quest: plan quest land's update-rule refusal and fork adoption

quest/m0/helpers/README.md

@@ -59,6 +59,10 @@ commands from Sep-Oct. Session counts in each child come from that window.
   merge gate, `quest land`, joins this epic. It ranks after the existing
   children, and kixelated/quest adopts it first. moq-dev/moq, moq-dev/moq.pro,
   and kixelated/rust2 plan their own adoption.
+- Decided 2026-10-27 (user), from the follow-ups of
+  [kixelated/quest#229](https://github.com/kixelated/quest/pull/229): the
+  gate's rule and setup fixes rank after its adoption, which verifies forks
+  live.
 
 ## Required
 
@@ -69,6 +73,7 @@ commands from Sep-Oct. Session counts in each child come from that window.
 - [Headless agents](/quest/m0/helpers/headless-agents.md) - `/quest-spawn api` launches, resumes, and stops billed agents through one command auto mode allows
 - [Sibling PRs through a server-side merge](/quest/m0/helpers/queue-siblings.md) - children of one epic land back to back through a merge queue without conflicting on its link list
 - [kixelated/quest lands through quest land](/quest/m0/helpers/land-adopt.md) - this repository's `main` changes only through its own gate
+- [quest land upholds only the rules GitHub lets it](/quest/m0/helpers/land-rules.md) - `resolve` refuses `update` rules, and the README names only credentials and check sources GitHub accepts
 
 ## Related
 

quest/m0/helpers/land-adopt.md

@@ -1,23 +1,40 @@
-# [S] kixelated/quest lands through quest land
+# [M] kixelated/quest lands through quest land
 
 ## Goal
 
 PRs to kixelated/quest's `main` land only through
 `quest land`, on a hosted runner, running
 `just check` and `just test` once per batch. GitHub's merge button cannot
-land around it.
+land around it. A PR from a fork lands through it too.
 
 ## Plan
 
 Decided 2026-10-26 (user): the repository adopts its own gate first. Being
 user-owned, it cannot use GitHub's merge queue
 ([landing](/quest/m0/helpers/landing.md)).
 
-- The push credential is GitHub Actions in the `main` ruleset's bypass list,
-  guarded by a test that refuses `contents: write` anywhere but the land job,
-  as moq.pro's `queue.test.ts` does. The admin role keeps its emergency
-  bypass. Ruleset writes are the user's.
-- The ruleset requires the `quest land` check, which PR heads never carry, so
-  auto-merge only waits for the gate.
+- **Push credential (user, 2026-10-27).** A GitHub App owned by the kixelated
+  account, installed only on this repository, is the `main` ruleset's bypass
+  actor. Only the land job mints its token, from a key in an environment only
+  `main` can use, as moq-dev/quest-land-scratch verified with moq-bot.
+  GitHub Actions cannot be the bypass: a disabled probe ruleset on this
+  repository was refused on 2026-10-27 with "must be part of the ruleset
+  source or owner organization". The user creates the App and stores its
+  key.
+- A test refuses `contents: write` anywhere but the land job, as moq.pro's
+  `queue.test.ts` does. The land job keeps it on `GH_TOKEN`, which ejecting a
+  PR needs. The admin role keeps its emergency bypass. Ruleset writes are the
+  user's.
+- The ruleset requires the `quest land` check, pinned to an app installed on
+  this repository that never reports it, so auto-merge only waits for the
+  gate. It replaces the classic protection that requires `check`.
+- **Forks (user, 2026-10-27).** The fork path was never verified live, since
+  moq-dev forbids private forks. This quest is done only once a fork PR that
+  allows maintainer edits lands through the gate and shows as merged; any fix
+  that needs lands here.
 - Update `CONTRIBUTING.md`'s landing section; the user asked for it through
   this plan.
+
+## Related
+
+- [quest land upholds only the rules GitHub lets it](/quest/m0/helpers/land-rules.md) - the README setup guidance this follows

quest/m0/helpers/land-rules.md

@@ -0,0 +1,37 @@
+# [XS] quest land upholds only the rules GitHub lets it
+
+## Goal
+
+`quest land resolve` fails on a base whose ruleset has an `update` rule, and
+the README's gate setup names only credentials and check sources GitHub
+accepts, so an adopter's first ruleset write succeeds.
+
+## Plan
+
+Decided 2026-10-27 (user), from the follow-ups of
+[kixelated/quest#229](https://github.com/kixelated/quest/pull/229):
+
+- **Refuse `update` (user).** An `update` rule lets only its bypass actors
+  move the base, but the gate's bypass lands any PR someone with write access
+  queues, so treating the rule as upheld widens who can update. Drop `update`
+  from `UPHELD` in `src/cli/land.ts`, so `resolve` names it among the rules it
+  does not uphold, and fix the README sentence that lists what the push
+  satisfies. Rejected: landing only PRs whose auto-merge a bypass actor
+  enabled (it needs bypass, role, and team reads with admin access), and
+  accepting `update` when the gate is the only bypass actor (it rules out an
+  admin emergency bypass). No planned adopter uses the rule. Test that
+  `resolve` refuses it.
+- **Installed check app (user).** A ruleset's `required_status_checks` can pin
+  only an app installed on the repository; GitHub rejects others with
+  "Invalid integration ids". Say so where the README tells adopters to pin the
+  `quest land` check's source.
+- **No GitHub Actions bypass.** A repository ruleset refused GitHub Actions
+  (`Integration` 15368) as a bypass actor on an organization repository
+  (moq-dev/quest-land-scratch, 2026-10-26) and a personal one
+  (kixelated/quest, 2026-10-27), both with "must be part of the ruleset source
+  or owner organization". The README's credential paragraph stops offering it
+  and names an App installed on the repository as the push bypass.
+
+## Related
+
+- [kixelated/quest lands through quest land](/quest/m0/helpers/land-adopt.md) - the first adopter, which follows this guidance