toga-ai 1.0.187 → 1.0.189

package/knowledge/2.0/apps/worker2/features/team-sprint-management.md

@@ -193,9 +193,30 @@ backfills `workTypeAtLock` the first time a task is seen).
   and the committed values should be rotated. See team coding/security standards.
 - **Worker contract.** Like all 2.0 workers this must return cleanly and commit writes via
   the `_Db`/transaction layer to be durable — uncommitted captures can be silently dropped.
+- **ClickUp pagination returns duplicate tasks — the sync loop must be idempotent.** ClickUp's
+  page-based task API (`/list/{id}/task?page=N`) can return the **same task on more than one
+  page**, especially on large/long runs (a real failure ran ~418s across many pages). If the
+  sync loop treats a re-seen task as new, it builds a second `_Model_Team_Task` (id=NULL) and
+  `save()`s it → a second INSERT → `Duplicate entry '<sprintId>-<clickupId>' for key
+  'Tasks.sprintId_clickupIdentifier'` and the whole run aborts. **Design rule (the two-map
+  pattern):** keep two separate maps keyed by `clickupIdentifier`. `$lookupTaskByClickUpId`
+  drives update-vs-insert and **must stay current for the entire run** — register every
+  newly-created task into it immediately and never `unset()` it mid-loop, so a duplicate page
+  row resolves to the same model and does an UPDATE. A separate `$tasksToDelete` map (seeded
+  from existing tasks) has entries removed as each task is seen; whatever remains after the
+  loop is deleted (SprintLock) / archived to `statusNow = ARCHIVED` (the Capture methods).
+  Do **not** overload one map for both jobs. This pattern is replicated identically in
+  `SprintLock()`, `CaptureSprintEnd()`, and `CaptureSprintDaily()` — fix all three together.
 
 ## Change history
 
+- 2026-06-24 — Fixed a duplicate-key crash (`Tasks.sprintId_clickupIdentifier`) in the
+  ClickUp→DB sync: ClickUp pagination can return the same task on multiple pages, and the
+  loop was overloading one map (`$lookupTaskByClickUpId`) for both update-vs-insert and
+  deletion tracking, `unset()`ing entries mid-loop so a re-seen task was treated as new and
+  re-INSERTed. Decoupled into two maps — a persistent `$lookupTaskByClickUpId` (new tasks
+  registered immediately, never unset) and a separate `$tasksToDelete` — making re-processing
+  idempotent. Applied to `SprintLock()`, `CaptureSprintEnd()`, and `CaptureSprintDaily()`. (jcardinal)
 - 2026-06-24 — Initial documentation of `_Worker_Team_Sprint` (`Worker/Team/Sprint.php`):
   the sprint lifecycle (warnings → lock → daily → end → release notes), the four-metric
   developer scoring model (reliability/quality/hygiene/integrity with weights, team-relative

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.187",
+  "version": "1.0.189",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",