quest: land through GitHub's merge queue with an async fixer watcher

quest/m0/README.md

@@ -43,6 +43,21 @@ Decided 2026-10-30 (user, /quest-plan), replacing "First public release":
 
   The land work is what moq-dev's repositories use every day, and the
   maintainer ranked it first in the 2026-10-30 and 2026-11-01 sessions.
+- How do moq-dev's repositories land? Decided 2026-11-01 (maintainer,
+  /quest-plan), reversing the 2026-10-26 move to a batched gate:
+  - ✅ Through GitHub's merge queue again, one PR at a time, with no batching
+    and no pre-checks. A host watcher runs the Codex land fixer on each PR the
+    queue drops and re-enqueues it, so only decisions reach a person. The
+    batched gate was left for GitHub's inability to resolve quest-file
+    conflicts (71% of moq's 246 removals); the async fixer now absorbs those.
+  - Keep the host queue, serial
+
+  The [queue watcher](/quest/m0/queue-watcher/README.md) ranks first and
+  records the full interview: moq first, self-hosted `merge_group` runners,
+  host-gate work frozen, build concurrency 1, re-enqueue at the back,
+  unlimited attempts while progressing, flaky re-enqueues, and fixing picks
+  GitHub refuses. The land work above now means the watcher first, then the
+  fixer and its host.
 
 Decided while planning m0 (2026-09-26), replacing the earlier copied-files and
 ownership-manifest design:
@@ -67,13 +82,11 @@ ownership-manifest design:
 
 ## Required
 
-- [Merge through a host gate](/quest/m0/host-land/README.md) - inline merge picks, small batches landed from the maintainer's host, and a Codex fixer instead of bisection
-- [The land fixer handles every mechanical failure](/quest/m0/land-fixer/README.md) - attempts, registry network, triage, flaky tests, local mergeability, protected edits, and fork commits
+- [Land through the merge queue with an async fixer](/quest/m0/queue-watcher/README.md) - GitHub's merge queue lands one PR at a time, and a host watcher fixes and re-enqueues each PR it drops
+- [Merge through a host gate](/quest/m0/host-land/README.md) - the host's fixer containers, and the frozen batched gate for the repositories not yet switched
+- [The land fixer resolves every mechanical failure](/quest/m0/land-fixer/README.md) - lockfile merges, protected edits as ready commits, workflow pushes, and the PR's own CI as context
 - [Landing priority](/quest/m0/land-priority.md) - cheap checks wait a bounded time and the land daemon's check runs ahead of agent builds
 - [Drop emptied Required headings](/quest/m0/required-heading.md) - a clean driver merge that empties a `Required` list passes `quest check`
-- [Current conflict reports](/quest/m0/land-conflicts-refresh.md) - a queued PR's conflict report updates when the queue ahead of it changes
-- [Land checks at gate priority](/quest/m0/land-priority-sandbox.md) - `quest land serve` passes `QUEST_GATE_PRIORITY` to its sandbox
-- [Squash mismatch comment](/quest/m0/land-squash-mismatch.md) - a post-squash `tree_mismatch` posts a CRITICAL comment on the merged PR
 - [Current landing status](/quest/m0/status-landing.md) - `quest status` drops a stale `landing-stopped` line and ignores superseded cancelled checks
 - [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners
 - [Codex cloud off](/quest/m0/codex-cloud-off.md) - automatic Codex cloud reviews stop once no open PR relies on them

quest/m0/helpers/README.md

@@ -72,4 +72,3 @@ commands from Sep-Oct. Session counts in each child come from that window.
 
 - [quest merge --land gaps](/quest/m0/helpers/merge-land.md) - squash on squash-only repositories, PR URLs outside a checkout, labels released after direct merges, and a warning when auto-merge outlives its head
 - [Headless agents](/quest/m0/helpers/headless-agents.md) - `/quest-spawn api` launches, resumes, and stops billed agents through one command auto mode allows
-- [moq-dev/quest lands through quest land](/quest/m0/helpers/land-adopt.md) - this repository's `main` changes only through its own gate

quest/m0/host-land/README.md

@@ -1,22 +1,20 @@
-# Merge through a host gate
+# Merge through a host gate until the merge queue replaces it
 
 ## Goal
 
-Picking a PR to merge starts no long-lived agent. `/quest-merge` queues it
-inline only when a counted review names its head, or the head is trivial;
-otherwise `/quest-iterate` runs first. A gate on the maintainer's host lands
-small batches: a base PR plus up to floor(log₂ n) others that merge cleanly,
-checked once on the chain's tip and pushed as one squash commit per PR. A
-conflict on the base PR or a failing batch hands the PRs to an asynchronous
-Codex fixer, which makes only mechanical fixes and requeues the healthy PRs.
-Bisection goes away. Since 2026-11-01 those PRs stay queued and parked while
-the fixer works, and only a handback takes one out of the queue; see the
-[land fixer epic](/quest/m0/land-fixer/README.md).
+The maintainer's host runs the land fixer in ephemeral nspawn containers for
+the [queue watcher](/quest/m0/queue-watcher/README.md), and keeps landing the
+repositories not yet on GitHub's merge queue (moq-dev/quest, moq.pro, rust2
+and rind) through the host gate until they
+[follow](/quest/m0/queue-watcher/follow.md). The gate is frozen: it gets only
+fixes the switch needs, and is
+[retired](/quest/m0/queue-watcher/retire.md) once nothing lands through it.
 
-Non-goals: other repositories adopting the gate (moq-dev/moq, moq-dev/moq.pro
-plan their own; moq.pro needs only `allow_auto_merge` and the ruleset, since
-moq-dev is on GitHub Team), and changing the review policy beyond the
-mechanical-fix exemption.
+`/quest-merge` queues a pick inline only when a counted review names its head,
+or the head is trivial; otherwise `/quest-iterate` runs first. That part of
+the 2026-10-30 design stands.
+
+Non-goals: changing the review policy beyond the mechanical-fix exemption.
 
 ## Plan
 
@@ -95,9 +93,20 @@ can hand off instead.
   ([moq-dev/quest#355](https://github.com/moq-dev/quest/pull/355)) went further: nothing is ejected for a failure, and the
   blamed PR is parked for the fixer.
 
+- Superseded 2026-11-01 (maintainer, /quest-plan; see the
+  [queue watcher](/quest/m0/queue-watcher/README.md)): each repository lands
+  through GitHub's merge queue again, one PR at a time, and a host watcher
+  runs this epic's fixer on each PR the queue drops and re-enqueues it.
+  moq-dev/moq moves first. The batched gate described above keeps serving the
+  other repositories until they follow, with its work frozen except for fixes
+  the switch needs. Its end-to-end batch run and its docs are dropped; the
+  watcher epic has its own. Deleted with it: keeping an in-flight batch check
+  across daemon restarts, current queue-conflict reports, the post-squash
+  mismatch comment, and gate priority for batch checks, all host-gate
+  improvements the freeze stops.
+
 ## Required
 
 - [Gate host](/quest/m0/host-land/host.md) - kixelated/nixos runs the daemon as its own user, checks in nspawn containers, and retires the Actions runner
 - [Fixer proxy access](/quest/m0/host-land/fixer.md) - connect the nixos fixer container to CLIProxyAPI with the gate client key and maintainer login
 - [Fixer TLS](/quest/m0/host-land/fixer-tls.md) - the fixer's container trusts public certificates, so workerd and the Worker tests run there
-- [Daemon restart keeps its check](/quest/m0/host-land/reattach.md) - a deploy no longer reruns the batch it interrupted

quest/m0/host-land/fixer.md

@@ -4,7 +4,8 @@
 
 The nixos fixer container reaches CLIProxyAPI with the gate's client key, while
 Codex login and Git/GitHub credentials stay outside the container. Verify a real
-mechanical fix and unchanged requeue through the host daemon.
+mechanical fix and unchanged requeue through the
+[queue watcher](/quest/m0/queue-watcher/README.md) or the host daemon.
 
 ## Plan
 
@@ -23,7 +24,8 @@ back for them.
 - ✅ Keep as decided
 
 The quest CLI implements `quest land fix`, durable collection, validation,
-lease-pushes, Review records, and one attempt per maintainer pick. Host work
+lease-pushes, Review records, and one attempt per maintainer pick (the
+watcher's [stop rules](/quest/m0/queue-watcher/stop.md) replace that limit). Host work
 remains in kixelated/nixos: the ephemeral fixer container (`qland-fix`) reaches
 CLIProxyAPI and, like the check containers, the public internet without private
 ranges (`modules/ci-egress.nix`), so its builds fetch dependencies;

quest/m0/host-land/host.md

@@ -106,8 +106,11 @@ What remains:
   quest-land-fixer.socket canceled" when several `*-socket-refresh`
   services restart at once (user, 2026-10-31). Find the race and fix it,
   without retrying the test.
-- Once [moq-dev/quest#324](https://github.com/moq-dev/quest/pull/324) lands
-  (user, 2026-10-31): export `QUEST_GATE_PRIORITY=1` in the generated
-  `quest-land-check-command`, then bump the pinned quest, so a land check's
-  nested `quest gate` waits for memory but not load. Don't use
-  `QUEST_GATE_ADMITTED`, which also skips the memory check.
+
+Amended 2026-11-01 (maintainer, /quest-plan; see the
+[queue watcher](/quest/m0/queue-watcher/README.md)): host-gate work is frozen
+except fixes the switch needs. The `QUEST_GATE_PRIORITY=1` export in the
+generated check command (planned 2026-10-31) is dropped with it. The items
+above stay, since the fixer container and its launcher serve the watcher too,
+and the gate keeps serving the repositories not yet switched. The watcher's
+own unit is [Watcher on the host](/quest/m0/queue-watcher/host.md).