A live token-scope probe against mathias/ai-sessions revealed gitea's contents API uses POST to create and PUT (sha required) to update — the first impl always PUT'd, so creating a new summary 422'd "[SHA]: Required". The httptest mock had the same wrong assumption. Pick the method by whether the file exists (GET sha). Token confirmed contents:write (push:true) by the probe. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>