fix(relay): plumb --yes to updateStateStore (CI first-deploy bootstrap)

README.md

@@ -1,3 +1,27 @@
+# T3 Turbo — Self-Hosted Infrastructure (`infra/t3turbo-relay`)
+
+> **This branch is the T3 Turbo operator repo.** It carries the complete, versioned
+> kit for standing up the self-hosted stack: Cloudflare relay + tunnel, Clerk auth,
+> and self-hosted Supabase Postgres — no Axiom, no APNs (Android-only operator).
+
+## Start here
+
+| What                                                                           | Where                                                            |
+| ------------------------------------------------------------------------------ | ---------------------------------------------------------------- |
+| Master runbook (bring-up order, architecture, threat model, secrets inventory) | [`infra/README.md`](infra/README.md)                             |
+| Rebase seam — upstream files we modify + conflict guidance                     | [`SEAM.md`](SEAM.md)                                             |
+| Supabase: schema, seed, RLS, setup rules                                       | [`infra/supabase/`](infra/supabase/)                             |
+| Cloudflare Tunnel configs + systemd unit                                       | [`infra/cloudflared/`](infra/cloudflared/)                       |
+| GitHub/Cloudflare vars & secrets checklist (names only)                        | [`infra/cloudflare/CHECKLIST.md`](infra/cloudflare/CHECKLIST.md) |
+| Relay deploy guide (Hyperdrive, Clerk, verification)                           | [`infra/relay/DEPLOY.md`](infra/relay/DEPLOY.md)                 |
+
+**Hard rule:** no secret values in this repository — ever. Placeholders in `<angle brackets>`
+are resolved from the operator's private vault at deploy time.
+
+---
+
+_Upstream T3 Code README follows below (kept for rebase context)._
+
 # T3 Code
 
 T3 Code is an "agent harness control surface". It enables control of the agents on your machine with a best-in-class mobile app ([iOS](https://apps.apple.com/us/app/t3-code-remote-claude-more/id6787819824), [Android](https://play.google.com/store/apps/details?id=com.t3tools.t3code)), [web app](https://app.t3.codes) and [Electron-based desktop app](https://t3.codes).

SEAM.md

@@ -0,0 +1,39 @@
+# Upstream seam
+
+`git show --name-status 774c53df b4904491` identifies these 16 unique upstream-owned paths. The
+label is the nature of this fork's change.
+
+- **Gated** `.github/workflows/deploy-relay.yml` — fork-safe credential detection, manual dispatch,
+  and external-database/optional-service inputs.
+- **Gated** `.github/workflows/release.yml` — release artifacts remain buildable when Connect is not
+  configured.
+- **Gated** `docs/operations/release.md` — documents the optional Connect release path.
+- **Additive** `docs/operations/self-host-relay.md` — self-hosting runbook.
+- **Optional** `infra/relay/.env.example` — external PostgreSQL settings and optional Axiom/APNs
+  groups.
+- **Optional** `infra/relay/alchemy.run.ts` — provider layers and tracing outputs exist only when
+  configured.
+- **Optional** `infra/relay/scripts/deploy.test.ts` — covers deployments without tracing outputs.
+- **Optional** `infra/relay/scripts/deploy.ts` — accepts absent tracing outputs while retaining the
+  relay URL requirement.
+- **Optional** `infra/relay/src/Config.ts` — APNs is a complete optional group.
+- **Optional** `infra/relay/src/agentActivity/ApnsDeliveries.test.ts` — adapts delivery tests to the
+  optional APNs type.
+- **Optional** `infra/relay/src/agentActivity/ApnsDeliveries.ts` — supplies the disabled APNs layer.
+- **Additive** `infra/relay/src/agentActivity/ApnsDisabled.test.ts` — proves disabled delivery is a
+  no-op.
+- **Gated** `infra/relay/src/db.ts` — a complete `DATABASE_*` group selects external PostgreSQL;
+  otherwise the upstream PlanetScale path remains.
+- **Additive** `infra/relay/src/deploymentConfiguration.test.ts` — covers complete and absent
+  provider groups.
+- **Optional** `infra/relay/src/observability.ts` — Axiom resources require the complete pair.
+- **Optional** `infra/relay/src/worker.ts` — APNs queues and tracing layers are conditional.
+
+## Nightly sync conflicts
+
+Resolve against the new upstream file first, then reapply only the behavior above; never take the
+fork's whole file over a newer upstream implementation. Drop a fork hunk when upstream now provides
+equivalent gating or optionality. Preserve the PlanetScale fallback, the Cloudflare credential
+gates, and the all-or-nothing `DATABASE_*`, Axiom, and APNs groups. Re-run the focused relay tests
+and compare workflow variable/secret names after every conflict. Never use a credential, generated
+state, or production output to resolve a conflict.