tp-merge-from-main

tp-merge-from-main — worktree-aware base-sync + living-doc conflict resolution

When parallel designs run in their own worktrees, the base branch moves under them and a merge conflict on the shared living docs (known_issues.md, product_roadmap.md, architecture.md, vision.md) is the expected case at /tp-design-complete time. Manual resolution is slow and — as the parent spike proved on real PR-#28 history — a silent content-drop risk: a careful human merge dropped a known-issue entry outright.

/tp-merge-from-main merges the base into the design's worktree branch and auto-resolves only the provably-mechanical living-doc conflict classes behind an independent zero-drop verifier. Everything semantic is left as conflict markers for the human. It is the conflict-handling step the merge-back flow never had; it composes with /tp-pr-iterate for the post-merge re-review loop.

Base-sync, not land. /tp-merge-from-main is the reversible base-into-branch operation (it merges {base} into the design branch and re-pushes the branch). It is not the irreversible gh pr merge that lands the PR to {default} — that is the separate /tp-merge land skill, which enforces the deterministic merge gate (including the human-approval predicate) before crossing the boundary. Keep them distinct: this skill syncs the base in; /tp-merge lands the PR out.

The boundary (from the worktree-merge-conflict-flow spike, verdict GO; log classes un-gated by basesync-prepend-log):

• AUTO-SAFE (auto-resolved + verified): design-inventory-row-merge, id-renumber-collision, log-entry-insertion, append-only-log.
• ALWAYS-HUMAN (deferred): preamble/Last updated, current-focus-reprioritization, generic-prose.

log-entry-insertion is the real base-sync shape for newest-first ADR logs (architecture.md's ## History): git merge-file --diff3 minimizes the conflict to an empty base between two divergent insertion blocks, so detection keys off empty-base (⇒ no deletions) and both sides being dated ### YYYY-MM-DD entries — keep-both, zero-drop, fail-closed on any deletion or non-dated line. (The GATED lever stays in the classifier, now empty, for any future class that needs a fixture first.)

Approval-carry consequence. When a base-sync is fully AUTO-SAFE (every conflict mechanical, certified byte-for-byte), the approval-survives-safe-base-sync carry keeps your existing PR approval + review proof current — no re-approval. A sync that hand-resolves any ALWAYS-HUMAN hunk cannot be certified mechanical (the hand-edit is a real content change), so it stales the approval and you must re-approve. Serial fleet PRs sharing a living doc do not each re-approve by default — verify the merge-tree empirically (--dry-run) before assuming a re-approval tax: a later PR can sync cleanly when its merge-base already holds the earlier PR's entry (different insertion line → no collision). See skills/_shared/human-approval-howto.md §"Does a base-sync cost me a re-approval?".