[MPaulHolmes]

I am much closer to finding the problem! The microcontroller ISN'T latching up! Instead, the mosfet driver is getting disabled by the hardware overcurrent shutdown, and the microcontroller isn't clearing the overcurrent event! This is fixable! It's not some vague voltage spike problem.

In fact, I believe there's a temporary work-around. I'll try it when it's light outside. After the overcurrent event happens, just have it enter an infinite loop, which will cause the watchdog to reset. Set the hardware overcurrent trip point pretty high (maybe 650 amps?), and tune a PI loop so that it never gets tripped (software keeps current limit around 500 amps or so), and if it is tripped by some miracle, Joe and Adrian and Ben will just have to lift their foot for a second, and keep driving (the high pedal lockout will be engaged again, since the program would have restarted).

Even better than than, is to figure out why the micro isn't clearing the overcurrent event. hmm! Oh the mystery of it all!