docs: mark TODO item 4 (crashed-create recovery) doneHEADmaster

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 14 insertions, 12 deletions

diff --git a/TODO.md b/TODO.md
index 4435428..e4d08cf 100644
--- a/TODO.md
+++ b/TODO.md
@@ -89,15 +89,17 @@ self-test coverage for every new helper verb, completion actions for `list` and
    check, no symlink follow, validated timestamp parse) and a dry-run default.
    Do not build until trash actually accumulates and space needs reclaiming.
 
-4. BUG: a crashed `repo create` leaves the working tree poisoned. Phase 1
-   writes the stanza into the working `conf/gitolite.conf` BEFORE the y/N and
-   commit; if the run dies at the prompt (e.g. no TTY, EOFError), the edit is
-   left uncommitted in the working tree. `stanza_exists` then reads that
-   working file, so a re-run reports "stanza already present", SKIPS Phase 1
-   entirely (never commits, never pushes), and times out waiting for a bare
-   repo that gitolite was never told to build. Recovery today is manual: commit
-   and push the admin clone by hand, then the bare repo appears. Fix options:
-   detect an uncommitted/unpushed stanza and push it instead of skipping; or
-   make Phase 1 atomic (only touch the working file once the user has confirmed,
-   or revert the edit on any abort, not just on an explicit "no"). Pin with a
-   self-test. Hit live while creating the private knowledge_base repo.
+4. BUG: a crashed `repo create` left the working tree poisoned -- DONE. Phase 1
+   used to write the stanza into the working `conf/gitolite.conf` BEFORE the y/N
+   and commit; a run that died at the prompt (e.g. no TTY, EOFError) left the
+   edit uncommitted, and because `stanza_exists` read the working file, the
+   re-run reported "stanza already present", SKIPPED Phase 1 entirely (never
+   committed, never pushed), and timed out waiting for a bare repo gitolite was
+   never told to build. Hit live while creating the private knowledge_base repo.
+   Fix: Phase 1 is now driven by git STATE, not text presence. It ensures the
+   stanza is in the working file (idempotent), commits if the working tree
+   differs from HEAD, and pushes if HEAD is ahead of upstream. This recovers
+   both a leftover uncommitted edit and a committed-but-unpushed stanza, and is
+   a no-op when already in sync; confirm happens before the commit, abort
+   reverts to HEAD. A self-test pins the three git states with a throwaway repo
+   plus bare upstream.