diff --git a/12-fix-rdp-bigres.sh b/12-fix-rdp-bigres.sh
index 1bfdaa1..c6528a3 100755
--- a/12-fix-rdp-bigres.sh
+++ b/12-fix-rdp-bigres.sh
@@ -105,6 +105,27 @@ else
   systemctl restart xrdp
 fi
 echo "EGFX disabled (drdynvc=false) — clients now negotiate classic codecs."
+
+###############################################################################
+# Part 5 — session hygiene (2026-09-01 night, #611 close-out)
+#
+# - sesman.ini: KillDisconnected=false + DisconnectedTimeLimit=0 — human
+#   keeps apps up 24x7 and reconnects at will.
+# - xrdp.ini: tcp_nodelay/tcp_keepalive=true so dead client connections
+#   (iPad backgrounding Jump) are detected; reconnects then RESUME the
+#   existing session instead of spawning duplicates.
+# - THE CLEAN SLATE, when a login black-screens and nothing else works:
+#   the systemd --user manager accumulates poisoned state across session
+#   generations (stale DISPLAY env, wedged dbus name waits — plasma units
+#   are Type=dbus and hang "activating" at ~0% CPU). Recycle it:
+#       systemctl stop user@<uid>
+#   then reconnect (fresh manager = clean login at ANY resolution).
+#   pkill of kwin/plasmashell/Xorg alone does NOT reach this layer.
+###############################################################################
+
+grep -q '^DisconnectedTimeLimit=0' /etc/xrdp/sesman.ini || sed -i 's/^DisconnectedTimeLimit=.*/DisconnectedTimeLimit=0/' /etc/xrdp/sesman.ini
+grep -qE '^tcp_keepalive' /etc/xrdp/xrdp.ini || printf 'tcp_keepalive=true\ntcp_nodelay=true\n' >> /etc/xrdp/xrdp.ini
+echo "session hygiene present (DisconnectedTimeLimit=0, tcp keepalives)."
 echo "kwin unit override: /etc/systemd/user/plasma-kwin_x11.service.d/bigres-timeout.conf"
 echo
 echo "If a session is currently black: loginctl terminate-session <id> (or"
diff --git a/TRACKING.md b/TRACKING.md
index bb0aa7e..f8e4207 100644
--- a/TRACKING.md
+++ b/TRACKING.md
@@ -16,7 +16,7 @@ One table, updated in place at each checkpoint. States: done ✅ / doing 🔄 /
 | OPT-10 | integ | ⏳ | #605: k8s join (Q11, blocked by #601) + proxmox-ctl token (Q12) |
 | #606 | gpu | 🔄 | Quadro 4000 passthrough STAGED on 5111 (vfio ids + q35 + hostpci0, staged/gpu-passthrough.md); activates at the human's pre-Friday roll; nouveau-only on kernel 6.12 (no CUDA/NVENC — compute cards come with #601) |
 | #610 | fleet | ✅ | Open Terminal 9-account fleet (tailscale-only :30000-30008) + OpenWebUI UAT PASS |
-| #611 | rdp | 🔄 | 3-layer fix + EGFX off (drdynvc=false) + autologin DISABLED per ruling 09-01 (console greeter at boot; RDP = primary desktop). Awaiting human visual confirm: bars gone on monitor + iPad |
+| #611 | rdp | ✅ | UAT PASS both accounts 2026-09-01 evening (5160x2160 clean, iPad res clean). Fix chain: kwin compositor-off + 5min timeout; max_bpp=24 (16K bitmap-row limit was the bars); drdynvc=false; autologin off; DisconnectedTimeLimit=0 (24x7 kept) + tcp keepalives; clean-slate = stop user@UID (manager recycle), not just pkill |
 | #612 | dotfiles | ✅ | UAT PASS 2026-09-01 (human): omz+v2 base + kali addendum both accounts; p10k fallback via KALI_PROMPT=0 |
 | #615 | microvm+rebuild | 🔄 | microvm tooling LIVE + REBUILD.md/docs/state + docs synced + regular-VM lane PROVEN (libvirt q35, REGULAR-VMS.md); human UAT pending |
 | #616 | macos | ⏳ | macOS VM on pfv-tsys5 (headless CI + iOS dev) — blocked by #601 |