docs(claude): add 2026-07-11 SESSION LOG — failsafe FC-comms-loss resolved, parked items

CLAUDE.md

@@ -427,6 +427,34 @@ entries; correct forward with a new dated entry if something needs revising.
   connection + heartbeat and drive W1 RED on FC comms loss. W1 status line should carry
   cause text (e.g. "Vehicle Disconnected", "Heartbeat Lost", "No Board Running"). Also
   flagged: no FD-count check on ardupilot_manager in the pre-dive gate.
+- 2026-07-11 — RESOLVED the 2026-07-09 flagged safety-critical fault: failsafe_monitor now
+  drives W1 RED on FC comms loss. Four commits: (1) 86b2728 — comms loss forces
+  unconditional RED (was scored as one marginal parameter, only reached AMBER) plus
+  fcu_ever_connected latch so the startup window before any heartbeat is not reported GREEN;
+  cause text "Heartbeat Lost"/"Vehicle Disconnected" added to FailsafeStatus.message per
+  DIR-7. (2) 1b0050d — FSM recovery fix: RETURN_TO_SAFE was a terminal trap (only
+  HOLD_AND_RECOVER could return to NORMAL); now both recover when conditions clear. (3)
+  dbe9515 — cockpit_bridge publishes new data lake variable rov-failsafe-cause (substring of
+  message before first "|"; empty when nominal). (4) 3409ae5 — W1 shows state word on
+  #w1-message (state-driven, no flicker) and cause text on #w1-footer, footer restyled red
+  11px, blank when nominal. All four verified live end-to-end: kill mavros -> RED +
+  "Heartbeat Lost", restart -> recover to GREEN. Also corrected: cockpit_bridge was
+  publishing failsafe_state (FSM, can be 3+) not assessment_state (0/1/2) to rov-failsafe —
+  fixed in dbe9515's sibling commit d854641; this was the real cause of the day's "widgets
+  show no data" (value 3 out of W1's range), compounded by a restart-storm wedging 9001.
+- 2026-07-11 — PARKED for next sessions, in priority order: (a) DOC RESTRUCTURE (do first
+  next session) — consolidate all current-state into the handover as single source of truth,
+  strip state from CLAUDE.md leaving rules only, make SESSION LOG the handover's changelog;
+  DIR and domain docs stay separate. Reason: current-state is smeared across CLAUDE.md,
+  handover and SESSION LOG, causing loss of situational awareness. (b) Mode-dependent
+  failsafe recovery: AUV (health_role=gate) commits to recovery on condition-clear, ROV
+  (advisory) holds AMBER and hands to operator to decide — requires failsafe_monitor to read
+  the mode profile (currently mode-blind). (c) Auto-recovery: failsafe_monitor should attempt
+  to re-establish the FC link itself and only escalate/hold RED if it cannot — real-world has
+  no operator to restore comms. (d) Dedicated "string cause" field in FailsafeStatus.msg to
+  replace the message-substring shortcut in cockpit_bridge. (e) Operator control surface
+  (start/pause/stop buttons via rov_api) and one-command stack startup+healthcheck. (f) DIR
+  and handover updates for the above still owed this session.
 
 ---