FN-5891: respect validator model settings in mission validation

Use the configured validator lane when creating mission validation sessions.

- resolve mission validation session models from test mode, assigned agent runtime, and validator/default task settings in precedence order
- surface validation session creation failures as mission validation errors instead of triggering fix-feature retries
- add regression coverage and documentation for mission validation model resolution and error handling

Files changed:
 AGENTS.md                                          |   1 +
 docs/missions.md                                   |   4 +-
 docs/settings-reference.md                         |   6 +-
 .../src/__tests__/mission-execution-loop.test.ts   | 252 ++++++++++++++++++++-
 packages/engine/src/mission-execution-loop.ts      |  63 +++++-
 5 files changed, 316 insertions(+), 10 deletions(-)

Fusion-Task-Id: FN-5891

Fusion-Task-Lineage: 6254daee-fb6b-4ebb-9fb4-3636237404b1

docs/missions.md

@@ -405,6 +405,8 @@ On task completion, the scheduler calls `MissionExecutionLoop.processTaskOutcome
 4. Fire AI validator agent against contract assertions
 5. Record `MissionValidatorRun` with per-assertion results
 
+Mission validation resolves its model from the validator lane before session creation: assigned agent runtime model (when the linked task has an assigned durable agent) → per-task `validatorModelProvider`/`validatorModelId` → project `validatorProvider`/`validatorModelId` → global `validatorGlobalProvider`/`validatorGlobalModelId` → project `defaultProviderOverride`/`defaultModelIdOverride` → global `defaultProvider`/`defaultModelId`. In `testMode`, validation is forced to `mock/scripted` instead of falling through to provider auto-detection.
+
 Validation runs are internal mission-loop operations: Fusion does **not** create visible `🔍 Validate:` board tasks for single-feature validation.
 
 ```typescript
@@ -425,7 +427,7 @@ interface MissionValidatorRun {
 }
 ```
 
-**Validation timeout:** 10 minutes (`VALIDATION_TIMEOUT_MS = 10 * 60 * 1000`). If the validator times out, the run is marked `error` and the feature remains in `needs_fix` for retry.
+**Validation timeout:** 10 minutes (`VALIDATION_TIMEOUT_MS = 10 * 60 * 1000`). If session creation, auth/credit checks, prompting, or timeout fails, the run is marked `error` and emits a surfaced `validation_error` mission event instead of silently spawning a fix feature.
 
 ### Phase 5: Fix-Feature Retries
 

docs/settings-reference.md

@@ -729,6 +729,8 @@ When heartbeat has both (1) and (2-5), the runtime model is used as primary and
 5. Global `defaultProvider` + `defaultModelId`
 6. Automatic provider/model resolution
 
+Mission validation sessions use this same validator lane, with an assigned durable agent runtime model taking precedence when the linked task has one.
+
 ### Merger model
 
 1. Assigned durable agent runtime model (`runtimeConfig.model` or `runtimeConfig.modelProvider` + `runtimeConfig.modelId`) when both provider and model ID are set
@@ -1301,13 +1303,13 @@ All three lanes (planning / executor / reviewer) follow the same 5-tier preceden
 
 ## Mock provider (test mode)
 
-Set `defaultProvider: "mock"` at any tier in that hierarchy (or the per-task lane override) to force planning, executor, reviewer/validator, merger, and heartbeat sessions onto the deterministic zero-network mock runtime.
+Set `defaultProvider: "mock"` at any tier in that hierarchy (or the per-task lane override) to force planning, executor, reviewer/validator, mission validation, merger, and heartbeat sessions onto the deterministic zero-network mock runtime.
 Default scripts are scripted by session purpose: executor marks unfinished steps done, triage writes a minimal PROMPT.md and calls `fn_review_spec` when available, reviewer/validation emit `Verdict: APPROVE`, and merger/heartbeat no-op safely.
 Per-task and global script overrides live in `mockScriptRegistry` (`setMockScript`, `clearMockScript`, `resetMockScripts`) exported from `@fusion/engine`.
 The mock runtime never registers with pi's `ModelRegistry` and is guarded by tests that fail on any `fetch`, `http.request`, or `https.request` usage.
 Activation UX/settings affordances are handled separately in FN-5204.
 
-`testMode?: boolean` exists at both global and project scopes. Project `testMode: true` takes precedence and forces planning, executor, reviewer/validator, merger, and heartbeat to `mock/scripted` regardless of per-task or per-lane overrides. The dashboard surfaces this with the Settings Modal "Enable test mode" toggle and the shell banner: "Test mode — no real AI calls".
+`testMode?: boolean` exists at both global and project scopes. Project `testMode: true` takes precedence and forces planning, executor, reviewer/validator, mission validation, merger, and heartbeat to `mock/scripted` regardless of per-task or per-lane overrides. The dashboard surfaces this with the Settings Modal "Enable test mode" toggle and the shell banner: "Test mode — no real AI calls".
 
 ## Per-task token budget precedence