Reminder jobs idempotent; no duplicate reminders sent after crash recovery

Job queues provide at-least-once delivery guarantees — if a worker crashes after sending the reminder but before acknowledging the job, the queue will re-deliver it on restart. Without an idempotency guard that reads the reminder_sent flag before proceeding, crash recovery produces a duplicate send on every failure. CWE-362 (race condition) applies: two workers processing the same job concurrently (a known BullMQ failure mode under high load) can both pass a post-send flag check and send twice. ISO 25010 reliability.fault-tolerance requires that the system produce correct outputs even under failure and recovery. The fix — checking the flag before sending, not after — trades a low-probability missed send for a guaranteed no-duplicate guarantee.

In src/jobs/reminder-worker.ts, check reminder_sent before sending and set it to true before making the carrier call, not after. This is the set-before-send pattern — it accepts a low-probability missed send on crash in exchange for a guaranteed no-duplicate guarantee:

const worker = new Worker('reminders', async (job) => {
  if (job.name === 'send-reminder') {
    const booking = await db.bookings.findUnique({ where: { id: job.data.bookingId } })
    if (booking.reminder_sent) return // Already sent — skip

    // Set flag BEFORE send — prevents duplicates on crash recovery
    await db.bookings.update({ where: { id: booking.id }, data: { reminder_sent: true } })

    try {
      await sendReminderMessage(booking)
    } catch (error) {
      await db.deliveryLog.create({ data: { booking_id: booking.id, type: 'reminder', error: error.message } })
      throw error // Queue retries; idempotency guard prevents double-send
    }
  }
}, { connection: redis })