diff --git a/quest/README.md b/quest/README.md
index 444bf2e0..05a03a75 100644
--- a/quest/README.md
+++ b/quest/README.md
@@ -7,11 +7,12 @@ versioned Markdown, with a standalone CLI and a reversible adoption path.
 
 ## Plan
 
-`m0` is the first public release; `m1` holds later work. Add `m2` and later
-horizons when concrete work warrants them, keeping milestone numbers stable as
-earlier milestones complete.
+`m0` is adoption on moq-dev's own repositories, `m1` the public release,
+and `m2` later work. Add later horizons when concrete work warrants them,
+keeping milestone numbers stable as earlier milestones complete.
 
 ## Required
 
-- [M0: First public release](/quest/m0/README.md) - install, set up, work, and leave, driven from one pinned binary, paired with the Kix decision UI and your own runners
-- [M1: Later work](/quest/m1/README.md) - cloud runners, a native mobile app, shared runners, and donated reviews and CI
+- [M0: moq-dev adoption](/quest/m0/README.md) - kix at quest.moq.dev, used daily on moq-dev/moq, moq-dev/quest, and moq-dev/moq.pro, beside the standalone CLI
+- [M1: Public release](/quest/m1/README.md) - kix.quest open to any maintainer, with onboarding, contributor sandboxing, the themed site, and launch material
+- [M2: Later work](/quest/m2/README.md) - cloud runners, a native mobile app, shared runners, and donated reviews and CI
diff --git a/quest/m0/README.md b/quest/m0/README.md
index f324ae5d..a523d4c2 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -1,23 +1,49 @@
-# First public release
+# moq-dev adoption
 
 ## Goal
 
-Ship Quest v0.1.0. A developer using Claude Code or Codex with GitHub pastes one
-line into their agent to set Quest up in any repository, plans and runs agent
-work through quests, and can remove it without losing their own content.
-It runs on macOS, Linux, and native Windows.
+moq-dev plans and runs its own work through Quest and kix:
+moq-dev/moq, moq-dev/quest, and moq-dev/moq.pro are enrolled at
+`https://quest.moq.dev`, maintainers answer decisions from a phone-friendly
+web app with push notifications, and their own Linux and macOS runners do
+the work through Claude Code and opencode inside each project's Nix
+devShell. The GitHub App bot publishes ordinary PRs. The standalone CLI
+(v0.1.0 shipped on 2026-10-07) keeps serving the same repositories locally on
+macOS, Linux, and native Windows.
 
-The hosted launch is kix.quest, a cloud for creating software: maintainers
-answer interactive prompts, from a phone-friendly web app with push
-notifications, to plan issues, start ready quests, and act on new PRs. Their
-own Linux and macOS runners do the work through Claude Code and opencode,
-with any number of signed-in accounts, inside each project's Nix devShell.
-The GitHub App bot publishes ordinary PRs. The contest no longer gates launch.
-The standalone v0.1.0 CLI shipped on 2026-10-07; remaining work expands the
-product without changing the core's independence.
+Work that only third-party repositories need, and the public launch, belong
+to [m1](/quest/m1/README.md).
 
 ## Plan
 
+Decided 2026-10-30 (user, /quest-plan), replacing "First public release":
+
+- Should m0 serve moq-dev's repositories before third parties?
+  - ✅ Yes: m0 is adoption on moq-dev/moq, moq-dev/quest, and moq-dev/moq.pro;
+    a new m1 holds the public release, and the old m1 became m2
+  - Fold third-party work into the existing later milestone
+
+  No resources go into a public service before it works for moq-dev.
+- Where does the Worker live until the public launch?
+  - ✅ quest.moq.dev
+  - kix.moq.dev
+
+  [Open kix.quest](/quest/m1/open.md) moves it for the launch.
+- Which kix work leaves m0? ✅ Onboarding (pick repositories, setup PR,
+  guide), ✅ the public face (theme, landing page, launch material), ✅
+  contributor sandboxing (untrusted-head VM, stock-Ubuntu AppArmor, macOS
+  verification), and ✅ the enrollment-time read-only CI check. Head approval
+  and opencode sandboxing stay, since moq-dev's own jobs need them.
+- moq-dev/moq comes first, then private repositories so moq.pro can enroll.
+- Where does Kix rank in m0? Decided 2026-11-01 (user, /quest-complete):
+  - ✅ Land work first (the host gate, the land fixer and the land quests),
+    then Kix, then the rest of m0
+  - Kix first
+  - Kix below the review quests
+
+  The land work is what moq-dev's repositories use every day, and the
+  maintainer ranked it first in the 2026-10-30 and 2026-11-01 sessions.
+
 Decided while planning m0 (2026-09-26), replacing the earlier copied-files and
 ownership-manifest design:
 
@@ -46,10 +72,10 @@ ownership-manifest design:
 - [GitHub retries](/quest/m0/github-retry.md) - one 5xx or dropped connection no longer fails a command or land step
 - [Current conflict reports](/quest/m0/land-conflicts-refresh.md) - a queued PR's conflict report updates when the queue ahead of it changes
 - [Land checks at gate priority](/quest/m0/land-priority-sandbox.md) - `quest land serve` passes `QUEST_GATE_PRIORITY` to its sandbox
+- [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners
 - [Codex cloud off](/quest/m0/codex-cloud-off.md) - automatic Codex cloud reviews stop once no open PR relies on them
 - [Review handles expired and environment logins](/quest/m0/review-login.md) - `quest review` says to log in again instead of failing with a 401, and reviews with credentials from the environment
 - [Live sandbox test](/quest/m0/review-sandbox.md) - the real reviewer CLIs run nothing a reviewed head plants
-- [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners
 - [Agent test environment](/quest/m0/agent-test-env.md) - `just test` passes inside agent sessions
 - [Stale skill stubs](/quest/m0/init-prune.md) - `quest init` and `quest uninstall` remove stubs of retired skills such as `quest-ready`
 - [Bun EFAULT report](/quest/m0/bun-efault.md) - condition: Bun fixes concurrent `rmSync` on Windows; report it, then drop the workaround
@@ -58,6 +84,4 @@ ownership-manifest design:
 - [Gate admission on CI](/quest/m0/gate-ci-admission.md) - gated commands admit on loaded hosted runners like arm64 macOS
 - [Agent lifecycle integration](/quest/m0/worktree-agents.md) - reclaim completed and suspended Claude checkouts through its hooks
 - [Agent workflow helpers](/quest/m0/helpers/README.md) - CLI commands for CI waits, PR status, claims, quest moves, and serialized merges
-- [Quest log theme](/quest/m0/theme/README.md) - an MMO-style identity, copy, board, landing page, and CLI output for the demo and launch
-- [Launch material](/quest/m0/launch.md) - README, quickstart, demo, comparison, and launch-post drafts
 - [Review harness check](/quest/m0/review-harness.md) - recurring each milestone: newest pinned review models, and the live sandbox test passes
diff --git a/quest/m0/kix/README.md b/quest/m0/kix/README.md
index d826c845..9ac62898 100644
--- a/quest/m0/kix/README.md
+++ b/quest/m0/kix/README.md
@@ -2,7 +2,8 @@
 
 ## Goal
 
-kix.quest is a cloud for creating software. Maintainers make decisions in a
+kix is a cloud for creating software, served at `https://quest.moq.dev`
+for moq-dev's repositories in m0. Maintainers make decisions in a
 phone-friendly web app with push notifications, while kix routes the work to
 any runner they own, using whatever agent accounts they connect. CLIs and
 providers stay hidden behind summaries and prompts.
@@ -27,6 +28,12 @@ live rehearsal on the operator's runner.
 
 ## Plan
 
+Decided 2026-10-30 (user, /quest-plan): m0 serves moq-dev/moq, then
+moq-dev/quest, then the private moq-dev/moq.pro, at quest.moq.dev with only
+moq-dev allowed to enroll. Onboarding, read-only CI checks, contributor
+sandboxing, and the guide moved to [m1](/quest/m1/kix/README.md), and
+kix.quest opens in [m1](/quest/m1/open.md).
+
 Decided on 2026-10-15 through the decisions-not-implementations interview,
 superseding the 2026-10-13 hosted-first, Claude-SDK-only, and
 operator-paid-hosting decisions:
@@ -36,12 +43,12 @@ operator-paid-hosting decisions:
   the whole default UI. Raw agent output is collapsed behind a per-job
   disclosure that only current maintainers can expand.
 - **Phone first.** m0 ships an installable PWA with Web Push for decision
-  items. A [native mobile app](/quest/m1/mobile-app.md) follows in m1.
+  items. A [native mobile app](/quest/m2/mobile-app.md) follows in m2.
 - **Your own runners first.** `quest runner` turns any Linux or macOS machine
   into a runner. It claims jobs over HTTPS and drives the official CLIs with
   that machine's own logins, so kix never holds provider tokens. There are no
-  Windows runners. Free, capped [cloud runners](/quest/m1/cloud/README.md)
-  and API-key or donor funding follow in m1, with paid compute later.
+  Windows runners. Free, capped [cloud runners](/quest/m2/cloud/README.md)
+  and API-key or donor funding follow in m2, with paid compute later.
 - **Abstract the CLIs.** A runner adapter interface hides each CLI: start or
   resume, structured questions, checkpoint summaries, and results. Claude
   Code covers Claude subscriptions; opencode covers OpenCode Go, ChatGPT
@@ -56,7 +63,7 @@ operator-paid-hosting decisions:
   shell, with no other way to install dependencies, for cache efficiency and
   reproducibility. The runner pins the agent CLIs through Nix as well.
   Runners keep a persistent local store and honor the flake's substituters;
-  a [shared cache](/quest/m1/automation/cache.md) follows in m1.
+  a [shared cache](/quest/m2/automation/cache.md) follows in m2.
 - **Sandboxed jobs.** Every job's commands run in an OS sandbox. PR heads
   with non-maintainer commits route to Linux runners, which build the PR's
   devShell in a VM first; macOS runners take trusted revisions only. Cloud
@@ -126,14 +133,12 @@ fixes what it finds:
 
 ## Required
 
-- [Deploy kix.quest](/quest/m0/kix/deploy.md) - the operator registers the App and deploys the Worker with GitHub sign-in at kix.quest
+- [Deploy quest.moq.dev](/quest/m0/kix/deploy.md) - the operator registers the App and deploys the Worker with GitHub sign-in at quest.moq.dev
 - [Upstream branches](/quest/m0/kix/upstream-branches.md) - jobs publish on the enrolled repository itself, with no service forks
-- [Read-only CI](/quest/m0/kix/ci-read-only.md) - enrolled repositories keep pull-request CI read-only, checked at enrollment, with every trust boundary written down
-- [Operator setup](/quest/m0/kix/operator-setup.md) - pilot installations and a verified test PR on moq-dev/quest and moq-dev/moq
-- [Pick repositories](/quest/m0/kix/pick-repos.md) - after installing, the maintainer enables repositories from a list
-- [Setup PR](/quest/m0/kix/setup-pr.md) - enrolling a repository without Quest makes the App open its `quest init` pull request
-- [Job sandbox](/quest/m0/kix/sandbox/README.md) - untrusted PR devShells built in a VM on Linux runners, maintainer PR heads trusted, opencode sandboxed, and macOS verified
+- [Owner allowlist](/quest/m0/kix/owners.md) - only moq-dev may enroll until the public release
+- [Operator setup](/quest/m0/kix/operator-setup.md) - pilot installations and a verified test PR on moq-dev/moq and moq-dev/quest
+- [Private repositories](/quest/m0/kix/private.md) - moq-dev/moq.pro enrolls, visible only to signed-in users who can read it
+- [Job sandbox](/quest/m0/kix/sandbox/README.md) - head approval for kix-pushed heads, and opencode sandboxed
 - [Web execution](/quest/m0/kix/execution.md) - spawn and iterate through the UI, ending in contribution PRs
 - [Land review](/quest/m0/kix/land-review.md) - kix lands only heads with a review that counts on that exact head
-- [Onboarding guide](/quest/m0/kix/guide.md) - a complete maintainer path, from runner setup through a reviewed PR
 - [Fast runner continuation test](/quest/m0/kix/runner-timeout.md) - the conflicted-continuation test passes on a loaded host without a longer timeout
diff --git a/quest/m0/kix/deploy.md b/quest/m0/kix/deploy.md
index c2a87d76..c2df7a84 100644
--- a/quest/m0/kix/deploy.md
+++ b/quest/m0/kix/deploy.md
@@ -1,20 +1,29 @@
-# [S] Deploy the Worker to kix.quest
+# [S] Deploy the Worker to quest.moq.dev
 
 ## Goal
 
-An operator registers the GitHub App and deploys `main` to `https://kix.quest`
-with GitHub sign-in pointed at it. The condition clears when
-`https://kix.quest/health` returns `{"status":"ok"}`, `https://kix.quest/setup`
-redirects to `SETUP.md`, a browser sign-in and sign-out on kix.quest succeed,
-and the App's ping to `https://kix.quest/webhooks/github` shows a successful
-delivery. Follow the Deployment section of `cloudflare/README.md` and steps 1,
-2 and 4 of `cloudflare/GITHUB.md`; delete this quest once verified.
+The Worker's checked-in origin is `https://quest.moq.dev`, and an operator
+registers the GitHub App and deploys `main` there with GitHub sign-in pointed
+at it. The condition clears when `https://quest.moq.dev/health` returns
+`{"status":"ok"}`, `https://quest.moq.dev/setup` redirects to `SETUP.md`, a
+browser sign-in and sign-out succeed, and the App's ping to
+`https://quest.moq.dev/webhooks/github` shows a successful delivery. Follow
+the Deployment section of `cloudflare/README.md` and steps 1, 2 and 4 of
+`cloudflare/GITHUB.md`; delete this quest once verified.
 
 ## Plan
 
+- ✅ Decided 2026-10-30 (user, /quest-plan): host at quest.moq.dev, not
+  kix.quest, until [the public release](/quest/m1/open.md), so nothing public
+  is launched before it works for moq-dev. Change the origin in
+  `cloudflare/wrangler.jsonc` (route and `AUTH_URL`),
+  `cloudflare/worker-configuration.d.ts`,
+  `cloudflare/github-app-manifest.json`, `quest runner`'s `DEFAULT_URL`
+  (`src/runner/cli.ts`) and its examples, and the docs that name kix.quest as
+  the live origin. The product keeps the kix name.
 - ✅ Decided 2026-10-14: deprecate kixel.quest without redirects or legacy
-  auth handling, because nobody uses it. kix.quest is the only site and
-  authentication origin. Remove the Worker's kixel.quest custom domain when
+  auth handling, because nobody uses it. quest.moq.dev is the only site and
+  authentication origin (amended 2026-10-30, was kix.quest). Remove the Worker's kixel.quest custom domain when
   deploying; the checked-in config no longer lists it.
 - Merging to `main` does not deploy: no workflow runs Wrangler, and
   deployment is a manual `bun run deploy` from `cloudflare/`.
@@ -31,11 +40,13 @@ delivery. Follow the Deployment section of `cloudflare/README.md` and steps 1,
   adds to the README's Deployment section, and confirm the rule with
   `bun run wrangler r2 bucket lifecycle list quest-output`. Until then,
   `main` has no R2 binding and needs no bucket. Decided 2026-10-18.
-- Add the `kix.quest` zone to the Worker's Cloudflare account. Keep the
+- Serve the Worker on `quest.moq.dev` from the `moq.dev` zone, which
+  already hosts `token.moq.dev`; if that zone sits in another Cloudflare
+  account, say which in `cloudflare/README.md`. Keep the
   Worker name, D1 database ID, and `AUTH_SECRET`; do not create a new
   production database.
-- Set the production GitHub App's homepage to `https://kix.quest` and
-  its callback to `https://kix.quest/api/auth/callback/github`.
+- Set the production GitHub App's homepage to `https://quest.moq.dev` and
+  its callback to `https://quest.moq.dev/api/auth/callback/github`.
 - The deploy deletes the legacy `RepositoryCoordinator` Durable Object and
   any storage it held, approved 2026-10-14 since nothing is stored. Afterwards
   remove its `exports` tombstone from `cloudflare/wrangler.jsonc`.
diff --git a/quest/m0/kix/execution.md b/quest/m0/kix/execution.md
index 5808edb1..fdabdc3f 100644
--- a/quest/m0/kix/execution.md
+++ b/quest/m0/kix/execution.md
@@ -2,7 +2,7 @@
 
 ## Goal
 
-A maintainer starts ready work through kix.quest, follows it through agent
+A maintainer starts ready work through kix, follows it through agent
 summaries, answers its questions, and receives a normal contribution PR. New
 PR notifications present useful next actions, including explicitly
 requested iteration, in the same decision UI.
@@ -68,4 +68,4 @@ Earlier guidance:
 
 ## Required
 
-- [Job sandbox](/quest/m0/kix/sandbox/README.md) - safe iteration on PRs with contributors' commits
+- [Job sandbox](/quest/m0/kix/sandbox/README.md) - iterate and merge jobs on approved kix-pushed heads, with opencode sandboxed
diff --git a/quest/m0/kix/land-review.md b/quest/m0/kix/land-review.md
index 807bc641..ec76b1a0 100644
--- a/quest/m0/kix/land-review.md
+++ b/quest/m0/kix/land-review.md
@@ -46,4 +46,4 @@ Decided 2026-10-28 (user, /quest-plan of the follow-ups from
 ## Related
 
 - [Web execution](/quest/m0/kix/execution.md) - merge jobs this rule gates
-- [Require read-only pull-request CI](/quest/m0/kix/ci-read-only.md) - the trust model this completes
+- [Require read-only pull-request CI](/quest/m1/kix/ci-read-only.md) - the trust model this completes
diff --git a/quest/m0/kix/operator-setup.md b/quest/m0/kix/operator-setup.md
index 6deddc5f..67874f88 100644
--- a/quest/m0/kix/operator-setup.md
+++ b/quest/m0/kix/operator-setup.md
@@ -3,15 +3,17 @@
 ## Goal
 
 The operator installs the registered GitHub App on the pilot repositories,
-moq-dev/quest and moq-dev/moq, and enrolls them. A real issue event and a
+moq-dev/moq and moq-dev/quest, and enrolls them on quest.moq.dev. A real issue event and a
 bounded test PR verify the integration before contributors are invited.
 
 ## Plan
 
 - This is an operator/setup outcome. App registration and its secrets belong
-  to [Deploy kix.quest](/quest/m0/kix/deploy.md), because every deploy needs them.
+  to [Deploy quest.moq.dev](/quest/m0/kix/deploy.md), because every deploy needs them.
 - Pilot repositories decided 2026-10-27 (user): moq-dev/quest and
-  moq-dev/moq, ranked first so kix.quest is usable on moq-dev/moq soonest.
+  moq-dev/moq, ranked first so kix is usable on moq-dev/moq soonest.
+  Decided 2026-10-30 (user): start with moq-dev/moq; the private
+  moq-dev/moq.pro follows in [Private repositories](/quest/m0/kix/private.md).
   Service forks were dropped the same day for
   [upstream branches](/quest/m0/kix/upstream-branches.md), so there is no
   fork namespace to set up.
@@ -40,5 +42,6 @@ bounded test PR verify the integration before contributors are invited.
 
 ## Required
 
-- [Deploy kix.quest](/quest/m0/kix/deploy.md) - the live origin and registered App
+- [Deploy quest.moq.dev](/quest/m0/kix/deploy.md) - the live origin and registered App
+- [Owner allowlist](/quest/m0/kix/owners.md) - only moq-dev can enroll before contributors are invited
 - [Upstream branches](/quest/m0/kix/upstream-branches.md) - jobs publish on the pilot repositories themselves
diff --git a/quest/m0/kix/owners.md b/quest/m0/kix/owners.md
new file mode 100644
index 00000000..cf7c64f9
--- /dev/null
+++ b/quest/m0/kix/owners.md
@@ -0,0 +1,29 @@
+# [S] Allow only moq-dev to enroll
+
+## Goal
+
+Until the public release, only repositories whose owner is on an operator
+allowlist can be enrolled on quest.moq.dev. Anyone else who signs in or
+installs the App sees that kix isn't open yet, instead of an enrollment form,
+and no job, webhook, or board runs for their repositories. The deployed
+allowlist is `moq-dev`.
+
+## Plan
+
+Decided 2026-10-30 (user, /quest-plan): don't spend resources on a public
+service before it works for moq-dev's own repositories.
+
+- Who may enroll before the launch?
+  - ✅ Only moq-dev
+  - Anyone, with the host simply not advertised
+
+- A Worker variable such as `ENROLL_OWNERS` in `cloudflare/wrangler.jsonc`
+  holds a comma-separated list of GitHub owner IDs, with each owner's login
+  in a comment beside it. Enrollment checks the repository owner's ID
+  beside its existing checks; webhooks from other owners' installations are
+  acknowledged and dropped. The local dev seed's owners are listed in dev.
+- Store IDs, not logins resolved at read time: GitHub frees a deleted or
+  renamed account's login for anyone to claim, so a name lookup could
+  admit a different account.
+- [Open kix.quest](/quest/m1/open.md) removes the allowlist for the launch.
+- Test enrollment and a webhook for a listed and an unlisted owner.
diff --git a/quest/m0/kix/private.md b/quest/m0/kix/private.md
new file mode 100644
index 00000000..27bc1463
--- /dev/null
+++ b/quest/m0/kix/private.md
@@ -0,0 +1,49 @@
+# [M] Enroll private repositories
+
+## Goal
+
+A maintainer enrolls a private repository, starting with moq-dev/moq.pro,
+and kix works on it as on a public one. Every page, board, inbox item, push
+notification, raw output, and API response about it is shown only to a
+signed-in user whose GitHub access can read that repository, checked against
+GitHub when served. No repository needs an OSI license to enroll.
+
+## Plan
+
+Decided 2026-10-30 (user, /quest-plan), after moq-dev/moq is enrolled:
+
+- How should private repositories be allowed?
+  - Owners on an allowlist skip the public and license checks
+  - Drop the checks entirely
+  - Private only for allowlisted owners, public open to anyone
+  - ✅ (user's answer) Start with moq-dev/moq, then plan private
+    repositories like moq.pro, where viewers must be signed in with
+    permission to see the repository
+- What happens to the OSI-license check?
+  - Skip it only for private repositories
+  - ✅ Drop it everywhere
+
+- Remove `#public` (`cloudflare/src/github/service.ts`) and its callers'
+  "Select a public repository" refusals, the `osiApproved` check and
+  `cloudflare/src/licenses.ts` if nothing else uses it, and the license
+  rechecks on observation. Update the eligibility copy and `cloudflare/README.md`
+  and `cloudflare/GITHUB.md`.
+- Reads already recheck maintainer authority; extend that so any reader of a
+  private repository's views needs GitHub read access, and anonymous routes
+  such as the public boards (`/repos/...`) and the project board never show a
+  private repository. A repository that turns private after enrolling loses
+  its public views at the next observation.
+- Push notifications and raw output carry no private content to users who
+  lost access: recheck access before sending and on expanding output.
+- Check the App's requested permissions cover private repositories' contents,
+  issues, and pull requests; changing them is an operator step in
+  `cloudflare/GITHUB.md`.
+- Enroll moq-dev/moq.pro and run one start job through to its PR as the live
+  check.
+- Test a private repository viewed by a maintainer, a reader without
+  maintain rights, a signed-in stranger, and an anonymous visitor, and a
+  public repository that turns private.
+
+## Required
+
+- [Operator setup](/quest/m0/kix/operator-setup.md) - moq-dev/moq and moq-dev/quest work first
diff --git a/quest/m0/kix/sandbox/README.md b/quest/m0/kix/sandbox/README.md
index 03e0754a..db29c0d3 100644
--- a/quest/m0/kix/sandbox/README.md
+++ b/quest/m0/kix/sandbox/README.md
@@ -1,17 +1,20 @@
-# Run untrusted PR heads on sandboxed runners
+# Sandbox maintainers' jobs
 
 ## Goal
 
-Jobs on PR heads containing non-maintainer commits route to Linux runners,
-which build the PR's devShell in a per-job VM before its commands run in the
-OS sandbox every Claude Code job already uses. opencode jobs' commands run in
-that sandbox too. kix classifies PR heads whose commits all
-carry a current maintainer's valid signature as trusted, so those run on any runner. The
-sandbox is verified on macOS, and the owner's approval of another
-maintainer's answer is lifted once it is.
+Every job's commands run in the OS sandbox, opencode's included, and a
+maintainer can approve one exact PR head, such as one kix pushed, so its
+iterate and merge jobs run on any runner. Runners keep refusing PR heads with
+non-maintainer commits until
+[contributor sandboxing](/quest/m1/kix/sandbox/README.md) in m1.
 
 ## Plan
 
+Decided 2026-10-30 (user, /quest-plan): the untrusted-head VM, stock-Ubuntu
+AppArmor, and macOS verification moved to
+[m1](/quest/m1/kix/sandbox/README.md), since moq-dev's maintainers run their
+own jobs. The decisions below still cover both epics.
+
 Decided 2026-10-15, from Codex's review of moq-dev/quest#121:
 
 - A Nix devShell is not an isolation boundary, and maintainers' machines
@@ -74,6 +77,3 @@ Shipped in [moq-dev/quest#212](https://github.com/moq-dev/quest/pull/212)
 
 - [Head approval](/quest/m0/kix/sandbox/head-approval.md) - a maintainer approves an exact head, such as one kix pushed, for host runners
 - [opencode sandboxing](/quest/m0/kix/sandbox/opencode.md) - opencode jobs' commands run in the same sandbox as Claude Code's
-- [macOS sandbox](/quest/m0/kix/sandbox/macos.md) - the boundary verified under Seatbelt, then the answer-approval gate removed
-- [Ubuntu AppArmor](/quest/m0/kix/sandbox/apparmor.md) - the sandbox starts on stock Ubuntu, or the runner refuses at startup
-- [Untrusted devShells](/quest/m0/kix/sandbox/vm.md) - untrusted PR heads build their devShell in a per-job VM
diff --git a/quest/m0/kix/sandbox/opencode.md b/quest/m0/kix/sandbox/opencode.md
index 375a4b32..76ac5905 100644
--- a/quest/m0/kix/sandbox/opencode.md
+++ b/quest/m0/kix/sandbox/opencode.md
@@ -54,5 +54,5 @@ its file tools follow permission rules. Checked against the pinned opencode
   that print the server password and the tools' token. Then remove the "opencode
   runs unconfined" notes from the README, `src/runner/opencode.ts`, and
   `src/runner/cli.ts`, and the epic's 2026-10-24 decision.
-- [macOS sandbox](/quest/m0/kix/sandbox/macos.md) reruns the test for
+- [macOS sandbox](/quest/m1/kix/sandbox/macos.md) reruns the test for
   opencode under Seatbelt.
diff --git a/quest/m1/README.md b/quest/m1/README.md
index 757c9016..12a0b6b1 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -1,22 +1,27 @@
-# Later work
+# Public release
 
 ## Goal
 
-Extend kix.quest with cloud runners, a native mobile app, runners shared
-with other projects, donated reviews and CI, stronger isolation, and
-additional login providers. This milestone does not gate the first release.
+kix.quest opens to any maintainer: a third-party repository onboards itself,
+contributor PR heads run safely on runners, and the themed site and launch
+material announce it. Nothing here is needed for moq-dev's own repositories,
+which m0 serves first.
+
+## Plan
+
+Decided 2026-10-30 (user, /quest-plan): m0 is adoption on moq-dev/quest,
+moq-dev/moq, and moq-dev/moq.pro, hosted at quest.moq.dev and closed to
+other owners. Work only third-party repositories need moved here, and the
+earlier "Later work" milestone became m2.
+
+- Where does the public launch live?
+  - ✅ Move to kix.quest in m1
+  - Stay on quest.moq.dev
+  - Decide later
 
 ## Required
 
-- [Cloud runners](/quest/m1/cloud/README.md) - one-click free cloud runners, API-key and donor funding, then paid compute
-- [Native mobile app](/quest/m1/mobile-app.md) - push notifications with quick replies to decisions
-- [Shared runners](/quest/m1/donor-runner.md) - offer your runner and accounts to other projects
-- [Review and check automation](/quest/m1/automation/README.md) - donated reviews, CI, and a shared Nix cache
-- [Donor isolation](/quest/m1/donor-isolation.md) - stronger boundaries for untrusted shared jobs
-- [ChatGPT hosted runs](/quest/m1/chatgpt-hosted.md) - conditional on provider approval and current terms
-- [ChatGPT approval](/quest/m1/chatgpt-waitlist.md) - resolve hosted-use approval before implementation
-- [Current landing status](/quest/m1/status-landing.md) - `quest status` drops a stale `landing-stopped` line and ignores superseded cancelled checks
-- [Worker dev setup](/quest/m1/worker-dev.md) - per-server cookies, seeded raw output, static assets, one fake GitHub, each test run alone
-- [Gate ownership everywhere](/quest/m1/gate-ownership.md) - delegated sub-cgroups for nested gates and Windows Job Objects
-- [Fewer git processes on Windows](/quest/m1/windows-git.md) - batched git lookups in the CLI and reused fixture repositories in tests
-- [Delete the legacy hold labels](/quest/m1/legacy-labels.md) - condition: every gated repository pins quest past #326; then only `quest:active` and `quest:kix` are holds
+- [Open kix.quest](/quest/m1/open.md) - the Worker moves to kix.quest and any owner may enroll
+- [Kix for any repository](/quest/m1/kix/README.md) - onboarding, read-only CI checks, contributor sandboxing, and the maintainer guide
+- [Quest log theme](/quest/m1/theme/README.md) - an MMO-style identity, copy, board, landing page, and CLI output for the demo and launch
+- [Launch material](/quest/m1/launch.md) - README, quickstart, demo, comparison, and launch-post drafts
diff --git a/quest/m1/kix/README.md b/quest/m1/kix/README.md
new file mode 100644
index 00000000..3e1830a9
--- /dev/null
+++ b/quest/m1/kix/README.md
@@ -0,0 +1,22 @@
+# Kix for any repository
+
+## Goal
+
+A maintainer outside moq-dev enrolls their repository on kix.quest without
+help from the operator, learns the trust rules their repository must meet,
+and accepts contributors' PRs without running contributor-controlled code
+unconfined on their own machines.
+
+## Plan
+
+Moved from m0 on 2026-10-30 (user, /quest-plan): moq-dev's own repositories
+already carry Quest, are enrolled by the operator, and are worked on by their
+maintainers, so they need none of this first.
+
+## Required
+
+- [Pick repositories](/quest/m1/kix/pick-repos.md) - after installing, the maintainer enables repositories from a list
+- [Setup PR](/quest/m1/kix/setup-pr.md) - enrolling a repository without Quest makes the App open its `quest init` pull request
+- [Read-only CI](/quest/m1/kix/ci-read-only.md) - enrolled repositories keep pull-request CI read-only, checked at enrollment, with every trust boundary written down
+- [Contributor sandboxing](/quest/m1/kix/sandbox/README.md) - contributors' PR heads build in a VM, on stock Ubuntu and verified on macOS
+- [Onboarding guide](/quest/m1/kix/guide.md) - a complete maintainer path, from runner setup through a reviewed PR
diff --git a/quest/m0/kix/ci-read-only.md b/quest/m1/kix/ci-read-only.md
similarity index 100%
rename from quest/m0/kix/ci-read-only.md
rename to quest/m1/kix/ci-read-only.md
diff --git a/quest/m0/kix/guide.md b/quest/m1/kix/guide.md
similarity index 100%
rename from quest/m0/kix/guide.md
rename to quest/m1/kix/guide.md
diff --git a/quest/m0/kix/pick-repos.md b/quest/m1/kix/pick-repos.md
similarity index 93%
rename from quest/m0/kix/pick-repos.md
rename to quest/m1/kix/pick-repos.md
index 199980ab..c1e4c57c 100644
--- a/quest/m0/kix/pick-repos.md
+++ b/quest/m1/kix/pick-repos.md
@@ -18,7 +18,7 @@ adopted GitHub App sign-in:
 - Each row reuses enrollment's existing checks (live authority, public, OSI
   license, Quest tree) and states why an ineligible repository cannot be
   enabled. A repository without Quest files offers the
-  [setup PR](/quest/m0/kix/setup-pr.md) once that lands; until then it links
+  [setup PR](/quest/m1/kix/setup-pr.md) once that lands; until then it links
   `/setup`.
 - Keep `/projects/select` for an already-enrolled repository's pause and
   disconnect controls.
diff --git a/quest/m1/kix/sandbox/README.md b/quest/m1/kix/sandbox/README.md
new file mode 100644
index 00000000..ef1681d3
--- /dev/null
+++ b/quest/m1/kix/sandbox/README.md
@@ -0,0 +1,21 @@
+# Run contributors' PR heads on sandboxed runners
+
+## Goal
+
+Jobs on PR heads containing non-maintainer commits route to Linux runners,
+which build the PR's devShell in a per-job VM before its commands run in the
+OS sandbox. The sandbox starts on stock Ubuntu, and it is verified on macOS,
+which lifts the owner's approval of another maintainer's answer.
+
+## Plan
+
+Split from [the m0 sandbox epic](/quest/m0/kix/sandbox/README.md) on
+2026-10-30 (user, /quest-plan): moq-dev's maintainers run their jobs on
+trusted or approved heads, so untrusted heads stay refused until m1. The
+design decisions for the whole sandbox stay in the m0 epic's Plan.
+
+## Required
+
+- [macOS sandbox](/quest/m1/kix/sandbox/macos.md) - the boundary verified under Seatbelt, then the answer-approval gate removed
+- [Ubuntu AppArmor](/quest/m1/kix/sandbox/apparmor.md) - the sandbox starts on stock Ubuntu, or the runner refuses at startup
+- [Untrusted devShells](/quest/m1/kix/sandbox/vm.md) - untrusted PR heads build their devShell in a per-job VM
diff --git a/quest/m0/kix/sandbox/apparmor.md b/quest/m1/kix/sandbox/apparmor.md
similarity index 100%
rename from quest/m0/kix/sandbox/apparmor.md
rename to quest/m1/kix/sandbox/apparmor.md
diff --git a/quest/m0/kix/sandbox/macos.md b/quest/m1/kix/sandbox/macos.md
similarity index 100%
rename from quest/m0/kix/sandbox/macos.md
rename to quest/m1/kix/sandbox/macos.md
diff --git a/quest/m0/kix/sandbox/vm.md b/quest/m1/kix/sandbox/vm.md
similarity index 94%
rename from quest/m0/kix/sandbox/vm.md
rename to quest/m1/kix/sandbox/vm.md
index e49e6927..3fffe4ab 100644
--- a/quest/m0/kix/sandbox/vm.md
+++ b/quest/m1/kix/sandbox/vm.md
@@ -13,7 +13,7 @@ sandbox with no network.
   still run in the OS sandbox afterwards.
 - Verify how to import unsigned store paths without making the runner trust
   arbitrary builders, and never publish them to the
-  [shared cache](/quest/m1/automation/cache.md).
+  [shared cache](/quest/m2/automation/cache.md).
 - The runner refuses untrusted jobs until this ships;
   the trusted-head classifier routes untrusted heads here.
 - Test a PR whose flake or shellHook tries to run on the host, and one whose
diff --git a/quest/m0/kix/setup-pr.md b/quest/m1/kix/setup-pr.md
similarity index 100%
rename from quest/m0/kix/setup-pr.md
rename to quest/m1/kix/setup-pr.md
diff --git a/quest/m0/launch.md b/quest/m1/launch.md
similarity index 93%
rename from quest/m0/launch.md
rename to quest/m1/launch.md
index f8718faa..4d364909 100644
--- a/quest/m0/launch.md
+++ b/quest/m1/launch.md
@@ -6,7 +6,7 @@ A quickstart, a recorded demo on a real repository other than MoQ, more
 examples, a comparison with alternatives, and launch-post drafts are ready, all
 in the quest-log voice from `design/theme.md`. Publishing the posts is out of
 scope. The README and the landing page belong to
-[the theme epic](/quest/m0/theme/README.md).
+[the theme epic](/quest/m1/theme/README.md).
 
 ## Plan
 
@@ -29,6 +29,6 @@ scope. The README and the landing page belong to
 
 ## Required
 
-- [Quest log theme](/quest/m0/theme/README.md) - the voice the posts build on, and the themed surfaces the demo records
+- [Quest log theme](/quest/m1/theme/README.md) - the voice the posts build on, and the themed surfaces the demo records
 
 - [Web execution](/quest/m0/kix/execution.md) - the working hosted flow for the demo
diff --git a/quest/m1/open.md b/quest/m1/open.md
new file mode 100644
index 00000000..7bb31b3d
--- /dev/null
+++ b/quest/m1/open.md
@@ -0,0 +1,21 @@
+# [S] Open kix.quest
+
+## Goal
+
+The Worker serves `https://kix.quest` instead of `https://quest.moq.dev`, and
+any owner who installs the App may enroll. The App's homepage, callback, and
+webhook URLs, `cloudflare/wrangler.jsonc`'s route and `AUTH_URL`, and
+`quest runner`'s default `--url` all name kix.quest, and quest.moq.dev
+redirects there.
+
+## Plan
+
+Decided 2026-10-30 (user, /quest-plan): m0 hosts at quest.moq.dev and only
+moq-dev may enroll, so nothing is spent making a public service before it
+works for moq-dev. This quest undoes both for the launch.
+
+- Remove the owner allowlist from
+  [Owner allowlist](/quest/m0/kix/owners.md) and its setup notes.
+- Keep the D1 database and secrets; only the origin changes. Existing
+  sessions may be dropped.
+- Comes before the landing page and launch material, which link kix.quest.
diff --git a/quest/m0/theme/README.md b/quest/m1/theme/README.md
similarity index 98%
rename from quest/m0/theme/README.md
rename to quest/m1/theme/README.md
index b7882315..da40cc8a 100644
--- a/quest/m0/theme/README.md
+++ b/quest/m1/theme/README.md
@@ -112,8 +112,8 @@ Decided while planning on 2026-10-05, amended 2026-10-14 where noted:
 
 ## Required
 
-- [Landing page](/quest/m0/theme/landing.md) - the home page's calls to action lead to sign-in, onboarding, and the setup paste
+- [Landing page](/quest/m1/theme/landing.md) - the home page's calls to action lead to sign-in, onboarding, and the setup paste
 
 ## Related
 
-- [Launch material](/quest/m0/launch.md) - posts, quickstart, demo, and comparison written in the same voice
+- [Launch material](/quest/m1/launch.md) - posts, quickstart, demo, and comparison written in the same voice
diff --git a/quest/m0/theme/landing.md b/quest/m1/theme/landing.md
similarity index 90%
rename from quest/m0/theme/landing.md
rename to quest/m1/theme/landing.md
index 8adc4099..64e5617f 100644
--- a/quest/m0/theme/landing.md
+++ b/quest/m1/theme/landing.md
@@ -18,4 +18,4 @@ their decision inbox. The standalone Quest setup remains easy to find.
 
 ## Required
 
-- [Deploy kix.quest](/quest/m0/kix/deploy.md) - the live site and setup link
+- [Open kix.quest](/quest/m1/open.md) - the live public site and setup link
diff --git a/quest/m2/README.md b/quest/m2/README.md
new file mode 100644
index 00000000..9d13f500
--- /dev/null
+++ b/quest/m2/README.md
@@ -0,0 +1,22 @@
+# Later work
+
+## Goal
+
+Extend kix.quest with cloud runners, a native mobile app, runners shared
+with other projects, donated reviews and CI, stronger isolation, and
+additional login providers. This milestone does not gate the public release.
+
+## Required
+
+- [Cloud runners](/quest/m2/cloud/README.md) - one-click free cloud runners, API-key and donor funding, then paid compute
+- [Native mobile app](/quest/m2/mobile-app.md) - push notifications with quick replies to decisions
+- [Shared runners](/quest/m2/donor-runner.md) - offer your runner and accounts to other projects
+- [Review and check automation](/quest/m2/automation/README.md) - donated reviews, CI, and a shared Nix cache
+- [Donor isolation](/quest/m2/donor-isolation.md) - stronger boundaries for untrusted shared jobs
+- [ChatGPT hosted runs](/quest/m2/chatgpt-hosted.md) - conditional on provider approval and current terms
+- [ChatGPT approval](/quest/m2/chatgpt-waitlist.md) - resolve hosted-use approval before implementation
+- [Current landing status](/quest/m2/status-landing.md) - `quest status` drops a stale `landing-stopped` line and ignores superseded cancelled checks
+- [Worker dev setup](/quest/m2/worker-dev.md) - per-server cookies, seeded raw output, static assets, one fake GitHub, each test run alone
+- [Gate ownership everywhere](/quest/m2/gate-ownership.md) - delegated sub-cgroups for nested gates and Windows Job Objects
+- [Fewer git processes on Windows](/quest/m2/windows-git.md) - batched git lookups in the CLI and reused fixture repositories in tests
+- [Delete the legacy hold labels](/quest/m2/legacy-labels.md) - condition: every gated repository pins quest past #326; then only `quest:active` and `quest:kix` are holds
diff --git a/quest/m1/automation/README.md b/quest/m2/automation/README.md
similarity index 73%
rename from quest/m1/automation/README.md
rename to quest/m2/automation/README.md
index 22c21d86..1c33ccb7 100644
--- a/quest/m1/automation/README.md
+++ b/quest/m2/automation/README.md
@@ -13,6 +13,6 @@ No custom review database or git-note approval protocol is introduced.
 
 ## Required
 
-- [Agent reviews](/quest/m1/automation/review.md) - attributed, advisory GitHub reviews
-- [Donated checks](/quest/m1/automation/checks.md) - repository-defined check execution with explicit trust
-- [Nix cache](/quest/m1/automation/cache.md) - optional main-only signed build cache
+- [Agent reviews](/quest/m2/automation/review.md) - attributed, advisory GitHub reviews
+- [Donated checks](/quest/m2/automation/checks.md) - repository-defined check execution with explicit trust
+- [Nix cache](/quest/m2/automation/cache.md) - optional main-only signed build cache
diff --git a/quest/m1/automation/cache.md b/quest/m2/automation/cache.md
similarity index 94%
rename from quest/m1/automation/cache.md
rename to quest/m2/automation/cache.md
index 5651cb39..88415f9d 100644
--- a/quest/m1/automation/cache.md
+++ b/quest/m2/automation/cache.md
@@ -22,4 +22,4 @@ merged default-branch revisions.
 
 ## Required
 
-- [Donated checks](/quest/m1/automation/checks.md) - runner configuration and trust model
+- [Donated checks](/quest/m2/automation/checks.md) - runner configuration and trust model
diff --git a/quest/m1/automation/checks.md b/quest/m2/automation/checks.md
similarity index 92%
rename from quest/m1/automation/checks.md
rename to quest/m2/automation/checks.md
index 1ede20da..d92cde4b 100644
--- a/quest/m1/automation/checks.md
+++ b/quest/m2/automation/checks.md
@@ -18,4 +18,4 @@ a pinned revision and publish accurately attributed GitHub check results.
 
 ## Required
 
-- [Shared runners](/quest/m1/donor-runner.md) - contributed execution capacity
+- [Shared runners](/quest/m2/donor-runner.md) - contributed execution capacity
diff --git a/quest/m1/automation/review.md b/quest/m2/automation/review.md
similarity index 100%
rename from quest/m1/automation/review.md
rename to quest/m2/automation/review.md
diff --git a/quest/m1/chatgpt-hosted.md b/quest/m2/chatgpt-hosted.md
similarity index 81%
rename from quest/m1/chatgpt-hosted.md
rename to quest/m2/chatgpt-hosted.md
index 01d05973..1a1405d1 100644
--- a/quest/m1/chatgpt-hosted.md
+++ b/quest/m2/chatgpt-hosted.md
@@ -14,5 +14,5 @@ and supported integration once approval is available.
 
 ## Required
 
-- [ChatGPT approval](/quest/m1/chatgpt-waitlist.md) - OpenAI must approve hosted use
-- [Cloud runners](/quest/m1/cloud/README.md) - the hosted runs this funds
+- [ChatGPT approval](/quest/m2/chatgpt-waitlist.md) - OpenAI must approve hosted use
+- [Cloud runners](/quest/m2/cloud/README.md) - the hosted runs this funds
diff --git a/quest/m1/chatgpt-waitlist.md b/quest/m2/chatgpt-waitlist.md
similarity index 100%
rename from quest/m1/chatgpt-waitlist.md
rename to quest/m2/chatgpt-waitlist.md
diff --git a/quest/m1/cloud/README.md b/quest/m2/cloud/README.md
similarity index 85%
rename from quest/m1/cloud/README.md
rename to quest/m2/cloud/README.md
index c9396ee5..cf1fabc2 100644
--- a/quest/m1/cloud/README.md
+++ b/quest/m2/cloud/README.md
@@ -29,7 +29,7 @@ Decided 2026-10-15 in the decisions-not-implementations interview:
 
 ## Required
 
-- [API funding](/quest/m1/cloud/funding.md) - maintainer API keys, the credential proxy, and durable usage accounting
-- [Hosted runners](/quest/m1/cloud/runners.md) - free, capped cloud runners enabled with one click
-- [Donor allocations](/quest/m1/cloud/donors.md) - shared API budgets after maintainer-funded cloud runners work
-- [Paid compute](/quest/m1/cloud/billing.md) - charge for cloud runner compute once free capacity is not enough
+- [API funding](/quest/m2/cloud/funding.md) - maintainer API keys, the credential proxy, and durable usage accounting
+- [Hosted runners](/quest/m2/cloud/runners.md) - free, capped cloud runners enabled with one click
+- [Donor allocations](/quest/m2/cloud/donors.md) - shared API budgets after maintainer-funded cloud runners work
+- [Paid compute](/quest/m2/cloud/billing.md) - charge for cloud runner compute once free capacity is not enough
diff --git a/quest/m1/cloud/billing.md b/quest/m2/cloud/billing.md
similarity index 89%
rename from quest/m1/cloud/billing.md
rename to quest/m2/cloud/billing.md
index ffec37fd..56229b4d 100644
--- a/quest/m1/cloud/billing.md
+++ b/quest/m2/cloud/billing.md
@@ -15,4 +15,4 @@ from their own connected accounts.
 
 ## Required
 
-- [Hosted runners](/quest/m1/cloud/runners.md) - the compute being billed
+- [Hosted runners](/quest/m2/cloud/runners.md) - the compute being billed
diff --git a/quest/m1/cloud/donors.md b/quest/m2/cloud/donors.md
similarity index 94%
rename from quest/m1/cloud/donors.md
rename to quest/m2/cloud/donors.md
index 0a0ff24d..d5ff6b5e 100644
--- a/quest/m1/cloud/donors.md
+++ b/quest/m2/cloud/donors.md
@@ -42,7 +42,7 @@ and charge only their explicitly selected allocation.
   from assumptions about promotional funding; verify applicable provider
   terms before making public promotional-credit claims.
 - Hosting stays under the operator's separate limit until
-  [paid compute](/quest/m1/cloud/billing.md) ships. Donor API authorization
+  [paid compute](/quest/m2/cloud/billing.md) ships. Donor API authorization
   never silently pays compute charges.
 - Decided 2026-10-15: extend existing service documentation with donor
   consent, budget estimates, usage, exhaustion, and revocation behavior.
@@ -55,8 +55,8 @@ and charge only their explicitly selected allocation.
 
 ## Required
 
-- [Hosted runners](/quest/m1/cloud/runners.md) - working cloud jobs using maintainer API funding
+- [Hosted runners](/quest/m2/cloud/runners.md) - working cloud jobs using maintainer API funding
 
 ## Related
 
-- [API funding](/quest/m1/cloud/funding.md) - the credential proxy and durable usage ledger
+- [API funding](/quest/m2/cloud/funding.md) - the credential proxy and durable usage ledger
diff --git a/quest/m1/cloud/funding.md b/quest/m2/cloud/funding.md
similarity index 96%
rename from quest/m1/cloud/funding.md
rename to quest/m2/cloud/funding.md
index cd37ce20..761bf60a 100644
--- a/quest/m1/cloud/funding.md
+++ b/quest/m2/cloud/funding.md
@@ -40,7 +40,7 @@ cloud runners; donor allocations follow working cloud runners separately.
   does not implement a shared monthly cap. Do not present it as one.
   Document provider workspace limits as an independent backstop.
 - Hosting is paid by kix.quest under a separate operator limit until
-  [paid compute](/quest/m1/cloud/billing.md) ships. API-key authorization
+  [paid compute](/quest/m2/cloud/billing.md) ships. API-key authorization
   never silently pays compute charges.
 - Decided 2026-10-15: keep key setup, usage, pause/revocation, and deployment
   instructions in the existing service documentation. No separate guide
@@ -57,4 +57,4 @@ cloud runners; donor allocations follow working cloud runners separately.
 
 ## Related
 
-- [Donor allocations](/quest/m1/cloud/donors.md) - add shared budgets after cloud runners work
+- [Donor allocations](/quest/m2/cloud/donors.md) - add shared budgets after cloud runners work
diff --git a/quest/m1/cloud/runners.md b/quest/m2/cloud/runners.md
similarity index 92%
rename from quest/m1/cloud/runners.md
rename to quest/m2/cloud/runners.md
index e93246a3..2de0d249 100644
--- a/quest/m1/cloud/runners.md
+++ b/quest/m2/cloud/runners.md
@@ -18,7 +18,7 @@ spend cap bounds the free hosting.
   revocable job credential only.
 - Decided 2026-10-15 in the funding interview: the first cloud release uses
   maintainer API keys. Enable production key collection with this hosted
-  integration; [donor allocations](/quest/m1/cloud/donors.md) follow working
+  integration; [donor allocations](/quest/m2/cloud/donors.md) follow working
   cloud runners and do not gate this quest.
 - Reuse the project's Nix devShell and the shared cache where available, so
   cold containers do not rebuild the world.
@@ -33,4 +33,4 @@ spend cap bounds the free hosting.
 
 ## Required
 
-- [API funding](/quest/m1/cloud/funding.md) - maintainer API keys, the credential proxy, and accounting
+- [API funding](/quest/m2/cloud/funding.md) - maintainer API keys, the credential proxy, and accounting
diff --git a/quest/m1/donor-isolation.md b/quest/m2/donor-isolation.md
similarity index 93%
rename from quest/m1/donor-isolation.md
rename to quest/m2/donor-isolation.md
index c3bc1d25..703ddd6e 100644
--- a/quest/m1/donor-isolation.md
+++ b/quest/m2/donor-isolation.md
@@ -19,4 +19,4 @@ with constrained network and filesystem access, without exposing host secrets.
 
 ## Required
 
-- [Shared runners](/quest/m1/donor-runner.md) - the execution path this hardens
+- [Shared runners](/quest/m2/donor-runner.md) - the execution path this hardens
diff --git a/quest/m1/donor-runner.md b/quest/m2/donor-runner.md
similarity index 100%
rename from quest/m1/donor-runner.md
rename to quest/m2/donor-runner.md
diff --git a/quest/m1/gate-ownership.md b/quest/m2/gate-ownership.md
similarity index 100%
rename from quest/m1/gate-ownership.md
rename to quest/m2/gate-ownership.md
diff --git a/quest/m1/legacy-labels.md b/quest/m2/legacy-labels.md
similarity index 100%
rename from quest/m1/legacy-labels.md
rename to quest/m2/legacy-labels.md
diff --git a/quest/m1/mobile-app.md b/quest/m2/mobile-app.md
similarity index 100%
rename from quest/m1/mobile-app.md
rename to quest/m2/mobile-app.md
diff --git a/quest/m1/status-landing.md b/quest/m2/status-landing.md
similarity index 100%
rename from quest/m1/status-landing.md
rename to quest/m2/status-landing.md
diff --git a/quest/m1/windows-git.md b/quest/m2/windows-git.md
similarity index 100%
rename from quest/m1/windows-git.md
rename to quest/m2/windows-git.md
diff --git a/quest/m1/worker-dev.md b/quest/m2/worker-dev.md
similarity index 100%
rename from quest/m1/worker-dev.md
rename to quest/m2/worker-dev.md