docs: TODO - record crashed-create poisons working tree bug

A repo create that dies at the y/N prompt leaves the stanza uncommitted
in the working tree; stanza_exists reads the working file, so a re-run
skips Phase 1 and times out waiting for a bare repo gitolite was never
told to build. Records recovery and fix options.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/TODO.md b/TODO.md
index 677217b..4435428 100644
--- a/TODO.md
+++ b/TODO.md
@@ -88,3 +88,16 @@ self-test coverage for every new helper verb, completion actions for `list` and
    `rm -rf` in the tool, so it needs hard guards (realpath-under-TRASH_DIR
    check, no symlink follow, validated timestamp parse) and a dry-run default.
    Do not build until trash actually accumulates and space needs reclaiming.
+
+4. BUG: a crashed `repo create` leaves the working tree poisoned. Phase 1
+   writes the stanza into the working `conf/gitolite.conf` BEFORE the y/N and
+   commit; if the run dies at the prompt (e.g. no TTY, EOFError), the edit is
+   left uncommitted in the working tree. `stanza_exists` then reads that
+   working file, so a re-run reports "stanza already present", SKIPS Phase 1
+   entirely (never commits, never pushes), and times out waiting for a bare
+   repo that gitolite was never told to build. Recovery today is manual: commit
+   and push the admin clone by hand, then the bare repo appears. Fix options:
+   detect an uncommitted/unpushed stanza and push it instead of skipping; or
+   make Phase 1 atomic (only touch the working file once the user has confirmed,
+   or revert the edit on any abort, not just on an explicit "no"). Pin with a
+   self-test. Hit live while creating the private knowledge_base repo.