docs(quest): plan decision inbox follow-ups

quest/m0/kix/README.md

@@ -95,6 +95,9 @@ operator-paid-hosting decisions:
 - [Job sandbox](/quest/m0/kix/sandbox.md) - OS-sandboxed commands, with untrusted PR devShells built in a VM on Linux runners
 - [opencode adapter](/quest/m0/kix/opencode.md) - OpenCode Go, ChatGPT plans, and API-key providers through opencode
 - [Decision inbox](/quest/m0/kix/prompts.md) - a simple prompt UI with new-issue and new-PR notifications
+- [Webhook reconcile](/quest/m0/kix/reconcile.md) - new issues and PRs arrive in the inbox ready to act on, without a manual refresh
+- [Inbox merge](/quest/m0/kix/merge.md) - PR items merge the reviewed head through GitHub's rules
+- [Co-maintainer inbox](/quest/m0/kix/members.md) - every current maintainer sees enrolled projects in their inbox
 - [Output retention](/quest/m0/kix/output.md) - raw agent output in R2, kept 30 days and capped at 64 MiB per attempt
 - [Agent activity](/quest/m0/kix/activity.md) - agent cards and map highlights built from checkpoint summaries
 - [Mobile web app](/quest/m0/kix/mobile.md) - an installable PWA with Web Push for decisions

quest/m0/kix/members.md

@@ -0,0 +1,29 @@
+# [S] Show co-maintainers' projects in their inbox
+
+## Goal
+
+Every current maintainer of an enrolled project sees it in their decision
+inbox, not only the user who enrolled it. A maintainer whose access is revoked
+stops seeing it.
+
+## Plan
+
+Decided 2026-10-18 as a follow-up of the decision inbox (#144), which lists
+only projects the viewer enrolled (`enrolledBy`):
+
+- A maintainer joins a project's inbox membership when they pass the
+  per-request maintainer check on its project page. No extra GitHub calls to
+  list maintainers.
+- Membership only decides which projects the inbox lists. It is not
+  authority: every action still rechecks the maintainer per request.
+- A maintainer check that GitHub answers with a denial drops that user's
+  membership along with their read and skip state for the project. A check
+  that cannot complete (an outage or rate limit) fails the request and leaves
+  membership as it is. The enrolling user is a member like any other.
+- Disconnecting a project removes its memberships with it.
+- Test a co-maintainer joining, a revoked maintainer dropping out, a
+  rate-limited check keeping membership, and a non-maintainer never joining.
+
+## Required
+
+- [Decision inbox](/quest/m0/kix/prompts.md) - the inbox and its read state

quest/m0/kix/merge.md

@@ -0,0 +1,32 @@
+# [S] Merge PRs from the decision inbox
+
+## Goal
+
+A PR item in the decision inbox offers a merge button when the maintainer may
+merge it. Clicking it merges exactly the head they reviewed through GitHub,
+using a method the repository allows, or shows GitHub's refusal plainly.
+
+## Plan
+
+Decided 2026-10-18 as a follow-up of the decision inbox (#144), whose PR items
+offer only "Review on GitHub":
+
+- Build on the bot publication's merge: bound to the current head, with the
+  method picked from the repository's allowed methods (squash, then merge
+  commit, then rebase). Keep that logic in publication and only add the
+  inbox action here.
+- Show the button only when it can work: the PR is open, the viewer passes
+  the per-request maintainer check, and GitHub reports it mergeable. Otherwise
+  keep "Review on GitHub".
+- Bind the form to the head SHA the maintainer saw. A moved head, failing
+  checks, missing reviews, or branch rules refuse the merge and say why; never
+  retry or bypass them.
+- An agent recommendation is never approval: the merge happens only on the
+  maintainer's click.
+- Test a moved head, a refused merge, a squash-only repository, and a
+  non-maintainer.
+
+## Required
+
+- [Bot publication](/quest/m0/kix/publication.md) - the head-bound merge and method selection
+- [Decision inbox](/quest/m0/kix/prompts.md) - the PR items that show the button

quest/m0/kix/mobile.md

@@ -33,6 +33,9 @@ Decided 2026-10-15 in the decisions-not-implementations interview:
   encryption and VAPID signing work in the Workers runtime with WebCrypto
   before choosing a library. Keep payloads minimal (project and decision
   title), since the full context loads in the app.
+- Show an unread decision count in the nav and, where the Badging API is
+  supported, on the installed app icon. Decided 2026-10-18 as a follow-up of
+  the decision inbox (#144), folded here rather than its own quest.
 - Make the installed app phone-first: the inbox, prompts, and activity cards
   fit a narrow viewport and work with touch and keyboard.
 - Sources:

quest/m0/kix/reconcile.md

@@ -0,0 +1,33 @@
+# [S] Reconcile projects after each webhook
+
+## Goal
+
+A new GitHub issue, PR, or quest change arrives in the decision inbox with its
+title and context, ready to act on, without anyone clicking "Refresh from
+GitHub". The manual refresh stays as a fallback. Webhooks still never approve
+or launch work.
+
+## Plan
+
+Decided 2026-10-18 as a follow-up of the decision inbox (#144), which shows a
+webhook's item as a bare pointer ("Issue #N") and offers only a refresh until
+someone reads the project from GitHub:
+
+- After a webhook records an observation, reconcile that project in the
+  background with the App's installation token. Coalesce bursts so repeated
+  or duplicate deliveries for one project trigger one read, not one each.
+- Background reads publish observations only. Authority stays per request:
+  every action still rechecks the acting maintainer, as decided for the
+  inbox, so a background read never grants or caches authority.
+- A failed or rate-limited reconcile leaves the item as it is today, with
+  the refresh fallback and its reason shown, and a later webhook or refresh
+  retries. No retry loops.
+- The per-load GitHub call count (about five per project) stays as is until
+  it becomes a measured problem; caching authority checks would weaken the
+  per-request recheck.
+- Test with duplicate deliveries, a burst of deliveries, a failed read, and a
+  webhook for a paused or disconnected project.
+
+## Required
+
+- [Decision inbox](/quest/m0/kix/prompts.md) - the webhook items this fills in

quest/m0/kix/runner.md

@@ -71,6 +71,10 @@ replacing the hosted Agent SDK runtime:
   away. Each account's opaque ID must stay stable across restarts so its
   preference rank and paused sessions follow it. A CLI sign-in flow and a
   control to reorder account preference remain here.
+- Add a runner and account settings page as a secondary view off the
+  decision inbox: each runner's online state, its accounts, and the
+  preference-order control. Decided 2026-10-18 as a follow-up of the
+  decision inbox (#144), folded here rather than its own quest.
 
 ## Required