diff --git a/scripts/ralph/prd.json b/scripts/ralph/prd.json
index c5db05d..d896490 100644
--- a/scripts/ralph/prd.json
+++ b/scripts/ralph/prd.json
@@ -653,7 +653,7 @@
         "Typecheck passes"
       ],
       "priority": 40,
-      "passes": false,
+      "passes": true,
       "notes": "with_cdp holds the state Mutex for the entire CDP round-trip (up to 30s). Background listener tasks block on the same lock. Currently unused (router uses get_cdp) but it's a public API that invites deadlock bugs."
     },
     {
diff --git a/scripts/ralph/progress.txt b/scripts/ralph/progress.txt
index ba74a76..4a750da 100644
--- a/scripts/ralph/progress.txt
+++ b/scripts/ralph/progress.txt
@@ -691,3 +691,12 @@ Started: Tue Mar 17 04:32:06 AM PDT 2026
   - `drain(..)` is idiomatic for consuming and clearing a Vec in one step
   - Abort tasks BEFORE closing the resource they depend on (CDP client) to avoid race conditions
 ---
+
+## 2026-03-17 - US-040
+- Removed `with_cdp()` method from BrowserRuntime that held the state Mutex across entire CDP round-trips (up to 30s), which could cause deadlocks with background listener tasks
+- No callers existed in the codebase; all router handlers already use `get_cdp()` which returns `Arc<CdpClient>` without holding the lock
+- Files changed: `browser_runtime.rs`
+- **Learnings for future iterations:**
+  - `get_cdp()` is the canonical pattern for accessing the CDP client - it returns an `Arc<CdpClient>` so callers don't hold the state lock during I/O
+  - Dead public API methods should be removed proactively to avoid inviting misuse patterns
+---