The 11 Jul DIR-7 addendum "In-mission recovery is mode-dependent" stated
that AUV gate mode commits to recovery ON CONDITION-CLEAR. That was
inverted and wrong — it produced a contradictory GREEN-while-in-
RETURN_TO_SAFE state observed live.
Corrected intent (v1.4, 13 Jul 2026, attributed to Grant):
- GREEN is unconditionally a working state. A cleared fault returns the
vehicle to GREEN and the mission continues/resumes; a cleared condition
must never trigger or commit a recovery. Committed recovery is triggered
by a fault PERSISTING or RECURRING, never by it clearing.
- Three-tier fault model: (1) uncontrollable — power loss / anything that
disables the safety logic itself, out of scope for the FSM, adjacent to
shelved DIR-6; (2) transient/self-resetting — system attempts restore,
returns to GREEN and resumes on success, each failure increments a raw
count (deliberately no time window/duration), commits to RETURN_TO_SAFE
only once the count exceeds a configured acceptable number; (3)
hard/persistent — a RED that doesn't clear, commits immediately without
waiting on a count.
- All thresholds (acceptable count, transient-vs-hard classification) are
configuration-driven via the resolved mode profile, same as health_role,
never hardcoded.
- Survives, correct: health_role mode-awareness (2a3e577); the
safe-zone-reached arrival-exit mechanism (bf815cc) — its role (completing
a committed recovery) is unchanged. Retired, known-wrong: 2a3e577's
condition-clear entry logic, which bf815cc built its exit on top of —
pending next-session rework into the count-based model. Only the ENTRY
into committed recovery was wrong, not the exit.
New Parked Design Item: adaptive restart-timing — monitor own restore
count/duration per fault, log it, weigh future restart attempts against
observed history rather than a fixed time. Deliberately holds all
time/duration sophistication kept out of the count-based correction;
depends on the count-based retry machinery existing first. Design-captured,
not yet specified for build.
Changelog and known-implementation-drift callout updated accordingly —
failsafe_monitor's current condition-clear logic is now flagged as a known
implementation gap pending rework, not merely an unimplemented addendum.
Documentation only — no code or widget files touched. Not uploaded to
Claude project knowledge; that remains a manual step.
255096f20b