job-forge 2.14.43 → 2.14.45

package/.cursor/rules/main.mdc

@@ -36,6 +36,9 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object plus `headless: true` and `stealth: true` to every `geometra_connect` call and every Geometra auto-connect call that passes `pageUrl` or `url`." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
   why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions. Geometra MCP opens visible Chromium unless `headless: true` is explicit, and Geometra MCP >=1.61.3 can launch CloakBrowser stealth Chromium via `stealth: true`; both flags belong with JobForge portal sessions instead of stock visible Playwright Chromium
 
+- [H9] If Geometra MCP disappears, becomes unresponsive, or returns a cascade of `Not connected` after a live form-fill, inspect `.jobforge-mcp/geometra-mcp.jsonl` before guessing. Report the last `launcher_start`, `child_spawn`, `heartbeat`, `signal_received`, `child_stderr`, and `child_exit` events plus the timestamp gap from the last heartbeat. If the last event is an old heartbeat with no `signal_received` / `child_exit`, treat it as likely host SIGKILL or external process death.
+  why: OpenCode or the OS can kill the MCP server without stderr, crash logs, or core dumps. JobForge's MCP launcher writes durable lifecycle events outside MCP stdout, so silent disappearances still leave enough evidence to distinguish host kill, child crash, stderr failure, and wrapper health
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -67,7 +70,7 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]. Use local helpers when they can replace broad file reads, prose math, manual policy checks, or artifact reuse decisions [D8]. Decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8].
+4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8], MCP lifecycle log awareness [H9].
 5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b], then settle the round with postflight status [D8].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].

package/AGENTS.md

@@ -31,6 +31,9 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object plus `headless: true` and `stealth: true` to every `geometra_connect` call and every Geometra auto-connect call that passes `pageUrl` or `url`." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
   why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions. Geometra MCP opens visible Chromium unless `headless: true` is explicit, and Geometra MCP >=1.61.3 can launch CloakBrowser stealth Chromium via `stealth: true`; both flags belong with JobForge portal sessions instead of stock visible Playwright Chromium
 
+- [H9] If Geometra MCP disappears, becomes unresponsive, or returns a cascade of `Not connected` after a live form-fill, inspect `.jobforge-mcp/geometra-mcp.jsonl` before guessing. Report the last `launcher_start`, `child_spawn`, `heartbeat`, `signal_received`, `child_stderr`, and `child_exit` events plus the timestamp gap from the last heartbeat. If the last event is an old heartbeat with no `signal_received` / `child_exit`, treat it as likely host SIGKILL or external process death.
+  why: OpenCode or the OS can kill the MCP server without stderr, crash logs, or core dumps. JobForge's MCP launcher writes durable lifecycle events outside MCP stdout, so silent disappearances still leave enough evidence to distinguish host kill, child crash, stderr failure, and wrapper health
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -62,7 +65,7 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]. Use local helpers when they can replace broad file reads, prose math, manual policy checks, or artifact reuse decisions [D8]. Decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8].
+4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8], MCP lifecycle log awareness [H9].
 5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b], then settle the round with postflight status [D8].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].

package/CLAUDE.md

@@ -31,6 +31,9 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object plus `headless: true` and `stealth: true` to every `geometra_connect` call and every Geometra auto-connect call that passes `pageUrl` or `url`." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
   why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions. Geometra MCP opens visible Chromium unless `headless: true` is explicit, and Geometra MCP >=1.61.3 can launch CloakBrowser stealth Chromium via `stealth: true`; both flags belong with JobForge portal sessions instead of stock visible Playwright Chromium
 
+- [H9] If Geometra MCP disappears, becomes unresponsive, or returns a cascade of `Not connected` after a live form-fill, inspect `.jobforge-mcp/geometra-mcp.jsonl` before guessing. Report the last `launcher_start`, `child_spawn`, `heartbeat`, `signal_received`, `child_stderr`, and `child_exit` events plus the timestamp gap from the last heartbeat. If the last event is an old heartbeat with no `signal_received` / `child_exit`, treat it as likely host SIGKILL or external process death.
+  why: OpenCode or the OS can kill the MCP server without stderr, crash logs, or core dumps. JobForge's MCP launcher writes durable lifecycle events outside MCP stdout, so silent disappearances still leave enough evidence to distinguish host kill, child crash, stderr failure, and wrapper health
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -62,7 +65,7 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]. Use local helpers when they can replace broad file reads, prose math, manual policy checks, or artifact reuse decisions [D8]. Decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8].
+4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8], MCP lifecycle log awareness [H9].
 5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b], then settle the round with postflight status [D8].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].

package/bin/create-job-forge.mjs

@@ -414,6 +414,7 @@ data/timeline-events.jsonl
 .jobforge-prioritize.json
 .jobforge-prioritize-items.json
 .jobforge-lineage.json
+.jobforge-mcp/
 .jobforge-runs/
 .jobforge-redacted/
 reports/

package/bin/geometra-mcp-launcher.mjs

@@ -1,12 +1,21 @@
 #!/usr/bin/env node
 
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const DEFAULT_FALLBACK_PACKAGE = '@geometra/mcp@1.62.1';
+const DEFAULT_FALLBACK_PACKAGE = '@geometra/mcp@1.62.2';
 const RESOLVE_ONLY_FLAG = '--job-forge-resolve-target';
+const DEFAULT_LOG_RELATIVE_PATH = '.jobforge-mcp/geometra-mcp.jsonl';
+const DEFAULT_HEARTBEAT_MS = 15_000;
+const MAX_STDERR_LOG_CHARS = 4_000;
+const SIGNAL_EXIT_CODES = {
+  SIGHUP: 129,
+  SIGINT: 130,
+  SIGQUIT: 131,
+  SIGTERM: 143,
+};
 
 function normalizeEnv(value) {
   if (typeof value !== 'string') return null;
@@ -26,6 +35,94 @@ function readJsonFile(filePath) {
   return JSON.parse(readFileSync(filePath, 'utf8'));
 }
 
+function boolEnvDisabled(value) {
+  if (typeof value !== 'string') return false;
+  return ['0', 'false', 'no', 'off'].includes(value.trim().toLowerCase());
+}
+
+function positiveIntEnv(value, fallback) {
+  if (typeof value !== 'string' || value.trim() === '') return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+function createLifecycleLogger(projectDir) {
+  if (boolEnvDisabled(process.env.JOB_FORGE_GEOMETRA_MCP_LOG)) {
+    return {
+      enabled: false,
+      logPath: null,
+      write() {},
+    };
+  }
+
+  const configuredPath = normalizeEnv(process.env.JOB_FORGE_GEOMETRA_MCP_LOG_PATH);
+  const logPath = configuredPath ? resolve(configuredPath) : join(projectDir, DEFAULT_LOG_RELATIVE_PATH);
+
+  function write(event, detail = {}) {
+    try {
+      mkdirSync(dirname(logPath), { recursive: true });
+      appendFileSync(logPath, `${JSON.stringify({
+        ts: new Date().toISOString(),
+        event,
+        pid: process.pid,
+        ppid: process.ppid,
+        projectDir,
+        ...detail,
+      })}\n`);
+    } catch {
+      // Logging must never break MCP startup or stdio protocol handling.
+    }
+  }
+
+  return {
+    enabled: true,
+    logPath,
+    write,
+  };
+}
+
+function targetForLog(target) {
+  return {
+    source: target.source,
+    command: target.command,
+    args: target.args,
+    resolvedPath: target.resolvedPath,
+    packageSpec: target.packageSpec,
+  };
+}
+
+function envForLog() {
+  return {
+    node: process.version,
+    platform: process.platform,
+    arch: process.arch,
+    geometraStealth: process.env.GEOMETRA_STEALTH ?? null,
+    geometraBrowser: process.env.GEOMETRA_BROWSER ?? null,
+    explicitMcpPath: Boolean(normalizeEnv(process.env.JOB_FORGE_GEOMETRA_MCP_PATH)),
+    explicitMcpPackage: Boolean(normalizeEnv(process.env.JOB_FORGE_GEOMETRA_MCP_PACKAGE)),
+    explicitLogPath: Boolean(normalizeEnv(process.env.JOB_FORGE_GEOMETRA_MCP_LOG_PATH)),
+  };
+}
+
+function processHealthForLog() {
+  const memory = process.memoryUsage();
+  const resourceUsage = typeof process.resourceUsage === 'function' ? process.resourceUsage() : null;
+  return {
+    uptimeMs: Math.round(process.uptime() * 1000),
+    memory,
+    resourceUsage,
+  };
+}
+
+function stderrChunkForLog(chunk) {
+  const text = Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk);
+  return {
+    text: text.slice(0, MAX_STDERR_LOG_CHARS),
+    bytes: Buffer.byteLength(text),
+    truncated: text.length > MAX_STDERR_LOG_CHARS,
+  };
+}
+
 function readProjectPathFromPackageJson(projectDir) {
   const packagePath = join(projectDir, 'package.json');
   if (!existsSync(packagePath)) return null;
@@ -114,18 +211,109 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  const projectDir = process.env.JOB_FORGE_PROJECT || process.cwd();
+  const logger = createLifecycleLogger(projectDir);
+  const heartbeatMs = boolEnvDisabled(process.env.JOB_FORGE_GEOMETRA_MCP_HEARTBEAT)
+    ? 0
+    : positiveIntEnv(process.env.JOB_FORGE_GEOMETRA_MCP_HEARTBEAT_MS, DEFAULT_HEARTBEAT_MS);
+
+  logger.write('launcher_start', {
+    argv,
+    target: targetForLog(target),
+    env: envForLog(),
+    logPath: logger.logPath,
+    heartbeatMs,
+  });
+
   const child = spawn(target.command, [...target.args, ...argv], {
-    stdio: 'inherit',
+    stdio: ['inherit', 'inherit', 'pipe'],
     env: process.env,
   });
+  let exiting = false;
+  let heartbeat = null;
+
+  logger.write('child_spawn', {
+    childPid: child.pid,
+    target: targetForLog(target),
+  });
+
+  if (child.stderr) {
+    child.stderr.on('data', (chunk) => {
+      process.stderr.write(chunk);
+      logger.write('child_stderr', {
+        childPid: child.pid,
+        ...stderrChunkForLog(chunk),
+      });
+    });
+  }
+
+  if (heartbeatMs > 0) {
+    heartbeat = setInterval(() => {
+      logger.write('heartbeat', {
+        childPid: child.pid,
+        childKilled: child.killed,
+        health: processHealthForLog(),
+      });
+    }, heartbeatMs);
+    heartbeat.unref();
+  }
+
+  const signalNames = ['SIGHUP', 'SIGINT', 'SIGQUIT', 'SIGTERM'];
+  for (const signal of signalNames) {
+    process.once(signal, () => {
+      if (exiting) return;
+      exiting = true;
+      if (heartbeat) clearInterval(heartbeat);
+      logger.write('signal_received', {
+        signal,
+        childPid: child.pid,
+        childKilled: child.killed,
+        health: processHealthForLog(),
+      });
+      if (!child.killed) child.kill(signal);
+      process.exit(SIGNAL_EXIT_CODES[signal] ?? 1);
+    });
+  }
+
+  process.once('uncaughtException', (error) => {
+    logger.write('uncaught_exception', {
+      message: error instanceof Error ? error.message : String(error),
+      stack: error instanceof Error ? error.stack : null,
+      health: processHealthForLog(),
+    });
+    throw error;
+  });
+
+  process.once('unhandledRejection', (reason) => {
+    logger.write('unhandled_rejection', {
+      message: reason instanceof Error ? reason.message : String(reason),
+      stack: reason instanceof Error ? reason.stack : null,
+      health: processHealthForLog(),
+    });
+  });
 
   child.on('error', (error) => {
+    if (heartbeat) clearInterval(heartbeat);
+    logger.write('child_error', {
+      childPid: child.pid,
+      message: error instanceof Error ? error.message : String(error),
+      stack: error instanceof Error ? error.stack : null,
+      health: processHealthForLog(),
+    });
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
   });
 
   child.on('exit', (code, signal) => {
+    if (heartbeat) clearInterval(heartbeat);
+    logger.write('child_exit', {
+      childPid: child.pid,
+      code,
+      signal,
+      health: processHealthForLog(),
+    });
     if (signal) {
+      for (const signalName of signalNames) process.removeAllListeners(signalName);
       process.kill(process.pid, signal);
       return;
     }

package/docs/SETUP.md

@@ -216,6 +216,8 @@ Use it to identify which sessions or models are consuming the most tokens. The `
 **PDF generation fails**  
 The scaffolded `opencode.json` already registers Geometra MCP; if it's not running, check `opencode mcp list` and verify the scaffolded config under the `mcp.geometra` key — its `command` MUST be `["npx", "--no-install", "job-forge", "mcp:geometra"]`, `enabled: true`, and its `environment` should include `GEOMETRA_STEALTH=1` (or equivalently `GEOMETRA_BROWSER=stealth`) so proxy-backed portal sessions default to CloakBrowser's patched Chromium. `job-forge mcp:geometra` resolves Geometra in this order: `JOB_FORGE_GEOMETRA_MCP_PATH`, then a consumer-project override from `package.json -> jobForge.geometraMcpPath`, then `opencode.json -> mcp.geometra.environment.JOB_FORGE_GEOMETRA_MCP_PATH`, then a sibling `../geometra/mcp/dist/index.js` checkout for local JobForge development, and finally the pinned npm package. Geometra manages Chromium via its built-in proxy. JobForge still passes `headless: true` and `stealth: true` for portal sessions explicitly; the env block keeps the default aligned for auto-spawned sessions and local debugging. For standalone CLI usage (outside opencode), `generate-pdf.mjs` also works with standalone Playwright/Chromium — install with `npx playwright install chromium`.
 
+`job-forge mcp:geometra` writes MCP launcher diagnostics to `.jobforge-mcp/geometra-mcp.jsonl`. If the server silently vanishes with empty stderr, run `tail -40 .jobforge-mcp/geometra-mcp.jsonl`. A final `signal_received` event means the host sent a catchable signal, a final `child_exit` means Geometra exited, and an old final `heartbeat` with no exit/signal usually means SIGKILL or external process death. Set `JOB_FORGE_GEOMETRA_MCP_LOG_PATH` to move the log, `JOB_FORGE_GEOMETRA_MCP_LOG=0` to disable it, or `JOB_FORGE_GEOMETRA_MCP_HEARTBEAT_MS` to tune the heartbeat interval.
+
 For consumer projects that should always use a local Geometra checkout across Opencode, Codex, Cursor, and Claude, prefer a local `package.json` override instead of editing symlinked MCP configs:
 
 ```json

package/iso/instructions.md

@@ -31,6 +31,9 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object plus `headless: true` and `stealth: true` to every `geometra_connect` call and every Geometra auto-connect call that passes `pageUrl` or `url`." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
   why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions. Geometra MCP opens visible Chromium unless `headless: true` is explicit, and Geometra MCP >=1.61.3 can launch CloakBrowser stealth Chromium via `stealth: true`; both flags belong with JobForge portal sessions instead of stock visible Playwright Chromium
 
+- [H9] If Geometra MCP disappears, becomes unresponsive, or returns a cascade of `Not connected` after a live form-fill, inspect `.jobforge-mcp/geometra-mcp.jsonl` before guessing. Report the last `launcher_start`, `child_spawn`, `heartbeat`, `signal_received`, `child_stderr`, and `child_exit` events plus the timestamp gap from the last heartbeat. If the last event is an old heartbeat with no `signal_received` / `child_exit`, treat it as likely host SIGKILL or external process death.
+  why: OpenCode or the OS can kill the MCP server without stderr, crash logs, or core dumps. JobForge's MCP launcher writes durable lifecycle events outside MCP stdout, so silent disappearances still leave enough evidence to distinguish host kill, child crash, stderr failure, and wrapper health
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -62,7 +65,7 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]. Use local helpers when they can replace broad file reads, prose math, manual policy checks, or artifact reuse decisions [D8]. Decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8].
+4. Prepare Geometra dispatches: cleanup [H3], local-helper prefilters when useful [D8], dedupe [H2], location filter [D5], file-backed preflight plan/check [D8], routing [D2], proxy/headless/stealth prompt hygiene [H8], MCP lifecycle log awareness [H9].
 5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b], then settle the round with postflight status [D8].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].

package/modes/apply.md

@@ -4,8 +4,8 @@ Live application assistant. Reads the active application form in Chrome (via Geo
 
 ## Hard limits
 
-- [H1] Submit the form in a single `geometra_run_actions` call that chains upload + fill + pick + submit. Never split upload / fill / submit across multiple tool calls.
-  why: Greenhouse-style forms regenerate internal field IDs after any DOM-mutating action (especially file uploads); multi-call sequences see stale IDs, enter a retry loop, and burn tens of thousands of tokens (4-retry Anthropic FDE trace, ~10K wasted tokens)
+- [H1] Submit the form with one stable `geometra_run_actions` action array that chains upload + fill + pick + submit. Set `softTimeoutMs: 45000`, `output: "final"`, and `includeSteps: false`; if Geometra returns `paused: true` with `resumeFromIndex`, immediately continue with the exact same `actions` array and that `resumeFromIndex`. Never split upload / fill / submit across separate direct tools or rebuilt action arrays.
+  why: Greenhouse-style forms regenerate internal field IDs after any DOM-mutating action (especially file uploads); multi-call sequences see stale IDs, enter a retry loop, and burn tens of thousands of tokens. The soft-timeout continuation keeps the MCP call under host timeout without changing the action array or restarting the application
 
 - [H2] Never auto-retry a failed submit. On recovery failure, report the error to the orchestrator and stop. The orchestrator decides whether to re-dispatch.
   why: duplicate applications are worse than a missed retry — ATS portals often accept a submit whose response was dropped mid-flight, so a retry double-submits. A human must decide.
@@ -64,7 +64,7 @@ Live application assistant. Reads the active application form in Chrome (via Geo
 9. Route high-stakes applications through `@general-paid` [D8].
 10. Extract form questions; classify each Section-G vs new.
 11. Generate answers from Block B + Block F + Section G + JD.
-12. Submit as ONE `run_actions` call [H1] using labels [D6] with `imeFriendly: true` [D4].
+12. Submit via one stable `run_actions` action array [H1] using labels [D6], `imeFriendly: true` [D4], `softTimeoutMs: 45000`, `output: "final"`, and `includeSteps: false`.
 13. On session error, run the 4-step recovery; only one retry [H2].
 14. On provider failure, stop and inspect telemetry before any retry [D9].
 15. On OTP prompt, fetch the code from Gmail via `gmail_get_message`.
@@ -308,13 +308,16 @@ Notes:
 
 When the candidate asks you to actually submit (or when running in auto-pipeline mode at score ≥ 3.0), follow these rules **strictly**. Greenhouse-style forms regenerate internal field IDs after any DOM-mutating action, especially file uploads. That breaks multi-call fill sequences and forces the model into a retry loop that burns tens of thousands of tokens.
 
-### Use one `run_actions` call (Rule A — never split)
+### Use one stable `run_actions` action array (Rule A — never split)
 
-Do the entire submission in a **single** `geometra_run_actions` call that chains all steps. Never split upload / fill / submit across multiple tool calls.
+Do the entire submission with one stable `geometra_run_actions` `actions` array that chains all steps. Never split upload / fill / submit across separate direct tools, and never rebuild the action array between continuations.
 
 ```
 geometra_run_actions({
   sessionId: "...",
+  softTimeoutMs: 45000,
+  output: "final",
+  includeSteps: false,
   actions: [
     { type: "upload_files",  fieldLabel: "Resume/CV", paths: ["/abs/path/cv.pdf"] },
     { type: "fill_fields",   imeFriendly: true,
@@ -326,6 +329,8 @@ geometra_run_actions({
 })
 ```
 
+If the response contains `paused: true`, `pauseReason: "soft-timeout"`, and `resumeFromIndex`, call `geometra_run_actions` again immediately with the same `sessionId`, the exact same `actions` array, `softTimeoutMs: 45000`, `output: "final"`, `includeSteps: false`, and `resumeFromIndex` set to the returned value. This is a continuation, not a retry, and it is the host-safe path for long Samsara/Greenhouse-style embeds. Stop only if the continued call fails, not merely because it paused.
+
 **Always pass `imeFriendly: true` on `fill_fields` for Ashby** (and safe as a default everywhere). Ashby's React form swallows programmatic text input silently — visible value looks correct, `invalidCount` stays >0, and Submit fails with "field required" or "flagged as possible spam." `imeFriendly: true` fires proper composition events that clear React's internal validity state. Confirmed fix: Supabase #793 (2026-04-19). Zero cost on other portals; no reason to leave it off.
 
 ### Use `fieldLabel` over `fieldId` (Rule B)
@@ -356,6 +361,9 @@ Call 3:  geometra_connect({
          })
 Call 4:  geometra_run_actions({
            sessionId: "<new sessionId from Call 3>",
+           softTimeoutMs: 45000,
+           output: "final",
+           includeSteps: false,
            actions: [... the EXACT same actions array you used before ...]
          })
 ```
@@ -365,7 +373,8 @@ Call 4:  geometra_run_actions({
 1. **Always run all 4 calls.** Do not skip Call 1 or Call 2 even if Call 1 shows an empty pool.
 2. **Do not re-fetch the form schema.** Do not call `geometra_form_schema` between Call 3 and Call 4. Your labels haven't changed, so the same `actions` array still works.
 3. **Do not edit the actions array.** Copy it verbatim from your first attempt. Do not re-pick fieldIds. Do not add or remove actions. Same array in, same array out.
-4. **Only ONE retry.** If Call 4 ALSO fails, STOP. Return this exact message to the orchestrator:
+4. **Soft-timeout pause is not failure.** If Call 4 returns `paused: true`, continue with the returned `resumeFromIndex` and the exact same action array. Do not count this as the one retry.
+5. **Only ONE retry.** If Call 4 ALSO fails, STOP. Return this exact message to the orchestrator:
 
    ```
    APPLY FAILED AFTER RECOVERY: <URL>

package/modes/reference-geometra.md

@@ -159,6 +159,8 @@ Subagents launched via the `task` tool start with a fresh context and cannot aut
 
 **Fix in one sentence:** ALWAYS run `geometra_list_sessions` + `geometra_disconnect` BEFORE `geometra_connect`. Every time. No exceptions except the one explicit exception below.
 
+If Geometra MCP itself disappears or becomes unresponsive, inspect `.jobforge-mcp/geometra-mcp.jsonl` before escalating. `signal_received` means the MCP host or parent process sent a catchable signal, `child_exit` means the Geometra child exited, `child_stderr` preserves stderr that may not show in the agent transcript, and a final stale `heartbeat` with no later event usually means SIGKILL / host reap / OS kill. Report the final event type and timestamp rather than saying only "MCP crashed."
+
 ---
 
 #### Rule 1 — Orchestrator pre-dispatch cleanup (DO THIS EVERY TIME)

package/modes/reference-portals.md

@@ -145,4 +145,20 @@ Use `npx job-forge portal:snapshot --url "{url}" --json` or `npx job-forge porta
 
 `job-forge mcp:geometra` resolves Geometra in this order: `JOB_FORGE_GEOMETRA_MCP_PATH`, then `package.json -> jobForge.geometraMcpPath`, then `opencode.json -> mcp.geometra.environment.JOB_FORGE_GEOMETRA_MCP_PATH`, then a sibling local `../geometra/mcp/dist/index.js` checkout for maintainers working across both repos, then the pinned npm fallback.
 
+JobForge's Geometra launcher writes a durable lifecycle log at `.jobforge-mcp/geometra-mcp.jsonl` in the consumer project. The log is JSONL and does not use stdout, so it does not interfere with the MCP stdio protocol. Expected events include `launcher_start`, `child_spawn`, periodic `heartbeat`, `child_stderr`, `signal_received`, `child_error`, and `child_exit`. Override the location with `JOB_FORGE_GEOMETRA_MCP_LOG_PATH`, disable it with `JOB_FORGE_GEOMETRA_MCP_LOG=0`, or tune the heartbeat with `JOB_FORGE_GEOMETRA_MCP_HEARTBEAT_MS`.
+
 To check or modify MCP settings, edit `opencode.json` in the project root.
+
+## Silent MCP Death Diagnostics
+
+If Geometra MCP vanishes with no stderr, no crash log, and subsequent calls return `Not connected`, inspect the lifecycle log before making a claim:
+
+```bash
+tail -40 .jobforge-mcp/geometra-mcp.jsonl
+```
+
+- Last event is `signal_received`: the MCP host or parent process sent a catchable signal such as `SIGTERM`.
+- Last event is `child_exit`: the Geometra child process exited and the log should show its code or signal.
+- Last event is `child_stderr`: preserve the stderr text; it is the best upstream bug report payload.
+- Last event is an old `heartbeat` with no later `signal_received` or `child_exit`: likely host `SIGKILL`, OS kill, or wrapper process death. No process can log after `SIGKILL`, so report the heartbeat timestamp and the missing exit event.
+- No `launcher_start`: OpenCode never started JobForge's Geometra launcher, or it used a different MCP command/config.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-forge",
-  "version": "2.14.43",
+  "version": "2.14.45",
   "description": "AI-powered job search pipeline built on opencode",
   "type": "module",
   "bin": {
@@ -199,7 +199,7 @@
     "@agent-pattern-labs/iso-score": "^0.1.1",
     "@agent-pattern-labs/iso-timeline": "^0.1.1",
     "@agent-pattern-labs/iso-trace": "^0.5.1",
-    "@geometra/mcp": "1.62.1",
+    "@geometra/mcp": "1.62.2",
     "playwright": "^1.58.1"
   },
   "devDependencies": {

package/scripts/check-iso-smoke.mjs

@@ -22,12 +22,14 @@ const checks = [
   ["H6 requires merge and verify", () => every(files.instructions, ["batch/tracker-additions/*.tsv", "npx job-forge merge", "npx job-forge verify"])],
   ["H7 distrusts subagent prose", () => every(files.instructions, ["must originate from a file", "not from prior subagent prose"])],
   ["H8 keeps proxy secret and requires headless stealth", () => every(files.instructions, ["[H8]", "Do not transcribe `server`, `username`, `password`, or `bypass`", "`headless: true`", "`stealth: true`"])],
+  ["H9 points to Geometra MCP lifecycle logs", () => every(files.instructions, ["[H9]", ".jobforge-mcp/geometra-mcp.jsonl", "launcher_start", "heartbeat", "child_exit"])],
   ["OpenCode addendum exists for task semantics", () => every(files.instructionsOpencode, ["OpenCode", "`task`", "launch acknowledgement", "Do not use `task` to poll status"])],
   ["root points to consolidated helper reference", () => every(files.instructions, ["[D8]", "modes/reference-local-helpers.md", "deterministic local helpers"])],
   ["helper reference covers score/timeline/prioritize/lineage", () => every(files.helpers, ["templates/score.json", "npx job-forge score:*", "templates/timeline.json", "npx job-forge timeline:*", "templates/prioritize.json", "npx job-forge prioritize:*", ".jobforge-lineage.json", "npx job-forge lineage:*"])],
   ["root helper defaults are consolidated", () => !/\[D(?:9|1\d|2[0-9])\]/.test(files.instructions)],
   ["shared prompt points to on-demand references", () => every(files.instructions, ["modes/{mode}.md", "modes/reference-setup.md", "modes/reference-portals.md", "modes/reference-geometra.md"])],
   ["apply mode requires headless stealth Geometra", () => every(files.apply, ["`headless: true`", "`stealth: true`", "`isolated: true`", "every Geometra auto-connect call"])],
+  ["apply mode uses host-safe run_actions continuations", () => every(files.apply, ["softTimeoutMs: 45000", "resumeFromIndex", "pauseReason: \"soft-timeout\"", "This is a continuation, not a retry"])],
   ["apply mode owns high-stakes upgrade", () => every(files.apply, ["[D8]", "@general-paid", "4.0/5", "high-stakes"])],
   ["apply mode blocks provider auto-downgrade", () => every(files.apply, ["[D9]", "do not auto-downgrade", "inspect telemetry before retrying"])],
   ["models policy pins OpenCode to DeepSeek V4 Flash", () => /extends:\s*standard/.test(files.models) && count(files.models, "opencode-go/deepseek-v4-flash") >= 4],

package/templates/migrations.json

@@ -112,6 +112,7 @@
             ".jobforge-prioritize.json",
             ".jobforge-prioritize-items.json",
             ".jobforge-lineage.json",
+            ".jobforge-mcp/",
             ".jobforge-redacted/",
             "data/timeline-events.jsonl",
             "batch/preflight-candidates.json",