fix(mission-control): namespace the designer-rotation state key — one file was shared by every mission

.claude/skills/mission-control/SKILL.md

@@ -1312,7 +1312,7 @@ model from the driver-exported env (defaults track the charter table):
 | Role | Model env | Default |
 |---|---|---|
 | Controller (this session: triage/pick/record/retro) | `$MODEL` (session) | **Opus** (opus-first since 2026-07-16, Mark: the long orchestration session is mechanical work — it must NOT ride Fable) |
-| Design-doc-creator | **ROTATION** (Mark 2026-07-17; `$MISSION_DESIGNER_MODEL` is the rotation SEED, not a fixed pin) | Rotate per new-doc iteration: `claude:claude-fable-5` → `codex:gpt-5.6-sol` → (gemini after G4) → repeat. State: `~/.ailang/state/mission-designer-rotation` holds the LAST-USED value; pick the next list entry (missing file = start at claude), write back after the designer run. Every design passes the quorum regardless of author — record `(designer, quorum outcome)` in the evidence row. A probe-failed designer falls to the NEXT in rotation (not to `$MODEL`), FLAGGED |
+| Design-doc-creator | **ROTATION** (Mark 2026-07-17; `$MISSION_DESIGNER_MODEL` is the rotation SEED, not a fixed pin) | Rotate per new-doc iteration: `claude:claude-fable-5` → `codex:gpt-5.6-sol` → (gemini after G4) → repeat. State: **`~/.ailang/state/mission-${MISSION_NAME}-designer-rotation`** holds the LAST-USED value; pick the next list entry (missing file = start at claude), write back after the designer run. **NAMESPACE THAT PATH — the unnamespaced `mission-designer-rotation` this skill used to prescribe is ONE FILE SHARED BY EVERY MISSION ON THE RIG, so a sibling's designer run silently overwrites yours, and the loop cannot tell a clobbered pointer from its own** (fixed 2026-08-13 V1 iteration 188; two frictions, both first-party). The Repo Profile above says "namespaced state keys (M1) keep two missions on one rig from colliding" — true of the keys M1 actually covered, and **false of this one**, which is why nobody re-checked it. Measured: `~/.ailang/state/` holds `mission-world-designer-rotation` and `mission-motoko-designer-rotation` — namespaced files hand-created by careful sibling controllers — **that this skill's literal path never reads**, beside the unnamespaced file it does. Friction 1: iteration 187 recorded advancing V1's pointer `claude → codex`, and at pick time it read `claude:claude-fable-5` again, mtime **01:10**, while V1 was idle (23:42→01:12) and `mission-world` was mid-iteration with a fable designer — consistent with a sibling write, and certain either way that 187's recorded advance was lost. Friction 2: iteration 188 then had to adjudicate between the file and the log to choose a designer at all, which is a coin-flip no rule covers. Note the failure is SILENT and self-concealing: a clobbered pointer holds a *valid* rotation value, so the only tell is a disagreement between the file and the previous iteration's own record — and the natural reading ("trust the state file") is the wrong one. **Migration is one line and costs nothing**: on first read, if the namespaced file is absent but `~/.ailang/state/mission-designer-rotation` exists, seed from it, then write the namespaced path from then on and never write the unnamespaced one again. Generalises: **any `~/.ailang/state/` key this skill names as a literal is shared by all missions** — audit the whole path list before adding another, rather than one key at a time. Every design passes the quorum regardless of author — record `(designer, quorum outcome)` in the evidence row. A probe-failed designer falls to the NEXT in rotation (not to `$MODEL`), FLAGGED |
 | Sprint-planner | `$MISSION_PLANNER_MODEL` | `codex:gpt-5.6-sol` configured default; effective lane = `derive-planner-lane.sh` output, used VERBATIM; fail-closed to opus |
 | Sprint-executor | `$MISSION_EXECUTOR_MODEL` | Opus |
 | Sprint-evaluator | `$MISSION_EVALUATOR_MODEL` | **Sonnet** (default changed fable→sonnet 2026-07-16 iter 38, Mark directive #399: "default … gemini (if able to git clone the codebase etc)? otherwise sonnet-5"; gemini-managed_agents VERIFIED not-viable-today — server-side sandbox sees no worktree + backend timed out; sonnet ≠ opus executor → generator≠judge, and it's Agent-tool-PINNABLE unlike fable) |
@@ -1645,7 +1645,7 @@ backstop until a Go orchestrator hard-pins it). Deterministic mechanical work (d
 Sonnet, inline, is fine.
 
 - No design doc yet → **design-doc-creator** on the ROTATION designer (see the roles table: next
-  entry after `~/.ailang/state/mission-designer-rotation`; claude via `claude-sub`, codex via the
+  entry after `~/.ailang/state/mission-${MISSION_NAME}-designer-rotation` — NAMESPACED, see the roles table; claude via `claude-sub`, codex via the
   executor recipe carrying the design-doc-creator directive) — spawned pinned/bounded, never inline
   (its hard gates apply: live `ailang check` verification, Conflict Surface for
   parser/types/codegen). **But first