v2.26, same-day continuation of v2.25:
- Records the DIR-7 in-mission-recovery intent correction just made in
docs/design_intent_register.md v1.4 (255096f): the condition-clear-commits-
to-recovery entry trigger built earlier today (2a3e577) is KNOWN-WRONG —
it produced a contradictory live state (W1 GREEN while the vehicle sat in
RETURN_TO_SAFE). Corrected model (pointer to the DIR, not duplicated):
GREEN is unconditionally a working state; committed recovery is triggered
by fault persistence/recurrence, never by condition-clear.
- Marks the FSM entry-trigger rework as the new top-priority NEXT item,
ahead of everything previously listed. Confirmed Working, Open Items, and
PARKED sections rewritten so nothing claims mode-aware recovery works
correctly end to end — the mode-awareness mechanism (2a3e577) and the
safe-zone-reached arrival exit (bf815cc) are both confirmed correct and
unaffected; only entry into committed recovery was wrong.
- Records the W1 safe-zone-reached button as PAUSED, not abandoned: the
rov_api endpoint and external/rov-failsafe-state variable are built and
committed (2def2b1), the pre-edit W1 widget backup exists, but the widget
edit itself was not started since the FSM state it would surface is
currently known-wrong.
- Records a recurring rov_mission build failure, root-caused and fixed:
stray nested build/install/log directories inside src/rov-autonomy
(from colcon being run from the wrong directory) collided with the real
workspace at /data/ros2_ws. Local filesystem cleanup only, no git change.
Durable guard recorded: colcon build only ever from /data/ros2_ws.
New §15g narrative section; Recent Commits, Version History, and Changelog
all updated. Documentation only — no code, widget, or DIR file touched in
this commit. Not uploaded to Claude project knowledge; that remains a
manual step.
docs/handover.md v2.25:
- mode_profile_loader found never wired into rov_full.launch.py despite being
committed 7 Jul (4e48dc2) — /rov/mode/profile had zero publishers at
runtime since; fixed with respawn (464e17e), verified live (0->1)
- failsafe_monitor's mode-aware recovery (2a3e577) surfaced a second gap:
gate-mode RETURN_TO_SAFE was a terminal trap; closed by the new permanent
/rov/nav/safe_zone_reached interface (bf815cc), verified live end-to-end
on the bench; today's publisher is temporary bench scaffolding only
- new §15f narrative section; §0 Confirmed Working, PARKED, NEXT, Recent
Commits, Version History, and Changelog all updated accordingly
- two pre-existing failsafe_monitor defects found this session (not caused
by it), flagged in §0 Open Items and §15f: flag_manual_abort is a
one-way latch never reset (shadows all lower-priority handling after any
manual abort — field-deployment concern); failsafe_monitor produces no
log output in journalctl (cost diagnostic time this session)
docs/design_intent_register.md v1.3:
- new Parked Design Item: mode-aware safe-zone-reached arrival event —
permanent /rov/nav/safe_zone_reached interface, mode-aware/sensor-derived
arrival judgement (GPS at surface + EKF/dead-reckoning underwater), GPS
recorded as first-class across mission types (not hull/jacket-specific),
gate-only scope, temporary W1-button bench-scaffolding publisher pending
navigation — cross-referenced to the DIR-7 "in-mission recovery is
mode-dependent" addendum, whose Implementation note is updated to record
the mechanism is no longer mode-blind (2a3e577)
Not uploaded to Claude project knowledge — that remains a manual step.
