(), rec.port)
             .expect("read_in ok")
             .expect("should be Some");
 
@@ -237,13 +258,13 @@ mod tests {
         };
 
         // Bypass the normal write_in (which doesn't check PID) by writing JSON directly.
-        let path = dir.path().join(RECORD_FILENAME);
+        let path = dir.path().join(record_filename(rec.port));
         let json = serde_json::to_string_pretty(&rec).unwrap();
         fs::write(&path, json).expect("write stale record");
         assert!(path.exists(), "file must exist before read_in");
 
         // read_in should detect the dead PID and return None.
-        let result = read_in(dir.path()).expect("read_in ok");
+        let result = read_in(dir.path(), rec.port).expect("read_in ok");
         assert!(result.is_none(), "stale PID must return None");
 
         // The file must have been removed.
@@ -254,9 +275,12 @@ mod tests {
     #[test]
     fn unit_daemon_record_atomic_write_no_tmp_left_behind() {
         let dir = tempfile::tempdir().expect("tempdir");
-        write_in(dir.path(), &sample_record()).expect("write_in");
+        let rec = sample_record();
+        write_in(dir.path(), &rec).expect("write_in");
 
-        let tmp = dir.path().join(format!("{RECORD_FILENAME}.tmp"));
+        let tmp = dir
+            .path()
+            .join(format!("{}.tmp", record_filename(rec.port)));
         assert!(
             !tmp.exists(),
             ".tmp file must not remain after atomic write"
@@ -267,7 +291,7 @@ mod tests {
     #[test]
     fn unit_daemon_record_read_absent_returns_none() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let result = read_in(dir.path()).expect("read_in ok");
+        let result = read_in(dir.path(), 6000).expect("read_in ok");
         assert!(result.is_none());
     }
 
@@ -275,14 +299,15 @@ mod tests {
     #[test]
     fn unit_daemon_record_remove_idempotent() {
         let dir = tempfile::tempdir().expect("tempdir");
-        remove_in(dir.path()).expect("remove when absent must not error");
+        remove_in(dir.path(), 6000).expect("remove when absent must not error");
 
-        write_in(dir.path(), &sample_record()).expect("write");
-        remove_in(dir.path()).expect("remove when present must not error");
-        assert!(!dir.path().join(RECORD_FILENAME).exists());
+        let rec = sample_record();
+        write_in(dir.path(), &rec).expect("write");
+        remove_in(dir.path(), rec.port).expect("remove when present must not error");
+        assert!(!dir.path().join(record_filename(rec.port)).exists());
     }
 
-    /// Overwriting with a second write replaces the first.
+    /// Overwriting the same port with a second write replaces the first.
     #[test]
     fn unit_daemon_record_overwrite_replaces() {
         let dir = tempfile::tempdir().expect("tempdir");
@@ -290,14 +315,69 @@ mod tests {
 
         let updated = DaemonRecord {
             pid: std::process::id(),
-            port: 7777,
+            port: sample_record().port,
             headless: false,
             launched_at: Utc::now(),
             profile_dir: PathBuf::from("/tmp/updated"),
         };
         write_in(dir.path(), &updated).expect("second write");
 
-        let read_back = read_in(dir.path()).expect("read_in ok").expect("Some");
-        assert_eq!(read_back.port, 7777);
+        let read_back = read_in(dir.path(), updated.port)
+            .expect("read_in ok")
+            .expect("Some");
+        assert_eq!(read_back.profile_dir, PathBuf::from("/tmp/updated"));
+    }
+
+    /// AC `unit_daemon_record_per_port_isolation` (iter-142 Theme A): two
+    /// records for different ports must not clobber each other — this is
+    /// the exact defect dogfooding session 63 reproduced 3/3 with parallel
+    /// agents on separate ports (a single global `launch-record.json` meant
+    /// the second `launch` silently overwrote the first's entry).
+    #[test]
+    fn unit_daemon_record_per_port_isolation() {
+        let dir = tempfile::tempdir().expect("tempdir");
+
+        let rec_a = DaemonRecord {
+            pid: std::process::id(),
+            port: 6100,
+            headless: true,
+            launched_at: Utc::now(),
+            profile_dir: PathBuf::from("/tmp/profile-a"),
+        };
+        let rec_b = DaemonRecord {
+            pid: std::process::id(),
+            port: 6101,
+            headless: true,
+            launched_at: Utc::now(),
+            profile_dir: PathBuf::from("/tmp/profile-b"),
+        };
+
+        write_in(dir.path(), &rec_a).expect("write a");
+        write_in(dir.path(), &rec_b).expect("write b");
+
+        let read_a = read_in(dir.path(), 6100)
+            .expect("read a ok")
+            .expect("a present");
+        let read_b = read_in(dir.path(), 6101)
+            .expect("read b ok")
+            .expect("b present");
+
+        assert_eq!(read_a.profile_dir, PathBuf::from("/tmp/profile-a"));
+        assert_eq!(read_b.profile_dir, PathBuf::from("/tmp/profile-b"));
+
+        // Removing port 6100's record must leave port 6101's untouched.
+        remove_in(dir.path(), 6100).expect("remove a");
+        assert!(
+            read_in(dir.path(), 6100)
+                .expect("read a after remove")
+                .is_none(),
+            "port 6100 record must be gone"
+        );
+        assert!(
+            read_in(dir.path(), 6101)
+                .expect("read b after remove a")
+                .is_some(),
+            "port 6101 record must survive removing port 6100's record"
+        );
     }
 }
diff --git a/crates/ff-rdp-cli/src/dispatch.rs b/crates/ff-rdp-cli/src/dispatch.rs
index 0d37c77..f23539d 100644
--- a/crates/ff-rdp-cli/src/dispatch.rs
+++ b/crates/ff-rdp-cli/src/dispatch.rs
@@ -713,6 +713,7 @@ fn dispatch_inner(
             text,
             eval,
             ref_id,
+            sleep_ms,
             wait_timeout,
         }) => {
             let effective_timeout = *wait_timeout;
@@ -735,6 +736,7 @@ fn dispatch_inner(
                     selector: resolved_selector.as_deref().or(selector.as_deref()),
                     text: text.as_deref(),
                     eval: eval.as_deref(),
+                    sleep_ms: *sleep_ms,
                     wait_timeout: effective_timeout,
                 },
             )
diff --git a/crates/ff-rdp-cli/src/script/runner.rs b/crates/ff-rdp-cli/src/script/runner.rs
index 7d6b7f5..f5a0aee 100644
--- a/crates/ff-rdp-cli/src/script/runner.rs
+++ b/crates/ff-rdp-cli/src/script/runner.rs
@@ -873,6 +873,10 @@ fn execute_wait(
         selector: step.selector.as_deref(),
         text: step.text.as_deref(),
         eval: step.eval.as_deref(),
+        // iter-142: recorded scripts have no sleep step type yet — only the
+        // interactive `wait --sleep-ms` CLI form is in scope for this
+        // iteration.
+        sleep_ms: None,
         wait_timeout: timeout,
     };
     wait_run_core(cli, &opts)
diff --git a/crates/ff-rdp-cli/src/util/profile_dir.rs b/crates/ff-rdp-cli/src/util/profile_dir.rs
index 73bd1c6..48feba2 100644
--- a/crates/ff-rdp-cli/src/util/profile_dir.rs
+++ b/crates/ff-rdp-cli/src/util/profile_dir.rs
@@ -424,13 +424,44 @@ pub fn prune_orphan_profiles(
         // iter-97 Theme B: a live owner-PID marker is a positive "still in
         // use" signal that overrides the mtime heuristics below — a running
         // (even fully idle) Firefox never has its profile pruned. A missing
-        // or dead marker falls through to the mtime checks unchanged.
-        if profile_is_owned_by_live_process(&path) {
-            tracing::debug!(
-                "prune_orphan_profiles: keeping {} — owner PID is alive",
-                path.display()
-            );
-            continue;
+        // marker falls through to the mtime checks unchanged.
+        //
+        // iter-142 Theme B: a marker naming a *dead* PID is the opposite
+        // signal — definitive proof of abandonment, not just "old enough to
+        // guess at". Previously a dead-owner profile still had to wait out
+        // the full `age_threshold` (7 days by default) before
+        // `prune_orphan_profiles` would touch it, so a day of crashes /
+        // `kill -9`s / restarted agents accumulated freely: dogfooding
+        // session 63 observed 62 profiles / 2.7 GB in a single day, all well
+        // under the threshold. Remove dead-owner profiles immediately,
+        // regardless of age — `max_entries` below still bounds how many a
+        // single `launch` will reclaim.
+        match read_owner_pid_marker(&path) {
+            Some(pid) if crate::daemon::process::is_process_alive(pid) => {
+                tracing::debug!(
+                    "prune_orphan_profiles: keeping {} — owner PID {pid} is alive",
+                    path.display()
+                );
+                continue;
+            }
+            Some(pid) => {
+                tracing::debug!(
+                    "prune_orphan_profiles: owner PID {pid} for {} is dead — removing immediately",
+                    path.display()
+                );
+                match std::fs::remove_dir_all(&path) {
+                    Ok(()) => summary.removed.push(path),
+                    Err(e) => tracing::warn!(
+                        "prune_orphan_profiles: failed to remove dead-owner {}: {e}",
+                        path.display()
+                    ),
+                }
+                continue;
+            }
+            None => {
+                // No marker (pre-97 profile, or the marker write failed) —
+                // fall back to the mtime heuristic below.
+            }
         }
 
         // `metadata()` (not `entry.file_type()`) so a vanished entry (race
@@ -874,6 +905,36 @@ mod tests {
         assert!(!dead.exists(), "dead-owner dir must be reclaimed");
     }
 
+    /// AC `live_142_profile_growth_bounded` (unit half — the policy under
+    /// test): a dead-owner profile is reclaimed **immediately**, even when
+    /// it is only seconds old — the age threshold no longer gates removal
+    /// once ownership is provably dead. This is the exact gap that let 62
+    /// profiles / 2.7 GB accumulate in a single day (dogfooding session 63):
+    /// every one of them was younger than the old 7-day age gate.
+    #[test]
+    fn unit_prune_reclaims_dead_owner_immediately_regardless_of_age() {
+        let root = tempfile::tempdir().expect("tempdir");
+        // Fresh (1 second old) — would survive any age-gated heuristic.
+        let dead = seed_fake_profile(root.path(), &"4".repeat(16), Duration::from_secs(1));
+        let dead_pid = spawn_and_reap_child_pid();
+        std::fs::write(dead.join(OWNER_PID_MARKER), format!("{dead_pid}\n"))
+            .expect("write dead marker");
+
+        // A 168h (7-day) threshold — the dir is nowhere near stale by mtime.
+        let summary = prune_orphan_profiles(root.path(), Duration::from_hours(168), 50);
+
+        assert_eq!(
+            summary.removed,
+            vec![dead.clone()],
+            "a dead-owner profile must be reclaimed the moment ownership is \
+             provably dead, not after waiting out the age threshold"
+        );
+        assert!(
+            !dead.exists(),
+            "fresh but dead-owner profile must be removed immediately"
+        );
+    }
+
     /// A missing marker falls back to the iter-96 mtime heuristic (pre-97
     /// profiles have no marker), so a stale dir with no marker is still
     /// pruned exactly as before.
diff --git a/crates/ff-rdp-cli/tests/e2e/eval.rs b/crates/ff-rdp-cli/tests/e2e/eval.rs
index 131b132..3044460 100644
--- a/crates/ff-rdp-cli/tests/e2e/eval.rs
+++ b/crates/ff-rdp-cli/tests/e2e/eval.rs
@@ -642,6 +642,52 @@ fn eval_meta_eval_path_page_await() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// iter-142 Theme E: ASI-separated top-level-await scripts
+// ---------------------------------------------------------------------------
+
+/// AC: `e2e_eval_asi_await_script` — an ASI-separated (no `;` anywhere)
+/// two-line top-level-await script must succeed end-to-end through the real
+/// CLI, not just at the `build_script` unit level. Pre-iter-142, the
+/// generated wrapper for this exact script
+/// (`await Promise.resolve(1)\n42`) was itself invalid JS — Firefox would
+/// have rejected it with a `SyntaxError` before ever reaching
+/// `evaluateJSAsync`'s result path. This test can't observe Firefox's
+/// parser (the mock server returns a canned fixture regardless of the sent
+/// script), but it does prove the CLI's full request/response plumbing
+/// (connect → target → evaluateJSAsync → envelope) still exits 0 and
+/// produces a normal result envelope for this script shape — combined with
+/// `crates/ff-rdp-cli/src/commands/eval.rs`'s
+/// `build_script_asi_separated_await_script_wraps_without_leaking_and_returns_tail`
+/// unit test (which does inspect the generated wrapper text), the two
+/// together cover both "the wrapper is valid JS" and "the CLI path works".
+#[test]
+fn e2e_eval_asi_await_script() {
+    let server = eval_server("eval_result_number.json");
+    let port = server.port();
+    let handle = std::thread::spawn(move || server.serve_one());
+
+    let mut args = base_args(port);
+    args.extend(["eval".to_owned(), "await Promise.resolve(1)\n42".to_owned()]);
+
+    let output = std::process::Command::new(ff_rdp_bin())
+        .args(&args)
+        .output()
+        .expect("failed to spawn ff-rdp");
+
+    handle.join().unwrap();
+
+    assert!(
+        output.status.success(),
+        "ASI-separated await script must exit 0, stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let json: serde_json::Value =
+        serde_json::from_slice(&output.stdout).expect("stdout must be valid JSON");
+    assert_eq!(json["results"], 42);
+}
+
 /// AC: `e2e_help_viewport_pointers` — `eval --help` documents the headless
 /// `resizeTo()` no-op and points at `launch --window-size` for a real
 /// window size.
diff --git a/crates/ff-rdp-cli/tests/e2e/wait.rs b/crates/ff-rdp-cli/tests/e2e/wait.rs
index 3fa0c19..04873c1 100644
--- a/crates/ff-rdp-cli/tests/e2e/wait.rs
+++ b/crates/ff-rdp-cli/tests/e2e/wait.rs
@@ -64,6 +64,99 @@ fn wait_selector_succeeds_immediately() {
     assert!(json["results"]["elapsed_ms"].is_number());
 }
 
+// ---------------------------------------------------------------------------
+// iter-142 Theme F: plain sleep form
+// ---------------------------------------------------------------------------
+
+/// AC: `e2e_wait_sleep_form` — `ff-rdp wait --sleep-ms <N>` sleeps for
+/// approximately `N` ms and succeeds with NO server listening at all on the
+/// target port — proving the sleep form genuinely skips the Firefox
+/// connection rather than merely tolerating a fast-failing one.
+#[test]
+fn e2e_wait_sleep_form() {
+    // Discover a port nothing is listening on — no MockRdpServer spawned.
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind ephemeral port");
+    let port = listener.local_addr().expect("local_addr").port();
+    drop(listener);
+
+    let mut args = base_args(port);
+    // base_args includes --no-daemon; irrelevant here since the sleep path
+    // never opens a connection at all, daemon or otherwise.
+    args.extend(["wait".to_owned(), "--sleep-ms".to_owned(), "50".to_owned()]);
+
+    let started = std::time::Instant::now();
+    let output = std::process::Command::new(ff_rdp_bin())
+        .args(&args)
+        .output()
+        .expect("failed to spawn ff-rdp");
+    let elapsed = started.elapsed();
+
+    assert!(
+        output.status.success(),
+        "expected success with no server listening on port {port}, stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(
+        elapsed >= std::time::Duration::from_millis(50),
+        "must actually sleep for the requested duration, elapsed={elapsed:?}"
+    );
+
+    let json: serde_json::Value =
+        serde_json::from_slice(&output.stdout).expect("stdout must be valid JSON");
+    assert_eq!(json["results"]["matched"], true);
+    assert_eq!(json["results"]["elapsed_ms"], 50);
+}
+
+/// The legacy `--time` alias (the flag name dogfooding session 63 reached
+/// for) parses identically to `--sleep-ms`.
+#[test]
+fn e2e_wait_sleep_form_time_alias() {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind ephemeral port");
+    let port = listener.local_addr().expect("local_addr").port();
+    drop(listener);
+
+    let mut args = base_args(port);
+    args.extend(["wait".to_owned(), "--time".to_owned(), "20".to_owned()]);
+
+    let output = std::process::Command::new(ff_rdp_bin())
+        .args(&args)
+        .output()
+        .expect("failed to spawn ff-rdp");
+
+    assert!(
+        output.status.success(),
+        "--time alias must work like --sleep-ms, stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let json: serde_json::Value =
+        serde_json::from_slice(&output.stdout).expect("stdout must be valid JSON");
+    assert_eq!(json["results"]["matched"], true);
+    assert_eq!(json["results"]["elapsed_ms"], 20);
+}
+
+/// `wait` with no condition flag at all (the pre-iter-142 dogfooding
+/// friction point) must still fail — `--sleep-ms` opts *in* to a delay, it
+/// does not become the default.
+#[test]
+fn wait_requires_a_condition_or_sleep() {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind ephemeral port");
+    let port = listener.local_addr().expect("local_addr").port();
+    drop(listener);
+
+    let mut args = base_args(port);
+    args.push("wait".to_owned());
+
+    let output = std::process::Command::new(ff_rdp_bin())
+        .args(&args)
+        .output()
+        .expect("failed to spawn ff-rdp");
+
+    assert!(
+        !output.status.success(),
+        "wait with no condition/sleep must fail"
+    );
+}
+
 #[test]
 fn wait_eval_succeeds_immediately() {
     let server = wait_server("eval_result_wait_true.json");
diff --git a/crates/ff-rdp-cli/tests/live/live_142_daemon_stop_pid_honesty.rs b/crates/ff-rdp-cli/tests/live/live_142_daemon_stop_pid_honesty.rs
new file mode 100644
index 0000000..f478e28
--- /dev/null
+++ b/crates/ff-rdp-cli/tests/live/live_142_daemon_stop_pid_honesty.rs
@@ -0,0 +1,139 @@
+//! Live test for iter-142 Theme A: `daemon stop` pid honesty + per-port
+//! isolation.
+//!
+//! AC: `live_142_daemon_stop_no_false_error`
+//!
+//! Root cause (confirmed against the filesystem, not just the plan's stated
+//! symptom — see `daemon_record.rs`'s module doc comment):
+//! `~/.ff-rdp/launch-record.json` was a single **global** file. Two
+//! concurrent `launch`es on different ports clobbered each other's record —
+//! the second `launch` overwrote the first's entry — so a later
+//! `daemon stop --port A` read back a record for a *different* port, didn't
+//! match, fell through to the proxy-daemon registry path, and reported the
+//! **daemon's own PID** as if it were Firefox's (dogfooding session 63
+//! item 27, reproduced 3/3 with four parallel agents on separate ports).
+//! iter-142 scopes the record file per port
+//! (`launch-record.<port>.json`) and, as defense in depth, makes the
+//! registry-fallback path itself resolve and kill the real Firefox process
+//! instead of the daemon's own PID (`daemon/client.rs::run_daemon_stop`).
+//!
+//! This test drives the exact repro shape: two `launch`es on different
+//! ports (the default daemon-mode connection path throughout — this suite
+//! never opts into a direct connection), then `daemon stop` on the first.
+//!
+//! Post-conditions:
+//! - `daemon stop` exits 0
+//! - `results.pid` equals the pid `launch` reported for that port (not the
+//!   daemon's own pid, and not the *other* instance's pid)
+//! - the stopped instance's port becomes free
+//! - the untouched second instance stays alive (no cross-instance kill)
+//!
+//! Run with:
+//!   FF_RDP_LIVE_TESTS=1 cargo test-live -p ff-rdp-cli \
+//!       --test live live_142_daemon_stop_pid_honesty -- --nocapture
+
+use std::process::Command;
+use std::time::Duration;
+
+use crate::common::{LiveFirefox, ff_rdp_bin, kill_pid, live_tests_enabled};
+
+/// Poll until `127.0.0.1:port` refuses connections (port is free) or timeout.
+fn wait_port_free(port: u16, timeout: Duration) -> bool {
+    let deadline = std::time::Instant::now() + timeout;
+    loop {
+        if std::net::TcpStream::connect(format!("127.0.0.1:{port}")).is_err() {
+            return true;
+        }
+        if std::time::Instant::now() >= deadline {
+            return false;
+        }
+        std::thread::sleep(Duration::from_millis(100));
+    }
+}
+
+#[test]
+#[ignore = "requires a live Firefox instance — set FF_RDP_LIVE_TESTS=1"]
+fn live_142_daemon_stop_no_false_error() {
+    if !live_tests_enabled() {
+        return;
+    }
+
+    let Some(ff_a) = LiveFirefox::headless_on_random_port() else {
+        eprintln!("live_142_daemon_stop_no_false_error: Firefox not available — skipping");
+        return;
+    };
+    let port_a = ff_a.port();
+    let pid_a = ff_a.pid();
+    // Transfer ownership to ManuallyDrop so Drop doesn't kill instance A
+    // before `daemon stop` does — the test asserts the stop path reaps it.
+    let _keep_a = std::mem::ManuallyDrop::new(ff_a);
+
+    let Some(ff_b) = LiveFirefox::headless_on_random_port() else {
+        eprintln!(
+            "live_142_daemon_stop_no_false_error: second Firefox not available — skipping \
+             (cleaning up instance A manually)"
+        );
+        kill_pid(pid_a);
+        return;
+    };
+    let port_b = ff_b.port();
+    // ff_b's normal Drop kills it at the end of this function — it must
+    // survive everything before that point, so no ManuallyDrop here.
+
+    eprintln!(
+        "live_142_daemon_stop_no_false_error: instance A pid={pid_a} port={port_a}, \
+         instance B port={port_b} (both launched via the default daemon-mode path)"
+    );
+
+    // `daemon stop` on instance A only — instance B must be unaffected.
+    let stop = Command::new(ff_rdp_bin())
+        .args([
+            "--host",
+            "127.0.0.1",
+            "--port",
+            &port_a.to_string(),
+            "--timeout",
+            "15000",
+            "daemon",
+            "stop",
+        ])
+        .output()
+        .expect("live_142_daemon_stop_no_false_error: daemon stop spawn failed");
+
+    assert!(
+        stop.status.success(),
+        "live_142_daemon_stop_no_false_error: daemon stop returned non-zero — \
+         stdout={} stderr={}",
+        String::from_utf8_lossy(&stop.stdout),
+        String::from_utf8_lossy(&stop.stderr)
+    );
+
+    let json: serde_json::Value = serde_json::from_slice(&stop.stdout)
+        .expect("live_142_daemon_stop_no_false_error: daemon stop JSON parse");
+    let reported_pid = json["results"]["pid"].as_u64();
+    assert_eq!(
+        reported_pid,
+        Some(u64::from(pid_a)),
+        "live_142_daemon_stop_no_false_error: daemon stop must report the pid \
+         `launch` returned for port {port_a} (pid {pid_a}), never the daemon's own \
+         pid or instance B's pid — got {json}"
+    );
+
+    assert!(
+        wait_port_free(port_a, Duration::from_secs(10)),
+        "live_142_daemon_stop_no_false_error: FAIL — port {port_a} still listening \
+         after daemon stop reported success"
+    );
+
+    assert!(
+        std::net::TcpStream::connect(format!("127.0.0.1:{port_b}")).is_ok(),
+        "live_142_daemon_stop_no_false_error: instance B on port {port_b} must survive \
+         stopping instance A — a cross-instance kill would be the exact \
+         global-launch-record clobber this iteration fixed"
+    );
+
+    eprintln!(
+        "live_142_daemon_stop_no_false_error: PASS — pid {pid_a} reported and reaped, \
+         port {port_a} freed, instance B on port {port_b} untouched"
+    );
+}
diff --git a/crates/ff-rdp-cli/tests/live/live_142_disk_growth.rs b/crates/ff-rdp-cli/tests/live/live_142_disk_growth.rs
new file mode 100644
index 0000000..4ea519d
--- /dev/null
+++ b/crates/ff-rdp-cli/tests/live/live_142_disk_growth.rs
@@ -0,0 +1,243 @@
+//! Live tests for iter-142 Theme B: disk growth (temp profiles, throttle
+//! state files).
+//!
+//! Dogfooding session 63 observed 62 temp profiles / 2.7 GB accumulate in a
+//! single day, plus 5 `daemon.*.throttle.json` files for dead daemon pids.
+//! Both existed because the safety nets that should reclaim them either
+//! never fired for a same-day workload (`prune_orphan_profiles`'s default
+//! 7-day age gate never lets a dead-owner profile go before a week has
+//! passed) or never covered the file at all (`gc_stale_spawn_locks_in`
+//! deliberately skips `*.throttle.json`, see `registry.rs`). iter-142 fixes
+//! both: a dead-owner profile is now reclaimed immediately regardless of
+//! age, and a dedicated GC sweep (wired into every `launch`) collects stale
+//! throttle-state files.
+//!
+//! Run with:
+//!   FF_RDP_LIVE_TESTS=1 cargo test-live -p ff-rdp-cli \
+//!       --test live live_142_disk_growth -- --nocapture
+
+use std::process::Command;
+use std::time::Duration;
+
+use crate::common::{ff_rdp_bin, kill_pid, live_tests_enabled};
+
+/// Attempt to bind `:0` to discover a free port.
+fn free_port() -> Option<u16> {
+    let l = std::net::TcpListener::bind("127.0.0.1:0").ok()?;
+    Some(l.local_addr().ok()?.port())
+}
+
+/// Launch Firefox headless via the CLI on a freshly discovered port and
+/// return `(port, results)` — the `results` object of the launch envelope.
+fn launch_headless() -> Option<(u16, serde_json::Value)> {
+    let port = free_port()?;
+    let out = Command::new(ff_rdp_bin())
+        .args(["launch", "--headless", "--debug-port", &port.to_string()])
+        .output()
+        .ok()?;
+    if !out.status.success() {
+        eprintln!(
+            "launch_headless: launch failed — stderr={}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+        return None;
+    }
+    let json: serde_json::Value = serde_json::from_slice(&out.stdout).ok()?;
+    let results = json.get("results")?.clone();
+    Some((port, results))
+}
+
+/// Spawn+reap a trivial child process, returning its now-dead PID.
+fn spawn_and_reap_child_pid() -> u32 {
+    #[cfg(unix)]
+    let mut child = Command::new("true").spawn().expect("spawn `true`");
+    #[cfg(windows)]
+    let mut child = Command::new("cmd")
+        .args(["/C", "exit", "0"])
+        .spawn()
+        .expect("spawn cmd exit");
+    let pid = child.id();
+    child.wait().expect("child exits");
+    std::thread::sleep(Duration::from_millis(50));
+    pid
+}
+
+/// AC: `live_142_profile_growth_bounded`
+///
+/// Policy under test: a temp profile whose owner PID is confirmed dead is
+/// reclaimed by the very next `launch`'s opportunistic sweep — immediately,
+/// not after any age threshold (`prune_orphan_profiles`, iter-142 Theme B).
+///
+/// 1. Launch Firefox headless (creates a managed temp profile + owner-PID
+///    marker).
+/// 2. Force-kill it directly (SIGKILL), bypassing `daemon stop` — the normal
+///    cleanup path never runs, so the profile dir is only reclaimable via
+///    the orphan sweep.
+/// 3. Launch a second Firefox headless immediately (same process, no delay,
+///    no artificial aging of the first profile's mtime).
+/// 4. Assert instance A's profile directory is gone — proves growth is
+///    bounded by "next launch", not by waiting out an age threshold.
+#[test]
+#[ignore = "requires a live Firefox instance — set FF_RDP_LIVE_TESTS=1"]
+fn live_142_profile_growth_bounded() {
+    if !live_tests_enabled() {
+        return;
+    }
+
+    let Some((_port_a, results_a)) = launch_headless() else {
+        eprintln!("live_142_profile_growth_bounded: Firefox not available — skipping");
+        return;
+    };
+    let pid_a =
+        u32::try_from(results_a["pid"].as_u64().expect("results.pid")).expect("pid fits u32");
+    let profile_a = results_a["profile_path"]
+        .as_str()
+        .expect("results.profile_path")
+        .to_owned();
+
+    assert!(
+        std::path::Path::new(&profile_a).exists(),
+        "live_142_profile_growth_bounded: profile {profile_a} must exist right after launch"
+    );
+
+    // Force-kill instance A directly — bypasses `daemon stop`'s own cleanup,
+    // so the profile dir is orphaned exactly like a crash or `kill -9` would
+    // leave it.
+    kill_pid(pid_a);
+    std::thread::sleep(Duration::from_millis(500));
+
+    eprintln!(
+        "live_142_profile_growth_bounded: instance A (pid {pid_a}) force-killed, \
+         profile {profile_a} now orphaned"
+    );
+
+    // Immediately launch a second instance — no artificial delay. If growth
+    // were still bounded only by the old 7-day age gate, instance A's
+    // fresh (seconds-old) profile would still be sitting there.
+    let Some((port_b, results_b)) = launch_headless() else {
+        eprintln!("live_142_profile_growth_bounded: second launch failed — skipping");
+        return;
+    };
+    let pid_b =
+        u32::try_from(results_b["pid"].as_u64().expect("results.pid")).expect("pid fits u32");
+
+    assert!(
+        !std::path::Path::new(&profile_a).exists(),
+        "live_142_profile_growth_bounded: FAIL — orphaned profile {profile_a} \
+         must be reclaimed by the very next launch's opportunistic sweep, \
+         not left to accumulate for days"
+    );
+
+    eprintln!(
+        "live_142_profile_growth_bounded: PASS — orphaned profile {profile_a} \
+         reclaimed by the next launch (instance B on port {port_b}, pid {pid_b})"
+    );
+
+    // Clean up instance B.
+    let _ = Command::new(ff_rdp_bin())
+        .args([
+            "--port",
+            &port_b.to_string(),
+            "--timeout",
+            "15000",
+            "daemon",
+            "stop",
+        ])
+        .output();
+    kill_pid(pid_b);
+}
+
+/// AC: `live_142_throttle_json_gc`
+///
+/// A `daemon.<port>.throttle.json` file whose recorded `daemon_pid` is dead
+/// is collected by the next `launch`'s sweep (`gc_stale_throttle_states`,
+/// wired into `commands::launch::run`); one whose `daemon_pid` is alive
+/// survives. Runs against an isolated `FF_RDP_HOME` so it never touches the
+/// real `~/.ff-rdp/` directory (same isolation pattern as
+/// `live_123_daemon_autostart_and_registry.rs`).
+#[test]
+#[ignore = "requires a live Firefox instance — set FF_RDP_LIVE_TESTS=1"]
+fn live_142_throttle_json_gc() {
+    if !live_tests_enabled() {
+        return;
+    }
+
+    let home = tempfile::tempdir().expect("tempdir for FF_RDP_HOME");
+    let registry_dir = home.path().join(".ff-rdp");
+    std::fs::create_dir_all(&registry_dir).expect("create registry dir");
+
+    let dead_pid = spawn_and_reap_child_pid();
+    let live_pid = std::process::id();
+
+    let dead_json = serde_json::json!({
+        "profile": "slow-3g",
+        "set_at": "2026-08-09T00:00:00Z",
+        "daemon_pid": dead_pid,
+    });
+    let live_json = serde_json::json!({
+        "profile": "slow-3g",
+        "set_at": "2026-08-09T00:00:00Z",
+        "daemon_pid": live_pid,
+    });
+    let dead_path = registry_dir.join("daemon.19100.throttle.json");
+    let live_path = registry_dir.join("daemon.19101.throttle.json");
+    std::fs::write(
+        &dead_path,
+        serde_json::to_string_pretty(&dead_json).unwrap(),
+    )
+    .expect("write dead throttle state");
+    std::fs::write(
+        &live_path,
+        serde_json::to_string_pretty(&live_json).unwrap(),
+    )
+    .expect("write live throttle state");
+
+    // Any `launch` sweeps the whole registry directory regardless of which
+    // port it targets — trigger it with a throwaway instance under the same
+    // isolated FF_RDP_HOME.
+    let Some(port) = free_port() else {
+        eprintln!("live_142_throttle_json_gc: no free port — skipping");
+        return;
+    };
+    let out = Command::new(ff_rdp_bin())
+        .env("FF_RDP_HOME", home.path())
+        .args(["launch", "--headless", "--debug-port", &port.to_string()])
+        .output()
+        .expect("launch spawn failed");
+    if !out.status.success() {
+        eprintln!(
+            "live_142_throttle_json_gc: Firefox not available — skipping (stderr={})",
+            String::from_utf8_lossy(&out.stderr)
+        );
+        return;
+    }
+    let json: serde_json::Value = serde_json::from_slice(&out.stdout).expect("launch JSON parse");
+    let pid =
+        u32::try_from(json["results"]["pid"].as_u64().expect("results.pid")).expect("pid fits u32");
+
+    assert!(
+        !dead_path.exists(),
+        "live_142_throttle_json_gc: FAIL — dead-pid throttle state must be \
+         collected by the next launch's sweep"
+    );
+    assert!(
+        live_path.exists(),
+        "live_142_throttle_json_gc: live-pid throttle state must survive the sweep"
+    );
+
+    eprintln!("live_142_throttle_json_gc: PASS — dead entry collected, live entry survived");
+
+    // Clean up the throwaway instance.
+    let _ = Command::new(ff_rdp_bin())
+        .env("FF_RDP_HOME", home.path())
+        .args([
+            "--port",
+            &port.to_string(),
+            "--timeout",
+            "15000",
+            "daemon",
+            "stop",
+        ])
+        .output();
+    kill_pid(pid);
+}
diff --git a/crates/ff-rdp-cli/tests/live/live_142_eval_asi_await.rs b/crates/ff-rdp-cli/tests/live/live_142_eval_asi_await.rs
new file mode 100644
index 0000000..9a1794f
--- /dev/null
+++ b/crates/ff-rdp-cli/tests/live/live_142_eval_asi_await.rs
@@ -0,0 +1,69 @@
+//! Live test for iter-142 Theme E: ASI-separated top-level-await scripts.
+//!
+//! AC: `e2e_eval_asi_await_script` (live half — the mock-server e2e test in
+//! `tests/e2e/eval.rs` can prove the CLI plumbing works but cannot prove the
+//! generated wrapper is valid JS, since the mock returns a canned fixture
+//! regardless of the script sent. This test runs the exact dogfooding
+//! session 63 repro against real Firefox, where an actual `SyntaxError`
+//! would surface as a genuine eval failure.)
+//!
+//! `await Promise.resolve(1)\n42` has no `;` anywhere — pre-iter-142 this
+//! was misclassified as a single expression and wrapped as
+//! `return (\nawait Promise.resolve(1)\n42\n)`, itself invalid JS
+//! (`missing ) in parenthetical`). Post-fix it must both parse and honor
+//! the trailing expression's value (`42`), not silently return `undefined`.
+//!
+//! Runs on the default daemon-mode connection path (no direct-connection
+//! flag anywhere in this suite), per the iteration's run guidance.
+//!
+//! Run with:
+//!   FF_RDP_LIVE_TESTS=1 cargo test-live -p ff-rdp-cli \
+//!       --test live live_142_eval_asi_await -- --nocapture
+
+use std::process::Command;
+
+use crate::common::{LiveFirefox, ff_rdp_bin, live_tests_enabled};
+
+#[test]
+#[ignore = "requires a live Firefox instance — set FF_RDP_LIVE_TESTS=1"]
+fn live_142_eval_asi_await_script() {
+    if !live_tests_enabled() {
+        return;
+    }
+
+    let Some(ff) = LiveFirefox::headless_on_random_port() else {
+        eprintln!("live_142_eval_asi_await_script: Firefox not available — skipping");
+        return;
+    };
+
+    let out = Command::new(ff_rdp_bin())
+        .args([
+            "--host",
+            "127.0.0.1",
+            "--port",
+            &ff.port().to_string(),
+            "eval",
+            "await Promise.resolve(1)\n42",
+        ])
+        .output()
+        .expect("live_142_eval_asi_await_script: eval spawn failed");
+
+    assert!(
+        out.status.success(),
+        "live_142_eval_asi_await_script: FAIL — ASI-separated await script must \
+         not produce a SyntaxError — stdout={} stderr={}",
+        String::from_utf8_lossy(&out.stdout),
+        String::from_utf8_lossy(&out.stderr)
+    );
+
+    let json: serde_json::Value = serde_json::from_slice(&out.stdout)
+        .expect("live_142_eval_asi_await_script: eval JSON parse");
+
+    assert_eq!(
+        json["results"], 42,
+        "live_142_eval_asi_await_script: the trailing expression's value must be \
+         honored, not silently dropped as undefined — got: {json}"
+    );
+
+    eprintln!("live_142_eval_asi_await_script: PASS — results=42, no SyntaxError");
+}
diff --git a/crates/ff-rdp-cli/tests/live/main.rs b/crates/ff-rdp-cli/tests/live/main.rs
index d293cf4..a774ab2 100644
--- a/crates/ff-rdp-cli/tests/live/main.rs
+++ b/crates/ff-rdp-cli/tests/live/main.rs
@@ -53,6 +53,9 @@ mod live_138_navigation_truthfulness_2;
 mod live_139_perf_honesty_2;
 mod live_140_element_targeting;
 mod live_141_output_hygiene;
+mod live_142_daemon_stop_pid_honesty;
+mod live_142_disk_growth;
+mod live_142_eval_asi_await;
 mod live_61l;
 mod live_61q_resource_bus;
 mod live_61r_eval;
diff --git a/kb/iterations/iteration-142-session-hygiene.md b/kb/iterations/iteration-142-session-hygiene.md
index 630b1d7..27bcd7e 100644
--- a/kb/iterations/iteration-142-session-hygiene.md
+++ b/kb/iterations/iteration-142-session-hygiene.md
@@ -13,7 +13,7 @@ dogfood_path: |
   ff-rdp navigate https://www.bbc.com/news --port 6100
   # → non-Sourcepoint CMP: must either dismiss it or warn that it did not
 first_call_sites: []
-status: planned
+status: in-progress
 ---
 
 # Iteration 142: session hygiene — daemon stop, disk growth, consent coverage, eval edges
@@ -115,22 +115,48 @@ in.
   (`ff-rdp click "#bbccookies-prompt button, #cookiePrompt button, #cookiePrompt a"` — the third
   alternative is a policy link). Hints should prefer buttons over links.
 
-## Acceptance Criteria
-
-- [ ] live_142_daemon_stop_no_false_error: `daemon stop` after `launch` exits 0 and reports the
-      Firefox pid that `launch` returned
-- [ ] live_142_profile_growth_bounded: repeated launch/stop cycles do not leave unbounded temp
-      profiles — name the chosen policy in the test
-- [ ] live_142_throttle_json_gc: throttle state files for dead pids are collected; live ones are not
-- [ ] unit_legacy_spawn_lock_collected: the port-less `daemon.spawn.lock` name is collectable
-- [ ] live_142_auto_consent_honest: on a page whose CMP is not handled, `auto_consent` does not
-      report success — a warning names what was found
-- [ ] live_142_bbc_cmp_dismissed: BBC's cookie banner is dismissed by `consent accept`
-- [ ] live_142_full_page_no_duplicate_header: full-page capture of a sticky-header page has no
-      repeated header band
-- [ ] e2e_eval_asi_await_script: an ASI-separated await script parses without wrapper leakage
-- [ ] e2e_wait_sleep_form: a plain duration wait exists and works
-- [ ] live_142_console_locale_pinned: console output is locale-stable regardless of system locale
+## Acceptance Criteria [6/10]
+
+- [x] live_142_daemon_stop_no_false_error: `daemon stop` after `launch` exits 0 and reports the
+      Firefox pid that `launch` returned — see
+      `crates/ff-rdp-cli/tests/live/live_142_daemon_stop_pid_honesty.rs`; root cause was
+      `launch-record.json` being a single global file clobbered by concurrent ports, fixed by
+      scoping it per port (`daemon_record.rs`)
+- [x] live_142_profile_growth_bounded: repeated launch/stop cycles do not leave unbounded temp
+      profiles — name the chosen policy in the test — see
+      `crates/ff-rdp-cli/tests/live/live_142_disk_growth.rs::live_142_profile_growth_bounded`;
+      policy: a dead-owner-pid profile is reclaimed by the very next `launch`, not gated by the
+      7-day age threshold (`util/profile_dir.rs::prune_orphan_profiles`)
+- [x] live_142_throttle_json_gc: throttle state files for dead pids are collected; live ones are not
+      — see `crates/ff-rdp-cli/tests/live/live_142_disk_growth.rs::live_142_throttle_json_gc`
+      (`daemon/throttle_state.rs::gc_stale_throttle_states`)
+- [x] unit_legacy_spawn_lock_collected: the port-less `daemon.spawn.lock` name is collectable —
+      see `crates/ff-rdp-cli/src/daemon/registry.rs::unit_legacy_spawn_lock_collected`
+- [deferred — new plan: kb/iterations/iteration-144-session-hygiene-followup.md] live_142_auto_consent_honest:
+      on a page whose CMP is not handled, `auto_consent` does not report success — a warning
+      names what was found. `launch`'s `auto_consent` field is set from the CLI flag alone
+      (`commands/launch.rs:603`) and `launch` returns before any page loads, so it structurally
+      cannot attest to a real dismiss within this iteration's scope — see the follow-up plan's
+      "Why these three were deferred" section
+- [deferred — new plan: kb/iterations/iteration-144-session-hygiene-followup.md] live_142_bbc_cmp_dismissed:
+      BBC's cookie banner is dismissed by `consent accept`
+- [deferred — new plan: kb/iterations/iteration-144-session-hygiene-followup.md] live_142_full_page_no_duplicate_header:
+      full-page capture of a sticky-header page has no repeated header band — deferred to avoid
+      touching iteration-135's stitching fix without dedicated pixel-level before/after
+      verification
+- [x] e2e_eval_asi_await_script: an ASI-separated await script parses without wrapper leakage —
+      see `crates/ff-rdp-cli/tests/e2e/eval.rs::e2e_eval_asi_await_script` and
+      `crates/ff-rdp-cli/tests/live/live_142_eval_asi_await.rs::live_142_eval_asi_await_script`
+      (`commands/eval.rs::top_level_statement_boundaries`, `wrap_top_level_await`)
+- [x] e2e_wait_sleep_form: a plain duration wait exists and works — see
+      `crates/ff-rdp-cli/tests/e2e/wait.rs::e2e_wait_sleep_form` (`commands/wait.rs`,
+      `--sleep-ms` / legacy `--time` alias)
+- [deferred — new plan: kb/iterations/iteration-144-session-hygiene-followup.md] live_142_console_locale_pinned:
+      console output is locale-stable regardless of system locale. `launch`'s `USER_JS` already
+      pins `intl.accept_languages`/`intl.locale.requested`/`intl.locale.matchOS` (since
+      iter-61j) yet dogfooding session 63 still observed German output — the implementation
+      environment for this iteration has no non-English-locale Firefox to reproduce with, so a
+      fix cannot be verified here; see the follow-up plan
 
 ## Notes
 
diff --git a/kb/iterations/iteration-144-session-hygiene-followup.md b/kb/iterations/iteration-144-session-hygiene-followup.md
new file mode 100644
index 0000000..0a7de86
--- /dev/null
+++ b/kb/iterations/iteration-144-session-hygiene-followup.md
@@ -0,0 +1,114 @@
+---
+branch: iter-144/session-hygiene-followup
+date: 2026-08-11
+depends_on:
+  - kb/iterations/iteration-142-session-hygiene.md
+dogfood_path: |
+  ff-rdp launch --headless --auto-consent --port 6100
+  ff-rdp navigate https://www.bbc.com/news --port 6100
+  ff-rdp tabs --port 6100
+  # → auto_consent must not report success unless something was actually
+  #   dismissed; a Consent-O-Matic Options tab must not pollute --tab N indices
+  ff-rdp screenshot --full-page --port 6100
+  # → BBC News full-page capture must not duplicate the sticky header
+first_call_sites: []
+status: planned
+---
+
+# Iteration 144: session hygiene follow-up — consent honesty, screenshot dedup, locale
+
+From [[dogfooding-session-63]], carried over from [[iteration-142-session-hygiene]] — Themes C
+and D, plus the console-locale item from Theme F, were deferred rather than landed unverified.
+iteration-142's own Notes section explicitly sanctions this: "Themes are independent; if the
+iteration runs long, land [what verifies] and defer [what doesn't] to a sibling plan rather than
+ticking ACs that were not verified." iteration-142 landed Themes A, B, E, and the `wait
+--sleep-ms` half of Theme F with live-Firefox-verified fixes; this plan picks up the rest.
+
+## Why these three were deferred (not just "ran out of time")
+
+- **Theme C (`--auto-consent` honesty)**: `launch --auto-consent`'s `auto_consent: true` field is
+  set unconditionally from the CLI flag (`crates/ff-rdp-cli/src/commands/launch.rs:603`) — it
+  reports "the extension was installed", not "something was dismissed". `launch` returns before
+  any page is loaded, so it structurally *cannot* know at that point whether the
+  Consent-O-Matic extension will find/dismiss anything later. Making the field honest requires
+  either renaming its semantics (`extension_installed` vs. a real dismiss signal) or moving the
+  honesty check to `navigate`/`consent accept` — a design decision affecting the JSON contract of
+  at least two commands, not a same-iteration drop-in fix.
+- **Theme C (BBC CMP coverage)**: adding a second CMP adapter (`#bbccookies-continue-button`)
+  needs its own scoped design (how does auto-detection choose between Sourcepoint and a
+  BBC-style adapter without site-specific hardcoding?) plus a live network test against
+  www.bbc.com — reasonable scope for a dedicated iteration, not a bolt-on.
+- **Theme D (full-page screenshot header dedup)**: the stitching pass lives in the same code
+  iteration-135 (screenshot-ff153-capture-drift) hardened against real capture-quality
+  regressions; freezing sticky/fixed elements mid-stitch is exactly the kind of change that
+  needs careful before/after pixel verification against that iteration's fixtures, not a quick
+  pass.
+- **Theme F (console locale pinning)**: `crates/ff-rdp-cli/src/commands/launch.rs`'s `USER_JS`
+  constant *already* sets `intl.accept_languages`, `intl.locale.requested`, and
+  `intl.locale.matchOS` to pin English — added all the way back in iter-61j (dogfood-51), git
+  history confirms (`git log -S intl.accept_languages`). Dogfooding session 63 observed German
+  console output anyway, on a *later* iteration. This means either (a) the existing pref pin is
+  insufficient because the underlying Firefox binary has no `en-US` language pack installed (a
+  requested locale a browser can't satisfy silently falls back — a real, known Firefox behavior
+  on distro packages that ship only a localized langpack) and a different fix is needed (e.g.
+  bundling/detecting available langpacks, or a different pref), or (b) the report predates the
+  iter-61j fix and is stale. **This iteration's implementer has no non-English-locale Firefox
+  available to reproduce with** — the dev environment is English macOS. Do not guess at a fix
+  without reproducing the symptom first (per the run guidance below); if a non-English Firefox
+  build/langpack cannot be obtained, say so and re-defer rather than landing an unverifiable
+  "fix".
+
+## Themes
+
+### Theme C — `--auto-consent` honesty + BBC-style CMP coverage
+
+Two asks, potentially two sub-iterations if the first turns out to need more design than expected:
+
+1. Decide what `launch`'s `auto_consent` field should mean now that it can't attest to a real
+   dismiss. Candidates: rename to `auto_consent_extension_installed` (keep `auto_consent` for a
+   future field that *can* attest, once one exists) and add a genuine dismiss-attestation signal
+   surfaced by `navigate` or a new `consent status`. Whichever direction, `--help`/docs must match
+   and existing consumers of the `auto_consent` field (grep before renaming) must not silently
+   break — this may itself want a small research note before code.
+2. Add a BBC-style CMP adapter (`#bbccookies-continue-button` / "Yes, I agree") to whatever
+   auto-detection `consent accept` uses today, without hardcoding to BBC specifically if a more
+   general non-Sourcepoint pattern exists (check what heuristics Consent-O-Matic itself already
+   ships before writing a bespoke one).
+3. `--auto-consent` leaves a permanent `Consent-O-Matic Options` tab in every `tabs` listing —
+   filter it out of `tabs`, or close it once the extension has initialized.
+
+### Theme D — full-page screenshot duplicates the sticky header
+
+Freeze sticky/fixed elements after the first capture band, or capture in a single pass where
+possible. Verify against iteration-135's fixtures (`kb/iterations/iteration-135-*`) before and
+after — that iteration exists specifically because screenshot stitching is easy to regress.
+
+### Theme F (carryover) — console locale reproducibility
+
+Reproduce the symptom first: obtain or build a Firefox with a non-English UI locale (a langpack
+install, or `MOZ_LOCALE`-style override, or a `--lang` flag if headless Firefox has one) and
+confirm German (or any non-English) console/error text actually appears despite the existing
+`intl.*` prefs in `USER_JS`. Only then diagnose why the existing pin doesn't hold. If no
+non-English Firefox can be obtained in the implementation environment, defer again with a note
+rather than shipping a guess.
+
+## Acceptance Criteria
+
+- [ ] live_144_auto_consent_field_honest: `launch --auto-consent`'s reported field never claims a
+      dismiss happened when `tabs`/a follow-up check shows the CMP banner still present
+- [ ] live_144_bbc_cmp_dismissed: `consent accept` dismisses BBC's cookie banner
+      (`#bbccookies-continue-button`) on www.bbc.com
+- [ ] live_144_no_consent_o_matic_tab_leak: `tabs` after `--auto-consent` does not include a
+      `Consent-O-Matic Options` entry (or it is filtered from the listing)
+- [ ] live_144_full_page_no_duplicate_header: full-page capture of a sticky-header page (BBC
+      News or an equivalent fixture) has no repeated header band, verified pixel-level
+- [ ] live_144_console_locale_pinned: console output is locale-stable on a genuinely
+      non-English-locale Firefox — name the reproduction method used in the test, since this AC
+      cannot be ticked without one
+
+## Notes
+
+Same independence rule as iteration-142: these three sub-themes don't depend on each other. If
+Theme F still can't be reproduced in whatever environment implements this plan, split it into its
+own plan again rather than blocking C/D, and say so explicitly rather than silently dropping the
+AC.

From b7abb6cee16294a73531100adc7a84ff396157b0 Mon Sep 17 00:00:00 2001
From: Jean-Pierre Bergamin <james@ractive.ch>
Date: Tue, 11 Aug 2026 14:53:03 +0200
Subject: [PATCH 2/4] docs(iter-142): fix AC evidence references for
 ac-fidelity-check

Move backtick-quoted test-function references onto each checkbox's first
line so the ac-fidelity gate's diff-evidence heuristic can find them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 kb/iterations/iteration-142-session-hygiene.md | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/kb/iterations/iteration-142-session-hygiene.md b/kb/iterations/iteration-142-session-hygiene.md
index 27bcd7e..5bc3bf4 100644
--- a/kb/iterations/iteration-142-session-hygiene.md
+++ b/kb/iterations/iteration-142-session-hygiene.md
@@ -144,13 +144,12 @@ in.
       full-page capture of a sticky-header page has no repeated header band — deferred to avoid
       touching iteration-135's stitching fix without dedicated pixel-level before/after
       verification
-- [x] e2e_eval_asi_await_script: an ASI-separated await script parses without wrapper leakage —
-      see `crates/ff-rdp-cli/tests/e2e/eval.rs::e2e_eval_asi_await_script` and
-      `crates/ff-rdp-cli/tests/live/live_142_eval_asi_await.rs::live_142_eval_asi_await_script`
-      (`commands/eval.rs::top_level_statement_boundaries`, `wrap_top_level_await`)
-- [x] e2e_wait_sleep_form: a plain duration wait exists and works — see
-      `crates/ff-rdp-cli/tests/e2e/wait.rs::e2e_wait_sleep_form` (`commands/wait.rs`,
-      `--sleep-ms` / legacy `--time` alias)
+- [x] e2e_eval_asi_await_script (`e2e_eval_asi_await_script` in `tests/e2e/eval.rs`,
+      `live_142_eval_asi_await_script` in `tests/live/live_142_eval_asi_await.rs`): an
+      ASI-separated await script parses without wrapper leakage — fixed in
+      `commands/eval.rs::top_level_statement_boundaries` / `wrap_top_level_await`
+- [x] e2e_wait_sleep_form: a plain duration wait exists and works — see `e2e_wait_sleep_form` in
+      `tests/e2e/wait.rs` (`commands/wait.rs`, `sleep_ms` / legacy `--time` alias)
 - [deferred — new plan: kb/iterations/iteration-144-session-hygiene-followup.md] live_142_console_locale_pinned:
       console output is locale-stable regardless of system locale. `launch`'s `USER_JS` already
       pins `intl.accept_languages`/`intl.locale.requested`/`intl.locale.matchOS` (since

From 1b4265e9e326b975ab690c0b80c62193f3ca286f Mon Sep 17 00:00:00 2001
From: Jean-Pierre Bergamin <james@ractive.ch>
Date: Tue, 11 Aug 2026 15:11:25 +0200
Subject: [PATCH 3/4] docs(iter-142): document sleep-ms, GC policy, and
 await-return semantics

README and --help text had fallen behind the iter-142 code: the new
`wait --sleep-ms` form, the launch-time GC sweep for stale spawn
locks/throttle-state/legacy locks, the dead-owner-pid immediate-reclaim
policy, and eval's new "auto-return the trailing bare expression"
await semantics were all undocumented.
---
 README.md                         | 14 ++++++++++++++
 crates/ff-rdp-cli/src/cli/args.rs | 13 ++++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 9b84106..7abc41f 100644
--- a/README.md
+++ b/README.md
@@ -224,6 +224,9 @@ ff-rdp wait --text "Success" --wait-timeout 10000
 # Wait for a JavaScript expression to become truthy
 ff-rdp wait --eval "document.readyState === 'complete'"
 
+# Plain sleep, no condition or Firefox connection needed (--time is a legacy alias)
+ff-rdp wait --sleep-ms 2000
+
 # List cookies
 ff-rdp cookies
 
@@ -380,6 +383,17 @@ ff-rdp --no-daemon eval "1+1"
   whether that owner process is still alive and, if so, keeps the profile
   regardless of age. This is a positive "still in use" signal that closes the
   gap where a fully-idle-but-running Firefox could look stale by mtime alone.
+- A marker naming a **dead** PID is reclaimed by the very next `launch`
+  immediately, without waiting out the age threshold — a dead owner is
+  definitive proof of abandonment, not just "old enough to guess at" (iter-142;
+  fixes an observed 62 profiles / 2.7 GB accumulating in a single day, all
+  younger than the old 7-day gate).
+- Every `ff-rdp launch` also sweeps `~/.ff-rdp/` housekeeping files: stale
+  per-port spawn locks, the legacy port-less `daemon.spawn.lock` name, and
+  `daemon.<port>.throttle.json` state files whose recorded daemon PID is no
+  longer alive (iter-142). Previously this only ran on the rare
+  daemon-autostart path, so a session that reused an already-running daemon
+  never triggered it at all.
 - `ff-rdp profiles list` / `ff-rdp profiles prune` inspect and reclaim the
   profile directory explicitly; `ff-rdp doctor` warns when the profile store
   grows past 100 entries or 1 GiB. `profiles prune --all` skips the age gate
diff --git a/crates/ff-rdp-cli/src/cli/args.rs b/crates/ff-rdp-cli/src/cli/args.rs
index e01bd36..39b1d9d 100644
--- a/crates/ff-rdp-cli/src/cli/args.rs
+++ b/crates/ff-rdp-cli/src/cli/args.rs
@@ -493,9 +493,16 @@ scope and `const`/`let` declarations never leak across calls. The
 Top-level `await` works (iter-132): `ff-rdp eval 'await Promise.resolve(41) + 1'`
 resolves to 42. Scripts containing `await` are transparently wrapped in an
 async IIFE before evaluation — no `--async` flag or extra syntax needed. A
-single-expression script (no top-level `;`) auto-returns its value; a
-multi-statement script needs an explicit `return` to surface a value (it
-still runs either way — no SyntaxError).
+single-expression script auto-returns its value. A multi-statement script
+(statements separated by `;` OR by a plain newline — iter-142 fixed
+ASI-separated scripts being misclassified and leaking the wrapper into a
+SyntaxError) also auto-returns its value if the LAST statement is a bare
+expression, e.g. `let x = await foo(); x + 1` returns `x + 1` — every
+earlier statement still runs unwrapped, so an explicit `return` earlier in
+the script keeps working. Only when the last statement is not a bare
+expression (a declaration, a control-flow construct) does the script need
+its own explicit `return` to surface a value (it still runs either way — no
+SyntaxError).
 
 Output: {\"results\": <value>, \"total\": 1, \"meta\": {...}}
 

From 283ef16d09916b7d18ddbd1e0d8e6fbd1d129261 Mon Sep 17 00:00:00 2001
From: Jean-Pierre Bergamin <james@ractive.ch>
Date: Tue, 11 Aug 2026 15:50:04 +0200
Subject: [PATCH 4/4] fix(iter-142): close child handle before liveness check
 in throttle GC test

unit_gc_stale_throttle_states_removes_dead_keeps_live failed on Windows CI:
the test's own std::process::Child stayed in scope through the
is_process_alive check. On Windows, OpenProcess succeeds for an
already-exited process as long as any handle to it (including our own
Child) is still open, so the test's dead-pid check spuriously reported
"alive" and the GC never removed the entry. Scope the spawn+wait into a
helper that drops Child before returning the pid, matching the working
pattern already used in util/profile_dir.rs's spawn_and_reap_child_pid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../ff-rdp-cli/src/daemon/throttle_state.rs   | 38 ++++++++++++++-----
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/crates/ff-rdp-cli/src/daemon/throttle_state.rs b/crates/ff-rdp-cli/src/daemon/throttle_state.rs
index 5a5033b..5644b47 100644
--- a/crates/ff-rdp-cli/src/daemon/throttle_state.rs
+++ b/crates/ff-rdp-cli/src/daemon/throttle_state.rs
@@ -257,14 +257,22 @@ mod tests {
         );
     }
 
-    /// AC `live_142_throttle_json_gc` (unit half): a throttle state whose
-    /// `daemon_pid` is dead is removed by the sweep; one whose `daemon_pid`
-    /// is alive (the current test process) is left alone.
-    #[test]
-    fn unit_gc_stale_throttle_states_removes_dead_keeps_live() {
-        let dir = tempfile::tempdir().expect("tempdir");
-
-        // Dead daemon pid (spawn+reap a trivial child for a portable dead PID).
+    /// Spawn+reap a trivial child process and return its now-dead PID.
+    ///
+    /// The spawn happens inside this function so the `Child` handle is
+    /// dropped before the caller ever sees the PID. This matters on
+    /// Windows: `is_process_alive` (`daemon/process.rs`) checks liveness
+    /// via `OpenProcess`, which succeeds for an already-exited process as
+    /// long as *any* handle to it (including our own `std::process::Child`)
+    /// is still open — the process object isn't destroyed, and the PID
+    /// isn't eligible for reuse, until the last handle closes. A test that
+    /// keeps its own `Child` alive across the `is_process_alive` check
+    /// therefore self-defeats: the check reports "alive" not because the
+    /// process is running, but because the test's own handle is still open.
+    /// Scoping the spawn to this function's return boundary (like
+    /// `util/profile_dir.rs`'s equivalent helper) closes that handle before
+    /// any liveness check runs.
+    fn spawn_and_reap_child_pid() -> u32 {
         #[cfg(unix)]
         let mut child = std::process::Command::new("true")
             .spawn()
@@ -274,8 +282,20 @@ mod tests {
             .args(["/C", "exit", "0"])
             .spawn()
             .expect("spawn cmd exit");
-        let dead_pid = child.id();
+        let pid = child.id();
         child.wait().expect("child exits");
+        // `child` drops here (handle closes) before the caller sees `pid`.
+        pid
+    }
+
+    /// AC `live_142_throttle_json_gc` (unit half): a throttle state whose
+    /// `daemon_pid` is dead is removed by the sweep; one whose `daemon_pid`
+    /// is alive (the current test process) is left alone.
+    #[test]
+    fn unit_gc_stale_throttle_states_removes_dead_keeps_live() {
+        let dir = tempfile::tempdir().expect("tempdir");
+
+        let dead_pid = spawn_and_reap_child_pid();
         std::thread::sleep(std::time::Duration::from_millis(50));
 
         write_throttle_state_in(dir.path(), 6000, &sample_state(dead_pid)).expect("write dead");