fix(turbo): ingest upstream by merge instead of rebase

[gfsaaser24]

The problem

The nightly sync's source job replayed the fork's commits onto each new upstream main. It can never finish.

turbo is not a linear stack above the SHA recorded in .t3-turbo/upstream.json. It contains merge commits of its own (977b4d63, ba84d289) and its root is parented three upstream generations back. A rebase therefore re-litigates history those merges already reconciled, one replayed commit at a time — including a modify/delete on a file the fork had already handled.

Measured against the tip the last nightly actually faced (turbo at 705ee4ab, upstream at f21d5e44):

	rebase	merge
commits processed	94 (15 merge commits)	1 merge
conflicts	8 in the first 10 commits	1 file, apps/web/src/routeTree.gen.ts (generated)

Because the rebase always aborted, the publish job never ran, so .t3-turbo/upstream.json never advanced, so every subsequent night repeated the identical failure. Meanwhile the only two ingests that have actually landed — #46 and #53 — were both merges done by hand. This makes the automation do what already works.

The fix

The rebase step now merges the resolved upstream SOURCE_SHA into the Turbo branch inside the same isolated worktree, with author/committer dates pinned to the upstream commit date so the candidate is reproducible.

What stayed byte-identical in the step contract:

• Step id: rebase and every output name — conflicted, upstream_sha, candidate_sha — so build_wsl_node_pty, build_windows, publish, report_repair, and notify_openclaw are untouched.
• The conflict contract. No auto-resolution (no -X ours/theirs, no strategy option); the same collision report from the same report command with the same files-changed-by-both and unmerged-path inputs; merge --abort; conflicted=true; exit 0 so the existing "Open or update review issue" and "Upload conflict report" steps run unchanged.
• The artifact and report paths — turbo-rebase-report.md, turbo-rebase-conflict-*, turbo-candidate.bundle — and the bundle's ^$OLD_MAIN_SHA prerequisite.
• The manifest gate (turbo-customization-manifest.ts verify --root "$sync_worktree") in exactly its old position: after a clean merge, before the anchor commit, the bundle, or any build.
• The guard that refuses a candidate when the official Nightly tag is not contained in upstream main, and every other forward-only history guard ahead of it.

Renamed only where it is user-facing: the job and step names, the collision report headings, and the review-issue title.

One real bug caught by dry-running it

git merge names conflicted files on stdout, not stderr — unlike git rebase. Splitting the streams the way the old step did would have filed a collision report whose error section read "Git did not provide stderr." The step now redirects into a single merge.log and the report reads that.

Docs

AGENTS.md rules 2, 3, and 5 said the workflow keeps "a small, reviewable commit stack above the upstream SHA" and "rebases the Turbo commit stack onto it". They now describe merge-based ingestion and say plainly why: the branch carries merge commits, and the manifest — not the shape of the history — is the preservation contract. The same correction lands in SEAM.md's "Nightly sync conflicts", docs/operations/turbo-runbook.md, and docs/internals/t3-turbo-nightly-inbound.md (the full state model, including its flow diagram).

Hard rules kept intact: upstream pingdotgg/t3code stays read-only, never hand-edit upstream.json, never delete checks to go green, automation never resolves a conflict.

Verification

• scripts/turbo-nightly-sync.test.ts + scripts/turbo-customization-manifest.test.ts — 31 passed. Adds a focused test pinning the merge strategy, the no-auto-resolve contract, the combined-log capture, and the guard/merge/manifest/candidate ordering.
• pnpm --dir scripts turbo:customizations:verify — 25 seams, 165 file checks. The manifest's own marker for this workflow moved from "Rebase in an isolated worktree" to "Merge in an isolated worktree" plus "merge --no-ff --no-edit".
• pnpm --dir scripts typecheck, targeted vp lint, vp fmt --check — clean.
• Dry-ran both paths of the real step logic locally against real upstream. The conflict path produced a complete collision report and left the worktree clean after merge --abort; the clean path passed the manifest gate, wrote the anchor commit, and produced a bundle that git bundle verify accepts.

The workflow was not triggered.

Mirror to main

.github/workflows/turbo-nightly-sync.yml must stay byte-identical on main and turbo. Blob sha to mirror:

8408d9589931edb2d7a05393ef29c07f0c9309ea

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	11.3 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	5.5 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	5.9 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	49.7 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	16	—	21	✅
Claude	Total thread wire	—	11.3 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	5.5 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	5.8 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	50.6 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	16	—	21	✅

Baseline: unavailable · PR result: a768081 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.6 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.