feat: drop the local copy after a successful push

Gitea becomes the source of truth. Once a push is confirmed, push.py
deletes tmp/issues/<id>.md and <id>.comments.md and prints the number and
URL the issue now lives at; the current state is obtained by pulling
again rather than by reconciling. --update follows the same rule, with no
exception: what is local is what has not left.

This reverses three statements AGENTS.md used to make, and rewriting them
is part of the change:

  - "tmp/issues/ is the store, not a cache of Gitea" — it is both, split
    by origin:. An origin: local file is the only copy of the work; an
    origin: gitea file is a deletable working copy.
  - "Pushing is additive: the file is never deleted" — it is deleted.
  - "origin: local is a durable state" — complete, but not durable:
    pushing ends it.

Slug stability, which the format promises for the life of an issue, can
no longer rest on a file push is about to delete. The slug goes up in the
body as a hidden marker, <!-- tea:id <slug> -->, on the first line:
map.to_payload strips every marker and prepends exactly one, map.from_api
strips every marker on the way down, so the local file never holds one
and a body cannot accumulate them however many round trips it makes. The
marker survives a rename in the web UI, a lost .remote.json, a fresh
clone and another machine — none of which a local index does.

Deletion is the last thing that happens to an issue and only after the
transport returned, the answer carried a positive integer number (and, on
--update, the number that was PATCHed — push.confirmed_number), and
.remote.json was written. A raised transport, a non-2xx, an empty or
mismatched body each leave the file on disk and stop the run.

.remote.json is no longer "only an index over the files": its entries now
deliberately outlive them, so it is the local number -> slug ledger and
rebuild_map merges into it instead of reconstructing it from files that
may be gone. It stays recoverable, from the markers in Gitea rather than
from the files. push.dep_state reads it too, so a blocker whose file an
earlier push dropped still gets its native dependency link.

Also fixes a pre-existing bug the new tests hit: issue.all_ids treated
<id>.comments.md as an issue called "<id>.comments", so a bare push.py in
a store holding pulled threads tried to file a comment thread as a unit
of work. A slug has no dot in it.

tests/test_drop_after_push.py covers the round trip (push -> gone -> pull
-> identical in slug, depends: and body), the marker's algebra, and every
failure path separately. test_push_dependencies.py is updated where it
encoded the old "never deleted" contract. 183 tests, no network.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

skills/sync/scripts/_gitea.py

@@ -13,8 +13,11 @@ script here accepts a login argument: the operator's pin is the only identity
 they will use. No pin -> exit with a pointer to /tea:auth.
 
 Also holds the id map (tmp/issues/.remote.json), which pairs a remote key with
-a local slug. It is transport bookkeeping, not domain data — the domain never
-reads it, and losing it costs a re-pull, not information.
+a local slug, and the paths of the store-side files this layer writes. All of
+it is transport bookkeeping, not domain data — the domain never reads any of
+it, and losing the map still costs a re-pull and not information: the slug it
+records also travels in the issue body as `<!-- tea:id … -->` (map.py), so a
+pull rebuilds the entry from the tracker. See `rebuild_map`.
 """
 import datetime
 import json
@@ -317,6 +320,22 @@ def resolve_milestone_id(login, base, title):
     return None
 
 
+# --------------------------------------------------------------------------
+# store-side files this layer owns
+# --------------------------------------------------------------------------
+# The issue file itself is the domain's (`issue.path_of`). The one file the sync
+# layer puts beside it is named here, in one place, because three commands have
+# to agree on it: pull.py writes the thread, comment.py refetches it, push.py
+# deletes it along with the issue it just sent.
+
+def comments_path(root, id):
+    """An issue's comment thread — beside it, under the same slug.
+
+    A path, not a concept the domain needs: a thread is pulled from Gitea and
+    never pushed back, so the domain has no reason to know the file exists."""
+    return os.path.join(root, "%s.comments.md" % id)
+
+
 # --------------------------------------------------------------------------
 # id map: remote key <-> local slug
 # --------------------------------------------------------------------------
@@ -326,7 +345,14 @@ def map_path(root):
 
 
 def load_map(root):
-    """{"owner/repo#42": "wire-sqlc-appclick"}"""
+    """{"owner/repo#42": "wire-sqlc-appclick"} — the local slug ledger.
+
+    Entries outlive the files they name, and that is now the normal case rather
+    than a leak: `push.py` deletes an issue's file the moment Gitea confirms it,
+    and the entry it leaves behind is what lets the next `pull.py 42` land on
+    the same slug. Nothing prunes them, because "no file" no longer means "no
+    such issue". A stale entry costs one json line and is corrected the next
+    time that number is pulled."""
     p = map_path(root)
     if not os.path.isfile(p):
         return {}
@@ -345,9 +371,27 @@ def save_map(root, m):
 
 
 def rebuild_map(root, issues):
-    """Recover the id map from the `gitea:` fields on disk. The files are the
-    source of truth; .remote.json is only an index over them."""
-    m = {}
+    """Fold the `gitea:` fields still on disk into the id map. Returns it.
+
+    This used to say "the files are the source of truth; .remote.json is only an
+    index over them", and that stopped being true the day push started deleting
+    the file it had just sent. A pushed issue leaves no `gitea:` field behind to
+    read, so the files are now a SUBSET of what the map knows, and a rebuild
+    from them alone would throw away every entry it cannot see.
+
+    So the contradiction is resolved by moving the source of truth, not by
+    keeping this function honest about files:
+
+        Gitea            the issue, and — in `<!-- tea:id … -->` — its slug
+        .remote.json     a local number -> slug ledger, a cache of that marker
+        tmp/issues/*.md  whatever happens to be checked out right now
+
+    Which makes this a MERGE and never a replacement: it starts from what is
+    already recorded and adds what the remaining files say. What it cannot
+    recover — a pushed-and-dropped issue whose ledger entry was also lost — is
+    not lost either; the next `pull.py <n>` reads the slug off the marker and
+    writes the entry back."""
+    m = load_map(root)
     for id, iss in issues.items():
         key = iss.extra.get("gitea")
         if key: