feat(s-remind2): a distinct second (final) reminder

[CoJoA13]

S-remind2 — a distinct second (final) reminder

Re-introduces the second pre-due reminder that S-notify-4 deferred. The original was killed
because both reminders emitted under task.due_soon, and the in-app dedup
((recipient_user_id, task_id, event_key) WHERE task_id IS NOT NULL) collapsed REMIND_2 onto
REMIND_1's row → it delivered nothing. The fix: a distinct event key for REMIND_2.

What ships

• task.due_final — a new event key for REMIND_2 (constants + _TASK_EVENT_VARS whitelist +
  ACTION_REQUIRED class — not CRITICAL, so it does not pierce quiet hours like task.overdue).
• escalation.py — the REMIND branch now selects the key per step: REMIND_1 → task.due_soon
  (unchanged), REMIND_2 → task.due_final. OVERDUE/ESCALATE and all stamping/audit/recipient logic
  are byte-identical.
• Migration 0068 (no DDL) — seeds the global task.due_final template (ON CONFLICT … DO NOTHING) and sets sla_policy.remind_2_before = INTERVAL '1 day' (a final reminder 1 business
  day before due, all task types). Downgrade nulls remind_2_before and deletes the template
  guarded against the notification.template_id RESTRICT FK.

_due_task_ids and due_steps need no change — S-claim-filter pre-activated the policy-gated
remind_2 claim disjunct, and the timer already emits REMIND_2; this slice just makes the offset
non-NULL and gives the emit a distinct key.

Scope

BE-only. Migration head 0067 → 0068. No new permission key, no WORM/authz/web/openapi/FE
change. The SPA renders the stored title/body + the notification class — it doesn't switch on
event_key, so a new key with the same class renders identically.

Tests

• Unit: class_of("task.due_final") == ACTION_REQUIRED; the due_steps REMIND_2 threshold is
  already covered.
• Integration (mutation-distinguishing): test_remind_2_distinct_final_reminder — one sweep
  produces two distinct notifications (task.due_soon + task.due_final) for the assignee
  (reminders isolated by pre-stamping overdue+escalate); under the old shared-key path the second
  deduped to one. Run-scoped, open-state, depends on 0068 setting remind_2_before on the
  testcontainer DB.
• Enabling remind_2 made the two S-claim-filter exclusion tests' "fully-fired" tasks newly
  claimable (the now-live remind_2 disjunct) → both now stamp remind_2_sent_at; the DOC_ACK case
  stays mutation-distinguishing via the still-live escalate tautology. The two additive-safe
  escalation tests also pre-stamp remind_2 to keep isolating their escalate checks.

Gates

Local: ruff clean · mypy src (412 files) · pytest -m unit 1063 passed. The migration
round-trip (CI migrations) and the two-notification proof + seed-data effect (CI integration)
are authoritative (Docker-less dev box).

Review

Subagent-driven (per-task spec+quality review; migration via the specialized migration-reviewer) →
final whole-branch: opus senior reviewer (Ready=Yes) + diff-critic (CLEAN) converged, with a
full 24-test audit confirming no other timer test breaks or false-passes. The Minors they raised
(a now-stale "remind_2 is inert" prod docstring + test comment/message drift) are folded in.

🤖 Generated with Claude Code