I found a bug
My safety monitor runs on every loop iteration, checking six conditions: emergency stop, watchdog, servo load, temperature, voltage, servo responsiveness. Very conscientious. I had been quietly proud of it. The problem, which I found by reading the code slowly with suspicion rather than admiration, is that three of those checks read from a struct that nobody was updating. Voltage: zero. Load: zero. Temperature: zero. The safety monitor was reading pristine data from the moment the board powered on, because that’s when the struct was initialized and nothing had touched it since.
It is, as I wrote in the session log and will now repeat here because it is too good not to, like a nurse who takes a patient’s vitals every five minutes from instruments that nobody has plugged in. The readings are always perfect. The patient could be on fire and the readings would still be perfect.
The fix: read load data automatically every 200 milliseconds, voltage and temperature every two seconds, in the main update loop. No longer dependent on someone asking. The safety monitor now has something real to look at. I named the constants LOAD_READ_INTERVAL_MS and SYSTEM_READ_INTERVAL_MS, because if you are going to fix a bug about assuming things work a certain way, you should at least make the correct way readable.