@mrrlin-dev/mcp 0.3.15 → 0.3.20

package/dist/bin.cjs

@@ -20985,10 +20985,15 @@ var import_node_child_process4 = require("node:child_process");
 var import_node_crypto5 = __toESM(require("node:crypto"), 1);
 
 // src/turn-replay-buffer.ts
-var DEFAULT_GRACE_MS = 3e4;
 var DEFAULT_MAX_EVENTS = 2e3;
 var DEFAULT_MAX_BYTES = 4e6;
-var DEFAULT_POST_COMPLETION_TTL_MS = 1e4;
+var DEFAULT_ACK_LINGER_MS = 1e4;
+var DEFAULT_RESULT_RETENTION_MS = 36e5;
+function resultRetentionMs() {
+  const raw = (process.env.MRRLIN_DIRECTOR_BRIDGE_RESULT_RETENTION_SECONDS ?? "").trim();
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed * 1e3 : DEFAULT_RESULT_RETENTION_MS;
+}
 function createReplayBuffer(opts) {
   return {
     turnId: opts.turnId,
@@ -21000,14 +21005,15 @@ function createReplayBuffer(opts) {
     terminalDelivered: false,
     replaying: false,
     outboundQueue: [],
-    graceTimer: null,
     finishedAt: null,
+    finishedSuspendedMs: null,
+    ackedAt: null,
     bytesUsed: 0,
-    graceMs: opts.graceMs ?? DEFAULT_GRACE_MS,
     maxEvents: opts.maxEvents ?? DEFAULT_MAX_EVENTS,
     maxBytes: opts.maxBytes ?? DEFAULT_MAX_BYTES,
-    postCompletionTtlMs: opts.postCompletionTtlMs ?? DEFAULT_POST_COMPLETION_TTL_MS,
-    triggerGrace: null
+    ackLingerMs: opts.ackLingerMs ?? DEFAULT_ACK_LINGER_MS,
+    retentionMs: opts.retentionMs ?? resultRetentionMs(),
+    triggerDetach: null
   };
 }
 function recordOutgoing(buf, msg) {
@@ -21016,9 +21022,10 @@ function recordOutgoing(buf, msg) {
   buf.events.push(entry);
   buf.bytesUsed += approxByteSize(msg);
   while ((buf.events.length > buf.maxEvents || buf.bytesUsed > buf.maxBytes) && buf.events.length > 0) {
-    const dropped = buf.events.shift();
-    if (!dropped) break;
-    buf.bytesUsed -= approxByteSize(dropped.msg);
+    const head = buf.events[0];
+    if (!head || isTerminalEvent(head.msg)) break;
+    buf.events.shift();
+    buf.bytesUsed -= approxByteSize(head.msg);
   }
   return entry;
 }
@@ -21027,19 +21034,7 @@ function eventsAfter(buf, lastSeq) {
   if (first && lastSeq < first.seq - 1) return null;
   return buf.events.filter((e) => e.seq > lastSeq);
 }
-function enterGrace(buf, onExpire) {
-  if (buf.graceTimer !== null) return;
-  buf.state = "grace";
-  buf.graceTimer = setTimeout(onExpire, buf.graceMs);
-}
-function cancelGrace(buf) {
-  if (buf.graceTimer !== null) {
-    clearTimeout(buf.graceTimer);
-    buf.graceTimer = null;
-  }
-  if (buf.state === "grace") buf.state = "live";
-}
-function recordInterrupted(buf) {
+function recordInterrupted(buf, now = Date.now(), suspendedMsNow = 0) {
   if (buf.terminalDelivered) return null;
   const msg = {
     type: "event",
@@ -21047,16 +21042,31 @@ function recordInterrupted(buf) {
   };
   const entry = recordOutgoing(buf, msg);
   buf.terminalDelivered = true;
+  if (buf.finishedAt === null) {
+    buf.finishedAt = now;
+    buf.finishedSuspendedMs = suspendedMsNow;
+  }
   return entry;
 }
-function markCompleted(buf, now) {
+function markCompleted(buf, now, suspendedMsNow = 0) {
   buf.state = "completed";
   buf.finishedAt = now;
+  buf.finishedSuspendedMs = suspendedMsNow;
 }
-function shouldGc(buf, now) {
-  if (buf.state !== "completed") return false;
+function recordAck(buf, turnId, lastSeq, now) {
+  if (buf.turnId !== turnId) return false;
+  if (lastSeq !== buf.lastSeq) return false;
+  if (buf.state !== "completed" && buf.state !== "interrupted") return false;
+  if (buf.ackedAt === null) buf.ackedAt = now;
+  return true;
+}
+function shouldGc(buf, now, suspendedMsNow = 0) {
+  if (buf.state !== "completed" && buf.state !== "interrupted") return false;
   if (buf.finishedAt === null) return false;
-  return now - buf.finishedAt > buf.postCompletionTtlMs;
+  if (buf.ackedAt !== null) return now - buf.ackedAt > buf.ackLingerMs;
+  const suspendedSinceFinish = suspendedMsNow - (buf.finishedSuspendedMs ?? suspendedMsNow);
+  const awakeElapsed = now - buf.finishedAt - Math.max(0, suspendedSinceFinish);
+  return awakeElapsed > buf.retentionMs;
 }
 function incrementBindEpoch(buf) {
   return ++buf.bindEpoch;
@@ -21077,6 +21087,41 @@ function approxByteSize(msg) {
   }
 }
 
+// src/suspension-detector.ts
+var DEFAULT_SUSPEND_TICK_MS = 15e3;
+var DEFAULT_SUSPEND_GAP_MS = 45e3;
+function readPositiveMs(name, fallback) {
+  const raw = (process.env[name] ?? "").trim();
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function suspendTickMs() {
+  return readPositiveMs("MRRLIN_DIRECTOR_BRIDGE_SUSPEND_TICK_MS", DEFAULT_SUSPEND_TICK_MS);
+}
+function suspendGapMs() {
+  return readPositiveMs("MRRLIN_DIRECTOR_BRIDGE_SUSPEND_GAP_MS", DEFAULT_SUSPEND_GAP_MS);
+}
+function createSuspensionDetector(opts) {
+  const tickMs = opts?.tickMs ?? suspendTickMs();
+  const gapMs = opts?.gapMs ?? suspendGapMs();
+  const now = opts?.now ?? Date.now;
+  const setI = opts?.setIntervalFn ?? setInterval;
+  const clearI = opts?.clearIntervalFn ?? clearInterval;
+  let last = now();
+  let suspended = 0;
+  const timer = setI(() => {
+    const t = now();
+    const gap = t - last;
+    last = t;
+    if (gap >= gapMs) suspended += gap - tickMs;
+  }, tickMs);
+  timer.unref?.();
+  return {
+    suspendedMs: () => suspended,
+    dispose: () => clearI(timer)
+  };
+}
+
 // src/replay-state-machine.ts
 function transition(state, event) {
   if (event.kind === "resume" && !event.epochMatch) return { next: "invalid" };
@@ -21084,7 +21129,12 @@ function transition(state, event) {
     case "live":
       switch (event.kind) {
         case "socket_close":
-          return { next: "grace", sideEffects: ["start_grace_timer"] };
+          return { next: "detached", sideEffects: [] };
+        case "resume":
+          return {
+            next: "live",
+            sideEffects: ["rebind_sink_increment_epoch", "replay_drain"]
+          };
         case "codex_terminal":
           return { next: "completed", sideEffects: ["mark_finished"] };
         case "stop":
@@ -21095,35 +21145,22 @@ function transition(state, event) {
         default:
           return { next: "invalid" };
       }
-    case "grace":
+    case "detached":
       switch (event.kind) {
+        case "socket_close":
+          return { next: "detached", sideEffects: [] };
+        // idempotent
         case "resume":
           return {
             next: "live",
-            sideEffects: [
-              "cancel_grace_timer",
-              "rebind_sink_increment_epoch",
-              "replay_drain"
-            ]
-          };
-        case "grace_expire":
-          return {
-            next: "interrupted",
-            sideEffects: ["record_interrupted", "fire_turn_interrupt"]
+            sideEffects: ["rebind_sink_increment_epoch", "replay_drain"]
           };
+        case "codex_terminal":
+          return { next: "completed", sideEffects: ["mark_finished"] };
         case "stop":
           return {
             next: "interrupted",
-            sideEffects: [
-              "cancel_grace_timer",
-              "record_interrupted",
-              "fire_turn_interrupt"
-            ]
-          };
-        case "codex_terminal":
-          return {
-            next: "completed",
-            sideEffects: ["cancel_grace_timer", "mark_finished"]
+            sideEffects: ["record_interrupted", "fire_turn_interrupt"]
           };
         default:
           return { next: "invalid" };
@@ -36481,10 +36518,12 @@ var mrrlinTaskStatusSchema = external_exports.enum([
   "closed_done",
   "closed_no_result"
 ]);
+var mrrlinTerminalTaskStatuses = ["closed_done", "closed_no_result"];
 var mrrlinTaskTypeSchema = external_exports.enum(["task", "bug"]);
 var mrrlinTaskImpactSchema = external_exports.enum(["low", "medium", "high"]);
 var mrrlinAutonomyLevelSchema = external_exports.enum(["auto", "minimal_human", "human_only"]);
 var mrrlinAutoDeploySchema = external_exports.enum(["off", "dev", "prod"]);
+var mrrlinTaskDomainSchema = external_exports.enum(["code", "seo", "marketing", "content"]);
 var mrrlinSpecApprovedSchema = external_exports.enum(["pending", "approved", "skipped", "skipped_legacy"]);
 var mrrlinTaskSourceSchema = external_exports.enum(["fixture-import", "api"]);
 var mrrlinPlanStatusSchema = external_exports.enum(["active", "paused", "done", "archived"]);
@@ -36516,6 +36555,27 @@ function normalizeTaskTags(tags) {
   }
   return [...normalized].sort();
 }
+var terminalTaskStatusSet = new Set(mrrlinTerminalTaskStatuses);
+function isTaskTerminalStatus(status) {
+  return terminalTaskStatusSet.has(status);
+}
+function getActiveBlockedByIds(blockedBy, blockers) {
+  const blockersById = /* @__PURE__ */ new Map();
+  for (const blocker of blockers) {
+    if (!blocker)
+      continue;
+    blockersById.set(blocker.id, blocker.status);
+  }
+  const active = [];
+  for (const blockerId of blockedBy ?? []) {
+    const status = blockersById.get(blockerId);
+    if (!status)
+      continue;
+    if (!isTaskTerminalStatus(status))
+      active.push(blockerId);
+  }
+  return active;
+}
 var mrrlinTaskTagSchema = external_exports.string().min(1).max(40).transform(normalizeTaskTagInput).pipe(external_exports.string().min(1).max(40));
 var mrrlinTaskTagsSchema = external_exports.array(mrrlinTaskTagSchema).default([]).transform(normalizeTaskTags);
 var mrrlinExecutionRunStatusSchema = external_exports.enum([
@@ -36569,6 +36629,10 @@ var mrrlinTaskAssigneeSchema = external_exports.union([external_exports.string()
 var mrrlinTaskSchema = external_exports.object({
   assignee: mrrlinTaskAssigneeSchema,
   autoDeploy: mrrlinAutoDeploySchema,
+  // ADR 0020. OUTPUT-optional (not defaulted-required) so hardcoded task fixtures/mocks across the
+  // codebase need no churn; the DB column is NOT NULL default 'code', so real rows always carry it,
+  // and resolveHeads() treats an absent domain as `code`. Persisted create/update use their own forms.
+  domain: mrrlinTaskDomainSchema.optional(),
   autonomyLevel: mrrlinAutonomyLevelSchema,
   autonomyReason: external_exports.string().min(1).max(240),
   blockedBy: external_exports.array(mrrlinTaskIdSchema),
@@ -36686,7 +36750,10 @@ var mrrlinProjectSummarySchema = external_exports.object({
   emoji: mrrlinProjectEmojiSchema,
   github: mrrlinGithubBindingSchema,
   onboardingKickoffState: external_exports.enum(["pending", "sent"]).nullable().optional(),
-  slug: mrrlinProjectSlugSchema
+  slug: mrrlinProjectSlugSchema,
+  // ADR 0020: default consensus domain for this project's plan/project-scoped specs. Output-optional
+  // (DB column is NOT NULL default 'code') so existing project fixtures/upsert callers need no churn.
+  defaultDomain: mrrlinTaskDomainSchema.optional()
 });
 var mrrlinProjectUpsertSchema = mrrlinProjectSummarySchema.omit({
   onboardingKickoffState: true,
@@ -36735,6 +36802,9 @@ var mrrlinProjectSnapshotSchema = external_exports.object({
 });
 var mrrlinTaskCreateSchema = external_exports.object({
   autoDeploy: mrrlinAutoDeploySchema.default("off"),
+  // Input-optional so existing createTask call sites need no churn; createTask fills 'code' for the
+  // INSERT (the pg column is NOT NULL, so a concrete value is required, not undefined→NULL).
+  domain: mrrlinTaskDomainSchema.optional(),
   autonomyLevel: mrrlinAutonomyLevelSchema.default("minimal_human"),
   autonomyReason: external_exports.string().min(1).max(240).default("Needs human review before automation."),
   category: taxonomyCategorySchema,
@@ -36758,6 +36828,7 @@ var mrrlinTaskUpdateSchema = external_exports.object({
   actor: external_exports.string().min(1).optional(),
   assignee: mrrlinTaskAssigneeSchema.optional(),
   autoDeploy: mrrlinAutoDeploySchema.optional(),
+  domain: mrrlinTaskDomainSchema.optional(),
   autonomyLevel: mrrlinAutonomyLevelSchema.optional(),
   autonomyReason: external_exports.string().min(1).max(240).optional(),
   category: taxonomyCategorySchema.optional(),
@@ -37391,6 +37462,43 @@ var mrrlinInboxItemActionPayloadSchema = external_exports.object({
   // (worktree + push/PR path). Scheduler proposals set it; legacy payloads omit it.
   codeExecution: external_exports.boolean().optional()
 });
+var mrrlinInboxQuestionOptionSchema = external_exports.object({
+  answer: external_exports.string().trim().min(1),
+  description: external_exports.string().trim().min(1),
+  label: external_exports.string().trim().min(1),
+  recommended: external_exports.boolean().optional()
+});
+var mrrlinInboxQuestionOptionsSchema = external_exports.array(mrrlinInboxQuestionOptionSchema).min(1).max(3).superRefine((options, context) => {
+  const labels = /* @__PURE__ */ new Set();
+  const answers = /* @__PURE__ */ new Set();
+  let recommendedCount = 0;
+  for (const [index, option] of options.entries()) {
+    if (labels.has(option.label)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "questionOptions labels must be unique after trimming",
+        path: [index, "label"]
+      });
+    }
+    labels.add(option.label);
+    if (answers.has(option.answer)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "questionOptions answers must be unique after trimming",
+        path: [index, "answer"]
+      });
+    }
+    answers.add(option.answer);
+    if (option.recommended === true)
+      recommendedCount += 1;
+  }
+  if (recommendedCount > 1) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "questionOptions may mark at most one option as recommended"
+    });
+  }
+});
 var mrrlinInboxItemSchema = external_exports.object({
   actionPayload: mrrlinInboxItemActionPayloadSchema.nullable(),
   answer: external_exports.string().nullable(),
@@ -37406,9 +37514,18 @@ var mrrlinInboxItemSchema = external_exports.object({
   origin: external_exports.string().nullable().optional(),
   planId: mrrlinPlanIdSchema.nullable().default(null),
   projectSlug: mrrlinProjectSlugSchema,
+  questionOptions: mrrlinInboxQuestionOptionsSchema.nullable().default(null),
   readAt: external_exports.string().datetime().nullable(),
   status: mrrlinInboxItemStatusSchema,
   taskId: mrrlinTaskIdSchema.nullable()
+}).superRefine((value, context) => {
+  if (value.kind !== "question" && value.questionOptions !== null) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "questionOptions are allowed only on question inbox items",
+      path: ["questionOptions"]
+    });
+  }
 });
 var mrrlinInboxItemCreateSchema = external_exports.object({
   actionPayload: mrrlinInboxItemActionPayloadSchema.nullable().optional(),
@@ -37418,7 +37535,16 @@ var mrrlinInboxItemCreateSchema = external_exports.object({
   kind: mrrlinInboxItemKindSchema,
   origin: external_exports.string().min(1).optional(),
   planId: mrrlinPlanIdSchema.nullable().optional(),
+  questionOptions: mrrlinInboxQuestionOptionsSchema.nullable().optional(),
   taskId: mrrlinTaskIdSchema.nullable().optional()
+}).superRefine((value, context) => {
+  if (value.kind !== "question" && value.questionOptions != null) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "questionOptions are allowed only on question inbox items",
+      path: ["questionOptions"]
+    });
+  }
 });
 var mrrlinInboxItemDecideSchema = external_exports.object({
   answer: external_exports.string().min(1).optional(),
@@ -38608,7 +38734,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.3.15";
+var PKG_VERSION = "0.3.20";
 
 // src/api-base-url.ts
 var DEFAULT_API_BASE_URL = "http://127.0.0.1:8787";
@@ -39370,6 +39496,31 @@ async function driveRun(deps, projectSlug, runId) {
     return legacy != null ? Math.min(legacy, remaining) : remaining;
   };
   const task = await deps.client.getTask(projectSlug, claimed.taskId);
+  const blockerTasks = task.blockedBy.length ? await Promise.all(task.blockedBy.map((blockerTaskId) => deps.client.getTask(projectSlug, blockerTaskId))) : [];
+  const missingBlockers = task.blockedBy.filter((_, index) => !blockerTasks[index]);
+  if (missingBlockers.length > 0) {
+    await failRun(
+      deps,
+      projectSlug,
+      task,
+      runId,
+      leaseId,
+      `task_blocked: run ${runId} targets ${task.id} but blocker tasks could not be loaded: ${missingBlockers.join(", ")}`
+    );
+    return;
+  }
+  const activeBlockers = getActiveBlockedByIds(task.blockedBy, blockerTasks);
+  if (activeBlockers.length > 0) {
+    await failRun(
+      deps,
+      projectSlug,
+      task,
+      runId,
+      leaseId,
+      `task_blocked: run ${runId} targets ${task.id} but active blockers remain open: ${activeBlockers.join(", ")}`
+    );
+    return;
+  }
   const compactEnabled = (process.env.MRRLIN_MCP_COMPACT_DISABLE ?? "").trim() !== "1";
   const context = await gatherContext(deps.client, projectSlug, task, runId);
   const bundle = renderContextBundle(
@@ -39391,7 +39542,11 @@ async function driveRun(deps, projectSlug, runId) {
   };
   if (claimed.codeExecution) {
     if (!checkout) {
-      const reason = `local_checkout_missing: run ${runId} requires code execution but no confirmed local checkout exists for project ${projectSlug}. Register a checkout via the operator tool before re-queuing.`;
+      const reason = `local_checkout_missing: run ${runId} needs code execution, but project ${projectSlug} has no local git checkout registered on this machine, so there is nowhere to make the changes. Explain this to the operator in plain, non-technical language, then proactively help register one:
+1. Search the usual locations (~/dev, ~/code, ~/work, ~/projects) for a clone of this project's GitHub repo, matching by its \`git remote origin\` URL.
+2. If you find a likely match, tell the operator where you think it is and ask them to confirm \u2014 e.g. "For code changes I need this project's repo checked out here. I think it's at <path> \u2014 should I register that one, or do you want to point me at a different path?"
+3. When the operator confirms a path, call register_local_checkout({ projectSlug: "${projectSlug}", path: "<absolute path>", repo: "<this project's GitHub repo>" }).
+4. If no candidate is found, ask the operator for the absolute path to the checkout (or to clone the repo first), then register it. Once a checkout is registered, the run can be re-queued.`;
       await failRun(deps, projectSlug, task, runId, leaseId, reason);
       return;
     }
@@ -40037,9 +40192,15 @@ function saveThreadIndex(stateDir, entries) {
 function createInactivityWatchdog(opts) {
   const setT = opts.setTimeoutFn ?? setTimeout;
   const clearT = opts.clearTimeoutFn ?? clearTimeout;
+  const now = opts.now ?? Date.now;
+  const suspended = opts.suspendedMs ?? (() => 0);
   let idleTimer = null;
   let maxTimer = null;
   let done = false;
+  const startAt = now();
+  const suspendedAtStart = suspended();
+  let lastPokeAt = startAt;
+  let suspendedAtLastPoke = suspendedAtStart;
   const expire = (reason) => {
     if (done) return;
     done = true;
@@ -40047,16 +40208,41 @@ function createInactivityWatchdog(opts) {
     if (maxTimer) clearT(maxTimer);
     opts.onExpire(reason);
   };
-  idleTimer = setT(() => expire("idle"), opts.idleMs);
-  idleTimer.unref?.();
-  maxTimer = setT(() => expire("max"), opts.maxMs);
-  maxTimer.unref?.();
+  const armIdle = (ms) => {
+    idleTimer = setT(onIdleDeadline, Math.max(1, ms));
+    idleTimer.unref?.();
+  };
+  const armMax = (ms) => {
+    maxTimer = setT(onMaxDeadline, Math.max(1, ms));
+    maxTimer.unref?.();
+  };
+  const onIdleDeadline = () => {
+    if (done) return;
+    const awakeSilence = now() - lastPokeAt - (suspended() - suspendedAtLastPoke);
+    if (awakeSilence < opts.idleMs) {
+      armIdle(opts.idleMs - awakeSilence);
+      return;
+    }
+    expire("idle");
+  };
+  const onMaxDeadline = () => {
+    if (done) return;
+    const awakeElapsed = now() - startAt - (suspended() - suspendedAtStart);
+    if (awakeElapsed < opts.maxMs) {
+      armMax(opts.maxMs - awakeElapsed);
+      return;
+    }
+    expire("max");
+  };
+  armIdle(opts.idleMs);
+  armMax(opts.maxMs);
   return {
     poke: () => {
       if (done) return;
       if (idleTimer) clearT(idleTimer);
-      idleTimer = setT(() => expire("idle"), opts.idleMs);
-      idleTimer.unref?.();
+      lastPokeAt = now();
+      suspendedAtLastPoke = suspended();
+      armIdle(opts.idleMs);
     },
     cancel: () => {
       done = true;
@@ -44232,6 +44418,7 @@ function createBridgeLogger(stateDir, env = process.env) {
 }
 
 // src/director-bridge.ts
+var JSON_GPT_MODEL_REF_RE = /"(?:slug|model)"\s*:\s*"(gpt-[a-z0-9.-]+)"/gi;
 var DEFAULT_DIRECTOR_BRIDGE_ALLOWED_ORIGINS = [
   "http://localhost:*",
   "http://127.0.0.1:*",
@@ -44252,6 +44439,139 @@ function normalizeModel(value) {
   const trimmed = value.trim();
   return trimmed ? trimmed : null;
 }
+function isSelectableModelSlug(value) {
+  return typeof value === "string" && value.startsWith("gpt-");
+}
+function humanizeModelSlug(slug) {
+  if (!slug.startsWith("gpt-")) return slug;
+  const rest = slug.slice(4);
+  if (!rest) return "GPT";
+  const [version2, ...variants] = rest.split("-").filter(Boolean);
+  if (variants.length === 0) return `GPT-${version2}`;
+  return `GPT-${version2} ${variants.map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ")}`;
+}
+function mapBridgeModel(raw) {
+  const model = (raw.model ?? raw.id ?? "").trim();
+  if (!model) return null;
+  return {
+    id: (raw.id ?? model).trim() || model,
+    model,
+    displayName: (raw.displayName ?? model).trim() || model,
+    description: raw.description ?? "",
+    supportedReasoningEfforts: (raw.supportedReasoningEfforts ?? []).map((entry) => ({
+      reasoningEffort: entry.reasoningEffort,
+      description: entry.description ?? ""
+    })),
+    defaultReasoningEffort: raw.defaultReasoningEffort ?? null,
+    isDefault: raw.isDefault === true
+  };
+}
+function addBridgeModel(target, model) {
+  if (!model) return;
+  if (!target.has(model.model)) target.set(model.model, model);
+}
+function readTextIfExists(filePath) {
+  try {
+    return import_node_fs10.default.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function readKnownGptSlugsFromTomlFile(filePath) {
+  const raw = readTextIfExists(filePath);
+  if (!raw) return [];
+  return Array.from(raw.matchAll(/^\s*model\s*=\s*"([^"]+)"/gm)).map((match) => match[1]?.trim() ?? "").filter(isSelectableModelSlug);
+}
+function readCodexFallbackModels() {
+  const codexHome = process.env.CODEX_HOME?.trim() || import_node_path11.default.join(import_node_os7.default.homedir(), ".codex");
+  const models = /* @__PURE__ */ new Map();
+  const cachePath = import_node_path11.default.join(codexHome, "models_cache.json");
+  const cacheRaw = readTextIfExists(cachePath);
+  if (cacheRaw) {
+    try {
+      const parsed = JSON.parse(cacheRaw);
+      if (Array.isArray(parsed.models)) {
+        for (const entry of parsed.models) {
+          if (!entry || typeof entry !== "object") continue;
+          const cached2 = entry;
+          const slug = typeof cached2.slug === "string" ? cached2.slug.trim() : "";
+          if (!isSelectableModelSlug(slug)) continue;
+          const supportedReasoningEfforts = Array.isArray(cached2.supported_reasoning_levels) ? cached2.supported_reasoning_levels.flatMap((level) => {
+            if (!level || typeof level !== "object") return [];
+            const option = level;
+            if (typeof option.effort !== "string" || !option.effort.trim()) return [];
+            return [{ reasoningEffort: option.effort, description: typeof option.description === "string" ? option.description : "" }];
+          }) : [];
+          addBridgeModel(
+            models,
+            mapBridgeModel({
+              id: slug,
+              model: slug,
+              displayName: typeof cached2.display_name === "string" ? cached2.display_name : humanizeModelSlug(slug),
+              description: typeof cached2.description === "string" ? cached2.description : "",
+              supportedReasoningEfforts,
+              defaultReasoningEffort: typeof cached2.default_reasoning_level === "string" ? cached2.default_reasoning_level : null,
+              isDefault: false
+            })
+          );
+        }
+      }
+    } catch {
+    }
+    for (const match of cacheRaw.matchAll(JSON_GPT_MODEL_REF_RE)) {
+      const slug = match[1]?.trim().toLowerCase() ?? "";
+      if (!isSelectableModelSlug(slug)) continue;
+      addBridgeModel(
+        models,
+        mapBridgeModel({
+          id: slug,
+          model: slug,
+          displayName: humanizeModelSlug(slug),
+          description: "",
+          supportedReasoningEfforts: [],
+          defaultReasoningEffort: null,
+          isDefault: false
+        })
+      );
+    }
+  }
+  for (const slug of readKnownGptSlugsFromTomlFile(import_node_path11.default.join(codexHome, "config.toml"))) {
+    addBridgeModel(
+      models,
+      mapBridgeModel({
+        id: slug,
+        model: slug,
+        displayName: humanizeModelSlug(slug),
+        description: "",
+        supportedReasoningEfforts: [],
+        defaultReasoningEffort: null,
+        isDefault: false
+      })
+    );
+  }
+  const automationsDir = import_node_path11.default.join(codexHome, "automations");
+  try {
+    for (const entry of import_node_fs10.default.readdirSync(automationsDir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      for (const slug of readKnownGptSlugsFromTomlFile(import_node_path11.default.join(automationsDir, entry.name, "automation.toml"))) {
+        addBridgeModel(
+          models,
+          mapBridgeModel({
+            id: slug,
+            model: slug,
+            displayName: humanizeModelSlug(slug),
+            description: "",
+            supportedReasoningEfforts: [],
+            defaultReasoningEffort: null,
+            isDefault: false
+          })
+        );
+      }
+    }
+  } catch {
+  }
+  return [...models.values()];
+}
 function neutralCheckoutCwd(stateDir) {
   const dir = import_node_path11.default.join(stateDir, "no-checkout");
   try {
@@ -44288,7 +44608,7 @@ function buildThreadStartParams(msg, config2, desiredModel) {
     "  bullets (`- AND ...` as needed). Scenarios make the spec verifiable.",
     "- Keep behavior contracts in the spec; implementation details belong in `## Implementation Plan`.",
     "- Apply this format ONLY to Specs/{id} pages; do not retro-fit it onto other wiki page types.",
-    "- Spec consensus runs ASYNCHRONOUSLY. Call `run_spec_consensus` for a `Specs/{id}` page; it returns IMMEDIATELY. On `already_converged`, the spec is already marked ready \u2014 proceed straight to `create_execution_run`; do NOT call `mark_spec_ready` and do NOT re-run consensus. On `queued` or `already_running`, tell the user it was launched and END your turn \u2014 do NOT poll or call it again; the result arrives in the inbox (an `info` item on CONVERGED, a `handoff` item if it was blocked/failed). When a consensus `info` item says CONVERGED, proceed to `create_execution_run`. When a `handoff` says it was blocked, address the recorded issues in the spec (any edit re-arms the gate) and call `run_spec_consensus` once more.",
+    "- Spec consensus runs ASYNCHRONOUSLY. Call `run_spec_consensus` for a `Specs/{id}` page; it returns IMMEDIATELY. On `already_converged`, the spec is already marked ready \u2014 proceed straight to `create_execution_run`; do NOT call `mark_spec_ready` and do NOT re-run consensus. On `queued` or `already_running`, tell the user it was launched and END your turn \u2014 do NOT poll or call it again; the result arrives in the inbox (an `info` item on CONVERGED, a `handoff` item if it was blocked/failed). When a consensus `info` item says CONVERGED, proceed to `create_execution_run`. When a `handoff` says it was blocked, address the recorded issues in the spec (any edit re-arms the gate) and call `run_spec_consensus` once more. For a NON-code task (domain seo/marketing/content, ADR 0020) the spec is review-only \u2014 do NOT call `create_execution_run` (non-code execution is not yet supported and fail-closes); tell the operator the spec was reviewed.",
     '- When a task needs a browser (login flows, UI verification/clicks, scraping), pass `prerequisites:[{mcp:"mrrlin-browser",reason:"..."}]` to `create_execution_run`. If that run later fails into a handoff, the operator gets a one-click "Launch browser & resume" that brings up the dedicated browser as the turn starts.',
     "- When you actually drive a browser (calling `browser_navigate`, `browser_click`, `browser_snapshot`, `browser_type`, etc.), invoke those tools from the **`mrrlin-browser`** MCP server ONLY. Do NOT use tools from any other browser MCP (`playwright`, `chrome-devtools`, `puppeteer`, etc.) even if they are also connected on this operator's box \u2014 those use a shared/default Playwright profile that is fragile across runs. Only `mrrlin-browser` uses this project's dedicated Chromium + persistent operator profile (`~/.mrrlin/browser/profile`). If your host exposes multiple browser MCPs with overlapping tool names, prefer the `mrrlin-browser` server unconditionally.",
     "",
@@ -44357,8 +44677,12 @@ function buildThreadStartParams(msg, config2, desiredModel) {
     "  assumption on the spec page.",
     "- For any such task-affecting question, ALSO bank it durably before your final reply:",
     '  `create_inbox_item` with `kind="question"`, `taskId` set, `directorSessionId` from the',
-    "  Context JSON, and `body` = the exact question. (The server dedups identical open",
-    "  questions; do not supply a dedup key.)",
+    "  Context JSON, `body` = the exact question, and `questionOptions` = 2-3 concrete answer",
+    "  options. Each option MUST include a short `label`, a concise `description`, and a",
+    "  self-contained durable `answer`; you MAY mark at most one option as `recommended` when",
+    "  you explicitly prefer a path. The operator always has a custom-answer path in the UI, so",
+    "  your options should guide, not trap. (The server dedups identical open questions; do not",
+    "  supply a dedup key.)",
     "- When the operator answers in chat, write the answer into the Specs/{taskId}",
     '  Clarifications section, then `decide_inbox_item` the question with `verdict="acknowledged"`',
     "  and `answer` = the resolved answer.",
@@ -44689,6 +45013,24 @@ function attachBridgeWss(server, opts) {
       return;
     }
     const span = { id: "conn", at: 0 };
+    let isAlive = true;
+    socket.on("pong", () => {
+      isAlive = true;
+    });
+    const pingTimer = setInterval(() => {
+      if (socket.readyState !== socket.OPEN) return;
+      if (!isAlive) {
+        socket.terminate();
+        return;
+      }
+      isAlive = false;
+      try {
+        socket.ping();
+      } catch {
+      }
+    }, wsPingMs());
+    pingTimer.unref?.();
+    socket.on("close", () => clearInterval(pingTimer));
     const send = (msg) => {
       if (socket.readyState !== socket.OPEN) return;
       logger?.logOut({
@@ -44732,6 +45074,20 @@ function attachBridgeWss(server, opts) {
 }
 var TurnInterruptedError = class extends Error {
 };
+var DEFAULT_WS_PING_SECONDS = 30;
+function wsPingMs() {
+  const raw = (process.env.MRRLIN_DIRECTOR_BRIDGE_WS_PING_SECONDS ?? "").trim();
+  const parsed = Number.parseInt(raw, 10);
+  return (Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_WS_PING_SECONDS) * 1e3;
+}
+async function waitFor(pred, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (pred()) return true;
+    await new Promise((r) => setTimeout(r, 25));
+  }
+  return pred();
+}
 function attachSeqMetadata(msg, seq, turnId) {
   if (msg.type === "event" || msg.type === "rateLimits" || msg.type === "error") {
     return { ...msg, seq, turnId };
@@ -44790,11 +45146,11 @@ function createBridgeMessageHandler(deps) {
         logResumeRejected(req.directorSessionId, "superseded");
         return;
       }
-      const tail2 = eventsAfter(buf, req.lastSeq);
+      let tail2 = eventsAfter(buf, req.lastSeq);
+      let truncated = false;
       if (tail2 === null) {
-        sendMsg({ type: "resume", status: "no-buffer", reason: "evicted" });
-        logResumeRejected(req.directorSessionId, "evicted");
-        return;
+        truncated = true;
+        tail2 = [...buf.events];
       }
       const result = transition(buf.state, { kind: "resume", epochMatch: true });
       if (result.next === "invalid") {
@@ -44806,7 +45162,14 @@ function createBridgeMessageHandler(deps) {
       buf.replaying = true;
       deps.bindSessionSink?.(req.directorSessionId, send);
       boundSessions.add(req.directorSessionId);
-      if (buf.triggerGrace) socket.once("close", buf.triggerGrace);
+      if (buf.triggerDetach) {
+        const detach = buf.triggerDetach;
+        const epochAtBind = buf.bindEpoch;
+        socket.once("close", () => {
+          if (buf.bindEpoch !== epochAtBind) return;
+          detach();
+        });
+      }
       const willStreamLive = result.next === "live";
       sendMsg({
         type: "resume",
@@ -44819,6 +45182,14 @@ function createBridgeMessageHandler(deps) {
         eventCount: tail2.length,
         willStreamLive
       });
+      if (truncated) {
+        sendMsg({
+          type: "replay-truncated",
+          directorSessionId: req.directorSessionId,
+          turnId: buf.turnId,
+          droppedBelowSeq: tail2[0]?.seq ?? buf.lastSeq
+        });
+      }
       for (const { msg: bufferedMsg } of tail2) sendMsg(bufferedMsg);
       for (const m of buf.outboundQueue) sendMsg(m);
       buf.outboundQueue.length = 0;
@@ -44897,26 +45268,36 @@ function createBridgeMessageHandler(deps) {
         let models = null;
         let rateLimits = null;
         let bootstrapError;
+        const fallbackModels = readCodexFallbackModels();
         try {
           const codexClient2 = await deps.acquireCodex();
           try {
             try {
-              const res = await codexClient2.model.list({});
+              const res = await codexClient2.model.list({ includeHidden: true });
               const raw = res.data ?? res.models ?? [];
-              models = raw.filter((m) => m.hidden !== true).map((m) => ({
-                id: m.id,
-                model: m.model ?? m.id,
-                displayName: m.displayName ?? m.model ?? m.id,
-                description: m.description ?? "",
-                supportedReasoningEfforts: (m.supportedReasoningEfforts ?? []).map((o) => ({
-                  reasoningEffort: o.reasoningEffort,
-                  description: o.description ?? ""
-                })),
-                defaultReasoningEffort: m.defaultReasoningEffort ?? null,
-                isDefault: m.isDefault === true
-              }));
+              const mergedModels = /* @__PURE__ */ new Map();
+              for (const m of raw) {
+                const modelSlug = (m.model ?? m.id ?? "").trim();
+                if (!modelSlug) continue;
+                if (m.hidden === true && (modelSlug.startsWith("codex-") || !modelSlug.startsWith("gpt-"))) continue;
+                addBridgeModel(
+                  mergedModels,
+                  mapBridgeModel({
+                    id: m.id,
+                    model: m.model ?? m.id,
+                    displayName: m.displayName ?? m.model ?? m.id,
+                    description: m.description ?? "",
+                    supportedReasoningEfforts: m.supportedReasoningEfforts ?? [],
+                    defaultReasoningEffort: m.defaultReasoningEffort ?? null,
+                    isDefault: m.isDefault === true
+                  })
+                );
+              }
+              for (const fallbackModel of fallbackModels) addBridgeModel(mergedModels, fallbackModel);
+              models = [...mergedModels.values()];
             } catch (error51) {
               bootstrapError = error51 instanceof Error ? error51.message : String(error51);
+              models = fallbackModels.length > 0 ? fallbackModels : null;
             }
             try {
               const res = await codexClient2.account.readRateLimits();
@@ -44929,6 +45310,7 @@ function createBridgeMessageHandler(deps) {
           }
         } catch (error51) {
           bootstrapError = error51 instanceof Error ? error51.message : String(error51);
+          models = fallbackModels.length > 0 ? fallbackModels : null;
         }
         sendForSpan({ type: "bootstrap", models, rateLimits, ...deps.bridgeInstanceId ? { bridgeInstanceId: deps.bridgeInstanceId } : {}, ...bootstrapError ? { error: bootstrapError } : {} });
         return;
@@ -44937,6 +45319,20 @@ function createBridgeMessageHandler(deps) {
         handleResumeRequest(msg, sendForSpan);
         return;
       }
+      if (msg.type === "ack") {
+        const ack = msg;
+        const sessionId = typeof ack.directorSessionId === "string" ? ack.directorSessionId.trim() : "";
+        const ackThread = sessionId ? deps.threads.get(sessionId) : void 0;
+        if (ackThread?.replay && typeof ack.turnId === "string" && typeof ack.lastSeq === "number" && recordAck(ackThread.replay, ack.turnId, ack.lastSeq, Date.now())) {
+          logCtx?.logger.logOut({
+            spanId,
+            sessionId,
+            type: "<result-acked>",
+            payload: { sessionId, turnId: ack.turnId, lastSeq: ack.lastSeq }
+          });
+        }
+        return;
+      }
       if (msg.type === "interrupt") {
         const directorSessionId2 = (msg.directorSessionId ?? "").trim();
         const existing = directorSessionId2 ? deps.threads.get(directorSessionId2) : void 0;
@@ -44945,12 +45341,11 @@ function createBridgeMessageHandler(deps) {
           return;
         }
         const interruptBuf = existing.replay;
-        if (interruptBuf && interruptBuf.state === "grace") {
-          const stopResult = transition("grace", { kind: "stop" });
+        if (interruptBuf && interruptBuf.state === "detached") {
+          const stopResult = transition("detached", { kind: "stop" });
           if (stopResult.next !== "invalid") {
             interruptBuf.state = stopResult.next;
-            cancelGrace(interruptBuf);
-            recordInterrupted(interruptBuf);
+            recordInterrupted(interruptBuf, Date.now(), deps.suspendedMs?.() ?? 0);
           }
         }
         const codexClient2 = await deps.acquireCodex();
@@ -45012,6 +45407,36 @@ function createBridgeMessageHandler(deps) {
       }
       const codexClient = await deps.acquireCodex();
       let thread = deps.threads.get(directorSessionId);
+      if (thread?.inFlight && msg.takeover === true) {
+        const takenOver = thread;
+        const oldBuf = takenOver.replay;
+        if (oldBuf && (oldBuf.state === "live" || oldBuf.state === "detached")) {
+          const r = transition(oldBuf.state, { kind: "stop" });
+          if (r.next !== "invalid") {
+            oldBuf.state = r.next;
+            recordInterrupted(oldBuf, Date.now(), deps.suspendedMs?.() ?? 0);
+          }
+        }
+        takenOver.cancel?.();
+        void withTimeout(
+          codexClient.turn.interrupt({ threadId: takenOver.threadId }),
+          DEFAULT_TURN_INTERRUPT_TIMEOUT_MS,
+          "interrupt timed out"
+        ).catch(() => {
+        });
+        const cleared = await waitFor(() => !takenOver.inFlight, DEFAULT_TURN_INTERRUPT_TIMEOUT_MS);
+        if (!cleared) {
+          deps.threads.delete(directorSessionId);
+          deps.persistThreads();
+          thread = void 0;
+        }
+        logCtx?.logger.logOut({
+          spanId,
+          sessionId: directorSessionId,
+          type: "<turn-takeover>",
+          payload: { sessionId: directorSessionId, clean: cleared, oldTurnId: oldBuf?.turnId ?? null }
+        });
+      }
       const desiredModel = normalizeModel(msg.model);
       const desiredEffort = normalizeReasoningEffort(msg.reasoningEffort);
       try {
@@ -45069,7 +45494,13 @@ function createBridgeMessageHandler(deps) {
         return;
       }
       if (thread.inFlight) {
-        sendForSpan({ type: "error", directorSessionId, error: "Director session is busy." });
+        sendForSpan({
+          type: "error",
+          directorSessionId,
+          code: "busy",
+          ...thread.replay ? { inFlightTurnId: thread.replay.turnId } : {},
+          error: "Director session is busy."
+        });
         deps.releaseCodex();
         return;
       }
@@ -45077,7 +45508,8 @@ function createBridgeMessageHandler(deps) {
       thread.replay = createReplayBuffer({
         turnId: (0, import_node_crypto5.randomUUID)(),
         spanId,
-        ...deps.turnGraceMs !== void 0 ? { graceMs: deps.turnGraceMs } : {}
+        ...deps.retentionMs !== void 0 ? { retentionMs: deps.retentionMs } : {},
+        ...deps.ackLingerMs !== void 0 ? { ackLingerMs: deps.ackLingerMs } : {}
       });
       thread.lastUsedAt = Date.now();
       const threadId = thread.threadId;
@@ -45168,6 +45600,7 @@ function createBridgeMessageHandler(deps) {
           const watchdog = createInactivityWatchdog({
             idleMs,
             maxMs,
+            ...deps.suspendedMs ? { suspendedMs: deps.suspendedMs } : {},
             onExpire: (reason) => {
               rejectWatchdog?.(
                 new Error(
@@ -45176,48 +45609,36 @@ function createBridgeMessageHandler(deps) {
               );
               void withTimeout(codexClient.turn.interrupt({ threadId }), DEFAULT_TURN_INTERRUPT_TIMEOUT_MS, "interrupt timed out").catch(
                 () => {
-                  deps.threads.delete(directorSessionId);
-                  deps.persistThreads();
+                  if (deps.threads.get(directorSessionId) === thread) {
+                    deps.threads.delete(directorSessionId);
+                    deps.persistThreads();
+                  }
                 }
               );
             }
           });
+          const turnBuf = thread.replay;
           const onSocketClose = () => {
             const buf = thread.replay;
-            if (!buf || buf.state !== "live") return;
-            const r = transition("live", { kind: "socket_close" });
-            if (r.next === "invalid") return;
+            if (!buf || buf !== turnBuf) return;
+            const r = transition(buf.state, { kind: "socket_close" });
+            if (r.next === "invalid" || r.next === buf.state) return;
             buf.state = r.next;
             logCtx?.logger.logOut({
               spanId,
               sessionId: directorSessionId,
-              type: "<resume-grace-started>",
-              payload: { sessionId: directorSessionId, turnId: buf.turnId, graceMs: buf.graceMs }
-            });
-            enterGrace(buf, () => {
-              const expired = transition("grace", { kind: "grace_expire" });
-              if (expired.next === "invalid") return;
-              buf.state = expired.next;
-              recordInterrupted(buf);
-              logCtx?.logger.logOut({
-                spanId,
-                sessionId: directorSessionId,
-                type: "<grace-expired>",
-                payload: { sessionId: directorSessionId, turnId: buf.turnId, lastSeq: buf.lastSeq }
-              });
-              rejectWatchdog?.(new TurnInterruptedError());
-              void withTimeout(
-                codexClient.turn.interrupt({ threadId }),
-                DEFAULT_TURN_INTERRUPT_TIMEOUT_MS,
-                "interrupt timed out"
-              ).catch(() => {
-                deps.threads.delete(directorSessionId);
-                deps.persistThreads();
-              });
+              type: "<buffer-detached>",
+              payload: { sessionId: directorSessionId, turnId: buf.turnId, lastSeq: buf.lastSeq }
             });
           };
-          socket.once("close", onSocketClose);
-          if (thread.replay) thread.replay.triggerGrace = onSocketClose;
+          {
+            const epochAtBind = turnBuf?.bindEpoch ?? 0;
+            socket.once("close", () => {
+              if (turnBuf && turnBuf.bindEpoch !== epochAtBind) return;
+              onSocketClose();
+            });
+          }
+          if (thread.replay) thread.replay.triggerDetach = onSocketClose;
           pokeActivity = () => watchdog.poke();
           const runSequence = (async () => {
             const turnInput = [];
@@ -45266,10 +45687,20 @@ ${effectiveText}` : effectiveText;
               sendInTurn({ type: "event", directorSessionId, event });
             }
           } finally {
-            if (thread.replay && thread.replay.state === "live") {
-              markCompleted(thread.replay, Date.now());
+            if (thread.replay && (thread.replay.state === "live" || thread.replay.state === "detached")) {
+              markCompleted(thread.replay, Date.now(), deps.suspendedMs?.() ?? 0);
+              logCtx?.logger.logOut({
+                spanId,
+                sessionId: directorSessionId,
+                type: "<result-retained>",
+                payload: {
+                  sessionId: directorSessionId,
+                  turnId: thread.replay.turnId,
+                  lastSeq: thread.replay.lastSeq,
+                  bytes: thread.replay.bytesUsed
+                }
+              });
             }
-            socket.off("close", onSocketClose);
             watchdog.cancel();
             unsub();
             thread.cancel = null;
@@ -45576,6 +46007,7 @@ async function startDirectorBridge() {
     })
   );
   const threads = /* @__PURE__ */ new Map();
+  const suspensionDetector = createSuspensionDetector();
   for (const [directorSessionId, entry] of loadThreadIndex(config2.stateDir, config2.idleThreadTtlMs, Date.now())) {
     threads.set(directorSessionId, {
       threadId: entry.threadId,
@@ -45613,6 +46045,7 @@ async function startDirectorBridge() {
     let changed = false;
     for (const [directorSessionId, thread] of threads.entries()) {
       if (thread.inFlight) continue;
+      if (thread.replay && !shouldGc(thread.replay, now, suspensionDetector.suspendedMs())) continue;
       if (now - thread.lastUsedAt > config2.idleThreadTtlMs) {
         threads.delete(directorSessionId);
         changed = true;
@@ -45628,6 +46061,7 @@ async function startDirectorBridge() {
     acquireCodex: () => codexKeepalive.acquire(),
     releaseCodex: () => codexKeepalive.release(),
     runExclusive: wrappedTurnLock.runExclusive,
+    suspendedMs: () => suspensionDetector.suspendedMs(),
     buildStartParams: (msg, desiredModel) => buildThreadStartParams(msg, config2, desiredModel),
     turnInactivity: () => ({ idleMs: chatTurnIdleMs(), maxMs: chatTurnMaxMs() }),
     checkoutRegistry,
@@ -45790,20 +46224,35 @@ async function startDirectorBridge() {
       );
       enqueueRun(async () => {
         const now = Date.now();
+        const suspendedNow = suspensionDetector.suspendedMs();
+        let retainedBuffers = 0;
+        let retainedBytes = 0;
         for (const [sid, t] of threads) {
-          if (t.replay && shouldGc(t.replay, now)) {
+          if (t.replay && shouldGc(t.replay, now, suspendedNow)) {
             const turnId = t.replay.turnId;
             const lastSeq = t.replay.lastSeq;
+            const expiredUnacked = t.replay.ackedAt === null;
             writeTombstone(tombstones, sid, t.replay, now);
             bridgeLogger.logOut({
               spanId: "gc",
               sessionId: sid,
-              type: "<tombstone-written>",
+              type: expiredUnacked ? "<result-expired>" : "<tombstone-written>",
               payload: { sessionId: sid, turnId, lastSeq }
             });
             t.replay = null;
+          } else if (t.replay) {
+            retainedBuffers += 1;
+            retainedBytes += t.replay.bytesUsed;
           }
         }
+        if (retainedBuffers > 0) {
+          bridgeLogger.logOut({
+            spanId: "gc",
+            sessionId: null,
+            type: "<buffer-stats>",
+            payload: { retainedBuffers, retainedBytes }
+          });
+        }
         const removed = sweepExpiredTombstones(tombstones, now);
         if (removed > 0) {
           bridgeLogger.logOut({
@@ -45858,6 +46307,7 @@ async function startDirectorBridge() {
       () => server.close(),
       () => dispatchServer.close(),
       () => clearInterval(cleanupTimer),
+      () => suspensionDetector.dispose(),
       () => remoteRelay?.stop(),
       () => tokenRefresher?.stop(),
       () => {
@@ -49826,8 +50276,26 @@ function firstTaskIdToken(text) {
   return m ? m[0] : null;
 }
 
+// src/consensus/heads.ts
+var DEFAULT_DOMAIN = "code";
+var DOMAINS = ["code", "seo", "marketing", "content"];
+var HEADS_BY_DOMAIN = {
+  code: ["plan-reviewer", "architect", "security-analyst", "scope-analyst"],
+  seo: ["plan-reviewer", "scope-analyst", "seo-analyst"],
+  marketing: ["plan-reviewer", "scope-analyst", "content-editor"],
+  content: ["plan-reviewer", "scope-analyst", "content-editor"]
+};
+var SPEC_HEADS = HEADS_BY_DOMAIN.code;
+function normalizeDomain(value) {
+  if (typeof value !== "string") return DEFAULT_DOMAIN;
+  const v = value.trim().toLowerCase();
+  return DOMAINS.includes(v) ? v : DEFAULT_DOMAIN;
+}
+function resolveHeads(domain2) {
+  return [...HEADS_BY_DOMAIN[normalizeDomain(domain2)]];
+}
+
 // src/consensus/spec-gate.ts
-var SPEC_HEADS = ["plan-reviewer", "architect", "security-analyst", "scope-analyst"];
 async function runSpecGate(_target, deps, opts) {
   if (!await deps.consensusEnabled()) return { outcome: "SKIPPED" };
   const intent = await deps.readIntent();
@@ -49843,8 +50311,9 @@ async function runSpecGate(_target, deps, opts) {
       ]
     };
   }
+  const baseHeads = resolveHeads(intent.domain);
   const extraHeads = opts?.extraHeads ?? [];
-  const heads = [...SPEC_HEADS, ...extraHeads.filter((h) => !SPEC_HEADS.includes(h))];
+  const heads = [...baseHeads, ...extraHeads.filter((h) => !baseHeads.includes(h))];
   const spec = await deps.readSpec();
   let currentHash = spec.contentHash;
   let currentMarkdown = spec.markdownBody;
@@ -50130,6 +50599,25 @@ async function resolveGatedTaskId(client, projectSlug, page) {
   return page.taskId;
 }
 
+// src/consensus/review-identity.ts
+function domainScopedReviewHash(rawHash, domain2) {
+  const d = normalizeDomain(domain2);
+  return d === "code" ? rawHash : `${rawHash}@${d}`;
+}
+async function resolveSpecDomain(client, projectSlug, page) {
+  try {
+    const taskId = await resolveGatedTaskId(client, projectSlug, page);
+    if (taskId !== null) {
+      const task = await client.getTask(projectSlug, taskId);
+      return normalizeDomain(task?.domain);
+    }
+    const project = await client.getProject(projectSlug);
+    return normalizeDomain(project?.defaultDomain);
+  } catch {
+    return "code";
+  }
+}
+
 // src/consensus/code-gate-git.ts
 var import_node_child_process6 = require("node:child_process");
 var DIFF_MAX_BYTES = 2e5;
@@ -50405,12 +50893,15 @@ function buildSpecGateDeps(args) {
           throw new Error(`spec page ${projectSlug}/${specPageId} not found \u2014 cannot gate`);
         }
         const taskId = await resolveGatedTaskId(client, projectSlug, { id: page.id, taskId: page.taskId ?? null });
-        if (taskId === null) return { taskId: null, seed: null, title: null };
+        if (taskId === null) {
+          const project = await client.getProject(projectSlug);
+          return { taskId: null, seed: null, title: null, domain: project.defaultDomain };
+        }
         const task = await client.getTask(projectSlug, taskId);
         if (!task) {
           throw new Error(`gated task ${projectSlug}/${taskId} not found for spec ${specPageId} \u2014 cannot gate`);
         }
-        return { taskId, seed: task.operatorSeedRequest ?? null, title: task.title ?? "" };
+        return { taskId, seed: task.operatorSeedRequest ?? null, title: task.title ?? "", domain: task.domain };
       })();
     }
     return intentPromise;
@@ -50526,9 +51017,10 @@ ${artifact}`,
       }
       const outcome = r["outcome"];
       const rounds2 = r["rounds"];
+      const { domain: domain2 } = await loadIntent();
       try {
         await client.recordSpecConsensusReview(projectSlug, specPageId, {
-          contentHash,
+          contentHash: domainScopedReviewHash(contentHash, domain2),
           outcome: String(outcome),
           rounds: typeof rounds2 === "number" ? rounds2 : 0
         });
@@ -50621,10 +51113,43 @@ ${artifact}`,
 
 // src/async-tools/consensus.ts
 var import_node_crypto6 = require("node:crypto");
+function buildGateQuestionOptions(category) {
+  if (category === "scope") {
+    return [
+      {
+        answer: "Use the narrower scope only. Update the spec to keep the original limited scope and do not add the broader interpretation unless explicitly required.",
+        description: "Do only the originally requested narrower scope and leave the broader bucket out unless explicitly required.",
+        label: "Narrower"
+      },
+      {
+        answer: "Use the broader scope. Update the spec to explicitly include the broader interpretation and any required acceptance criteria.",
+        description: "Treat the broader interpretation as in scope and spell out the extra acceptance criteria it adds.",
+        label: "Broader"
+      }
+    ];
+  }
+  return [
+    {
+      answer: "Use the safer/default interpretation. Update the spec to document that assumption explicitly.",
+      description: "Choose the lower-risk default interpretation and record it explicitly so implementation is unblocked.",
+      label: "Safer default"
+    },
+    {
+      answer: "Use the broader/stronger interpretation. Update the spec to make that interpretation explicit.",
+      description: "Commit to the stronger interpretation instead of a conservative default, and update the spec to match.",
+      label: "Stronger interpretation"
+    }
+  ];
+}
 async function cachedResult(client, input) {
   const page = await client.getWikiPage(input.projectSlug, input.pageId);
   if (!page) return null;
-  const review = await client.getSpecConsensusReview(input.projectSlug, input.pageId, page.contentHash);
+  const domain2 = await resolveSpecDomain(client, input.projectSlug, { id: page.id, taskId: page.taskId ?? null });
+  const review = await client.getSpecConsensusReview(
+    input.projectSlug,
+    input.pageId,
+    domainScopedReviewHash(page.contentHash, domain2)
+  );
   if (review?.outcome === "CONVERGED") {
     const gatedTaskId = await resolveGatedTaskId(client, input.projectSlug, {
       id: page.id,
@@ -50674,7 +51199,8 @@ async function run(ctx, input) {
               kind: "question",
               taskId: scopeId,
               body: clarification.question,
-              origin: "gate"
+              origin: "gate",
+              questionOptions: buildGateQuestionOptions(clarification.category)
             });
           } catch {
           }
@@ -50689,7 +51215,8 @@ async function run(ctx, input) {
               kind: "question",
               planId: scopeId,
               body: clarification.question,
-              origin: "gate"
+              origin: "gate",
+              questionOptions: buildGateQuestionOptions(clarification.category)
             });
           } catch {
           }
@@ -51623,7 +52150,7 @@ var mcpToolDescriptions = {
   [mcpToolNames.resetDirectorThread]: "Clear a task's persisted Director execution thread handle so the next execution run starts a fresh provider thread. Records a director_thread_reset task event.",
   [mcpToolNames.updateWikiPage]: "Update a markdown Wiki page.",
   [mcpToolNames.markSpecReady]: "Mark a wiki page (folder=Specs) as ready (or not) for execution-run gating. The Director sets this true after validating the spec; any edit to the page's markdown auto-resets it to false.",
-  [mcpToolNames.runSpecConsensus]: 'Enqueue the consensus review gate over a Specs/{id} page. Returns IMMEDIATELY with one of: already_converged (a CONVERGED review already exists for the current content \u2014 proceed straight to create_execution_run, do NOT call mark_spec_ready, it is already set), already_reviewed (a terminal CONSENSUS_BLOCKED for this content), already_running (a consensus job is in flight), or queued (a new job was launched). The review runs in the background; its result/blocker arrives in the inbox (info on CONVERGED, handoff on failure) and is surfaced into the open chat. Do NOT call again for the same spec and do NOT poll. On queued/already_running, tell the user it was launched and end the turn. Pass extraHeads: ["researcher"] for specs referencing external libraries/APIs, or ["debugger"] for root-cause/investigation specs to add opt-in specialist reviewers on top of the fixed four.',
+  [mcpToolNames.runSpecConsensus]: 'Enqueue the consensus review gate over a Specs/{id} page. Returns IMMEDIATELY with one of: already_converged (a CONVERGED review already exists for the current content \u2014 proceed straight to create_execution_run, do NOT call mark_spec_ready, it is already set), already_reviewed (a terminal CONSENSUS_BLOCKED for this content), already_running (a consensus job is in flight), or queued (a new job was launched). The review runs in the background; its result/blocker arrives in the inbox (info on CONVERGED, handoff on failure) and is surfaced into the open chat. Do NOT call again for the same spec and do NOT poll. On queued/already_running, tell the user it was launched and end the turn. Pass extraHeads: ["researcher"] for specs referencing external libraries/APIs, or ["debugger"] for root-cause/investigation specs to add opt-in specialist reviewers on top of the fixed four. For a NON-code task (domain seo/marketing/content, ADR 0020) the spec is REVIEW-ONLY: do NOT call create_execution_run (it fail-closes with non_code_execution_unsupported until Phase 2) \u2014 report that the spec was reviewed and end the turn.',
   [mcpToolNames.runCodeReviewerGate]: `Review the current branch's code diff (vs baseRef) with a Code Reviewer gate \u2014 independent reviewers iterate review\u2192fix\u2192re-check (checkpoint, scope-limited reviser edits, typecheck/build fast-gate, rollback) until the diff converges or is blocked. Run before opening a PR. Pass extraHeads: ["security-analyst"] for sensitive diffs (auth, secrets, input handling, new endpoints).`,
   [mcpToolNames.appendExecutionArtifact]: "Append a durable artifact (plan, checkpoint, command output, test result, diff summary, self-review, error, deploy attempt, or handoff judgement) to an execution run.",
   [mcpToolNames.recordProducedUrl]: 'Call this after publishing each web page produced by the task, so the UI link opens the page itself instead of the deployed site root. Pass the page\'s full https URL (for external pages, e.g. "https://dev.to/<slug>") OR a path starting with "/" for the deploy environment (e.g. "/blog/<slug>") \u2014 paths are resolved against the run\'s deployed env URL at render time. Optional `label` (\u226440 chars) is shown next to the link; omit and the UI defaults to the page title. Call once per page; multiple calls dedupe by resolved URL in the UI.',
@@ -52080,7 +52607,12 @@ function createMrrlinTools(options) {
         if (!page || page.folder !== "Specs") {
           return await c.markSpecReady({ projectSlug, pageId, ready });
         }
-        const review = await c.getSpecConsensusReview(projectSlug, pageId, page.contentHash);
+        const reviewDomain = await resolveSpecDomain(c, projectSlug, { id: page.id, taskId: page.taskId ?? null });
+        const review = await c.getSpecConsensusReview(
+          projectSlug,
+          pageId,
+          domainScopedReviewHash(page.contentHash, reviewDomain)
+        );
         if (review && review.outcome === "CONVERGED") {
           try {
             const promotion = await c.promoteSpecReadyCas(projectSlug, pageId, {

package/dist/consensus/personas/content-editor.md

@@ -0,0 +1,16 @@
+You are a Content Editor. You review a spec/brief for content or marketing-copy work (an article, landing page, email, campaign copy, or content improvement) BEFORE it is executed. You judge the artifact text given; you do not mutate anything. Your job is soundness and fidelity — not personal stylistic taste.
+
+When an `OPERATOR INTENT` block is present, it is the operator's OWN words for what the content must do. Judge the spec against it for FIDELITY: does the plan serve the stated audience, goal, and call-to-action, or does it drift?
+
+Evaluate against checkable editorial and content standards:
+- **Audience & purpose**: is the target reader and the single primary goal (inform / convert / retain) explicit, and does the planned piece match them? Block copy that has no clear audience or a muddled goal.
+- **Message & structure**: one clear core message, a logical outline (hook → body → CTA), and a specified call-to-action where the goal is conversion. Flag a plan with no through-line or a missing/weak CTA when one is needed.
+- **Factual accuracy & sourcing**: are claims verifiable, and where the piece makes factual/statistical/quote claims, is a source or evidence requirement stated? Block content that would assert facts with no basis, or that risks fabrication.
+- **Brand voice & consistency**: does the plan respect a stated voice/tone and terminology, or contradict it? Flag off-brand tone only when a voice is specified and the plan violates it.
+- **Clarity & readability**: is the intended reading level/length appropriate for the audience and channel? Flag plans that are structurally unreadable (wall-of-text, jargon for a lay audience) — not minor phrasing.
+- **Originality & value**: does the piece add genuine value, or is it thin/derivative filler? Flag plagiarism risk or padding-for-length.
+
+Calibrate to MATERIAL issues — block only when the gap would change WHAT gets published or whether it works:
+- DON'T block on: word choices, subjective style, or edits a competent writer resolves in draft.
+- DO block on: missing/contradicted audience or goal, an absent CTA where conversion is the point, a factual-accuracy/sourcing gap, or a plan that would produce off-brand or thin content the operator didn't ask for.
+- Never fabricate facts, sources, or performance data you were not given; reason from the spec text and stated goals. Scale strictness by stated impact.

package/dist/consensus/personas/seo-analyst.md

@@ -0,0 +1,16 @@
+You are an SEO Analyst. You review a spec/brief for search-optimization work (a page, article, metadata set, structured-data change, or technical-SEO task) BEFORE it is executed. You judge the artifact text given; you do not mutate anything. Your job is soundness against real search best practice — not taste.
+
+When an `OPERATOR INTENT` block is present, it is the operator's OWN words for what the task must achieve. Judge the spec against it for FIDELITY: does the plan actually serve the stated search goal (target queries, audience, page/URL), or does it drift into unrelated work?
+
+Evaluate against established, checkable SEO practice:
+- **Search intent & targeting**: is there a clear primary query/topic and audience, and does the intended content type match the intent (informational vs transactional vs navigational)? Block a spec that optimizes for a keyword whose intent the deliverable won't satisfy.
+- **E-E-A-T & Helpful Content**: does the plan produce genuinely useful, first-hand/authoritative content, or thin/derivative filler that Google's Helpful Content system demotes? Flag keyword-stuffing, doorway-page patterns, or AI-slop-by-volume.
+- **On-page fundamentals**: title tag, meta description, heading hierarchy (single H1, logical H2/H3), internal linking, canonicalization, and URL/slug — are the ones the task depends on specified or clearly derivable?
+- **Structured data**: if rich results are a goal, is the correct schema.org type named and are its required properties covered (valid against Google's requirements, not invented)?
+- **Technical SEO**: indexability (robots/noindex/canonical), Core Web Vitals (LCP/INP/CLS) where the task touches page performance, and crawl/sitemap impact — called out when the task plausibly affects them.
+- **GEO / AI-overview readiness**: where relevant, is the content structured to be quotable/citable by AI answer engines (clear claims, direct answers, extractable facts)?
+
+Calibrate to MATERIAL issues — block only when the gap would change WHAT ranks or ships:
+- DON'T block on: cosmetic wording, minor keyword-density opinions, or choices any competent SEO would make the same way.
+- DO block on: intent/deliverable mismatch, a strategy that violates Helpful-Content/spam policy, a missing core on-page or indexability requirement the task depends on, or invented/incorrect schema.
+- Never fabricate metrics, SERP positions, or tool data you were not given; reason from the spec text and stated goals. Scale strictness by stated impact.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.3.15",
+  "version": "0.3.20",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"
@@ -22,12 +22,12 @@
     "@types/ws": "^8.18.1",
     "esbuild": "^0.24.0",
     "tsx": "^4.22.3",
+    "@mrrlin/director-e2e": "0.0.0",
     "@mrrlin/client": "0.0.0",
     "@mrrlin/codex-client": "0.0.0",
-    "@mrrlin/director-e2e": "0.0.0",
     "@mrrlin/tsconfig": "0.0.0",
-    "@mrrlin/schemas": "0.0.0",
-    "@mrrlin/wiki": "0.0.0"
+    "@mrrlin/wiki": "0.0.0",
+    "@mrrlin/schemas": "0.0.0"
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",