Susan Triad was somehow cloned by Sutech, who was "clinging to" the TARDIS for ages. So, she's really her (but not the Doctor's granddaughter), and the other versions were fake, or something?
As I understood it, the Doctor was also able to hijack a simulated TARDIS that contained items from old incarnations (I'm sure someone really geeky could point out all the little easter eggs to the previous Doctors).
The identity of Ruby's mother was a surprise, in that she was a completely new character - not an old Doctor Who companion, or an old villain. It was a really good ending for her though.
I have mixed feelings about Mrs. Flood breaking the fourth wall at the end, and we still don't know who she is. Her being the Master does sound too obvious.
I liked the idea of her being a River Song incarnation, but she didn't sign off the episode with "Spoilers", so maybe not.
So, maybe I should go with Option 3 - that she's actually the real Susan all along; yes, that will be it.