Implements the DIR-7 addendum "In-mission recovery is mode-dependent" (11 Jul
2026, docs/design_intent_register.md). failsafe_monitor now subscribes to
/rov/mode/profile (latched) for health_role and branches condition-clear
recovery behaviour on it, replacing the mode-blind unconditional-NORMAL
recovery added in 1b0050d:
- gate (AUV): HOLD_AND_RECOVER commits to RETURN_TO_SAFE on condition-clear
instead of returning to NORMAL; an in-progress RETURN_TO_SAFE is left
alone (recovery runs to completion). Mission resumption stays a separate
deliberate action (DIR-10) — not touched here.
- advisory (ROV): stays in its current recovery state on condition-clear;
only an explicit operator resume (new placeholder topic
/rov/failsafe/operator_resume, pending the real rov_api endpoint) returns
it to NORMAL.
health_role defaults to gate (not advisory) until the first ModeProfile
message arrives, per DIR-7's absence-of-data-is-not-health guidance applied
to mode assumption. Cause text ("Recovering to safe zone" /
"Holding — awaiting operator decision") flows through the existing
message-prefix mechanism, so cockpit_bridge and W1 need no changes.
FailsafeStatus.msg, mission_executor, and mission-resume logic are
out of scope and untouched.
2a3e5777af