The first part (before except) matches all the decedents of any matching @due or @today item. The
@done//* is there to cancel out all those results in case the original item also had a @done tag. For example if you had marked "Final Guest List" as @done above.
But yeah, my query misses out one individual @dones that are descendants of a @today. This should fix I think:
Overdue @search(@due <[d] today or @today//* except (@done union @done//*))