feat(#1466 P3c): insurance-prompt autopilot (advisor-first fallback client-send)

[Systemsaholic]

#1466 P3c — Insurance-prompt autopilot (FINAL slice of the Automation Gate epic)

Hourly recurring.insurance_prompt_autopilot: booked (status='active') trips still carrying pending trip_traveler_insurance past the booking grace window nudge the advisor first, then — on a later sweep once the nudge grace elapses — auto-send the client insurance proposal via InsuranceAutomationService.queueProposalEmails verbatim.

⚠️ HIGHEST-RISK slice — the ONLY net-new client email in the epic. The MERGE is "the flip": once live, the hourly job can send real client insurance proposals. Held by the coordinator for Al's explicit go. Do NOT self-merge.

Safety (client-send blast radius) — all verified by Codex xhigh

1. Zero new send code — queueProposalEmails + handleInsuranceProposalEmail invoked verbatim; the actual email still goes through emailService.sendEmail({ audience: 'client', automated: true, templateSlug: 'insurance-proposal' }).
2. MIGRATION_SILENT_MODE hard-stops the sweep up front — before any DB read, nudge, or form-token mint — closing the orphan-token leak that would exist if relying only on schedule()'s no-op.
3. Idempotent — pending-only; excludes any traveler with an existing insurance:${tripId}:${travelerId} job in automation_job_history; deterministic jobId + UNIQUE(queue,job_id) second fence. Leftover-pending-minor can't double-send (queueProposalEmails only builds recipients from adults-with-email).
4. Advisor nudge strictly precedes send (separate cycle). The nudge notification (stable insurance-autopilot:${advisorId}:${tripId} dedupe key) is the durable "nudged at T" marker read by stage 2; a missing/failed marker only delays, never skips to send.
5. Trigger = grace-since-booking only (status='active' so lastStatusChangeAt == booking anchor; soft-deleted excluded); purchase_window_hours never read (display-only per Al).
6. No migration (grace = env/code const). P3b evidence auto-populates on the resulting client_esign waiver.

InsuranceAutomationService is resolved lazily via ModuleRef (breaks the TripsModule ↔ AutomationModule DI cycle — the ShoreEx pattern). Nudge reuses the automation_gate category with a distinct dedupe namespace (no collision with the P2 gate nudge).

Tests (foreground)

• insurance-autopilot.spec.ts (11) — pure selection/grouping/staging, grace parsing, dedupe key.
• client-care.processor.insurance-autopilot.spec.ts (7) — advisor-first, stage-2 send, within-grace defer, idempotent no-op, MIGRATION_SILENT_MODE suppression, audience:'client' tag on the inherited send path.
• Full src/automation folder: 112/112 green.

Review

Codex gpt-5.5 xhigh: APPROVE on e8fe7f6f.

refs #1466

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tailfire-client	Ready	Preview, Comment	Jul 5, 2026 3:08pm
tailfire-ota	Ready	Preview, Comment	Jul 5, 2026 3:08pm

[coderabbitai]

Warning

Review limit reached

@Systemsaholic, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8e320dbb-426e-4653-bceb-ddfb736f5a59

📥 Commits

Reviewing files that changed from the base of the PR and between 9f216a5 and e8fe7f6.

📒 Files selected for processing (6)

• apps/api/src/automation/automation.service.ts
• apps/api/src/automation/automation.types.ts
• apps/api/src/automation/insurance-autopilot.spec.ts
• apps/api/src/automation/insurance-autopilot.ts
• apps/api/src/automation/processors/client-care.processor.insurance-autopilot.spec.ts
• apps/api/src/automation/processors/client-care.processor.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/issue-1466-p3c-insurance-autopilot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}