quest: plan review-state and sandbox PR-trigger follow-ups

quest/m0/README.md

@@ -95,6 +95,7 @@ ownership-manifest design:
 ## Required
 
 - [Land through a serial merge queue with an async fixer](/quest/m0/queue-watcher/README.md) - GitHub's merge queue, or the watcher's own where GitHub has none, lands one PR at a time, and a host watcher fixes and re-enqueues each PR it drops
+- [quest review continues older sessions](/quest/m0/review-old-state.md) - a review session saved by an older quest continues, or is refused before the reviewer runs
 - [Review sessions keyed by upstream branch](/quest/m0/review-session-key.md) - a round from a local branch tracking the PR branch continues that branch's review session
 - [Kix decision UI](/quest/m0/kix/README.md) - planning and implementation through prompts and summaries, run on the maintainer's own runners
 - [Route quests to models by size](/quest/m0/model-routing/README.md) - `/quest-spawn` starts each quest on the first model of its size's ranked list that can run, reviews rank the same way, and PRs record size, implementer, and reviewer

quest/m0/kix/sandbox/README.md

@@ -95,3 +95,4 @@ Shipped in [moq-dev/quest#212](https://github.com/moq-dev/quest/pull/212)
 ## Required
 
 - [Per-job opencode saved output](/quest/m0/kix/sandbox/opencode-data.md) - each opencode job saves its tool output and shell captures beside its checkout, so no job reads another's, while sessions and the credential stay in the account's database
+- [Boundary tests on agent-moving PRs](/quest/m0/kix/sandbox/pr-trigger.md) - PRs that bump flake.lock or change the runner run the live sandbox tests before landing

quest/m0/kix/sandbox/pr-trigger.md

@@ -0,0 +1,28 @@
+# [S] The sandbox boundary tests run on PRs that move the agents
+
+## Goal
+
+A PR that changes what the runner's agents are, such as a `flake.lock`
+bump or a change to the opencode client or the runner's sandbox code, runs
+the live boundary tests (`just runner-sandbox`) before it lands, so a
+failure shows on the PR instead of the next nightly run. The merge gate
+still does not wait on them.
+
+## Plan
+
+Decided 2026-11-07 (coordinator, follow-up of
+[moq-dev/quest#536](https://github.com/moq-dev/quest/pull/536)): the
+nixpkgs bump in [moq-dev/quest#502](https://github.com/moq-dev/quest/pull/502)
+moved the pinned opencode from 2.1.1 to 2.2.1, which offered jobs its own
+session and worktree tools outside the sandbox. Nothing ran the boundary
+test until the next nightly run, which failed after the bump had merged.
+
+- Add a `pull_request` trigger with a paths filter to
+  `.github/workflows/sandbox.yml`: `flake.lock`, `flake.nix`, the runner's
+  sources and its live tests. Keep the job off the merge queue's required
+  checks; `/quest-merge` already names a failing optional check before it
+  queues.
+- Keep the workflow read-only (`contents: read`, no secrets), since it runs
+  PR code.
+- Update the workflow's header comment and the sandbox epic's README,
+  which say the test runs only nightly.

quest/m0/review-old-state.md

@@ -0,0 +1,27 @@
+# [S] quest review continues sessions saved by an older quest
+
+## Goal
+
+A `quest review` round on a branch whose review session was saved by an
+older `quest` either continues it, settling the last round's findings, or
+refuses before the reviewer runs with an error naming the fix, such as
+`--new`. It never spends a reviewer round and then fails.
+
+## Plan
+
+Decided 2026-11-07 (coordinator, follow-up of
+[moq-dev/quest#517](https://github.com/moq-dev/quest/pull/517) and
+[moq-dev/quest#538](https://github.com/moq-dev/quest/pull/538)): both
+iterate agents hit `the reviewer's reply does not settle each of the last
+round's undefined finding(s) once` (`src/cli/review.ts`, the `earlier` count),
+after the reviewer had already run. #517's session predated
+[moq-dev/quest#514](https://github.com/moq-dev/quest/pull/514); #538's
+branch was new that day, so reproduce both cases before fixing.
+
+- Find where the last round's finding count comes from and why it is
+  `undefined`; `git blame` it to the PR that changed the saved format and
+  list it under `## Caused by`.
+- Validate the saved session when it is loaded, before the reviewer starts.
+  Read the older format when it carries what the round needs; otherwise
+  refuse with the error above.
+- A test covers a session file in each format the reviewer can meet.