Entry and exit conditions are explicit

Duplicate enrollment — calling enrollContact() twice for the same contact and sequence — creates two active send threads. Both threads advance independently and both send on their own schedules, so a single contact can receive every sequence email twice. CWE-841 (Improper Enforcement of Behavioral Workflow) applies directly: the system fails to enforce that a contact occupies exactly one position in a sequence at a time. The exit-conditions gap is equally damaging: contacts who unsubscribe mid-sequence continue receiving steps because no exit path was wired to the opt-out signal, creating CAN-SPAM and GDPR Art-6 exposure for marketing emails sent after a withdrawal of consent.

Add an idempotency guard on enrollment and explicit exit handlers for every termination reason. In src/lib/sequences/enrollment.ts (or equivalent):

async function enrollContact(contactId: string, sequenceId: string) {
  const existing = await db.contactSequence.findFirst({
    where: { contactId, sequenceId, status: { in: ['active', 'paused'] } }
  })
  if (existing) return { alreadyEnrolled: true }

  return db.contactSequence.create({
    data: { contactId, sequenceId, currentStepIndex: 0, status: 'active' }
  })
}

async function exitContact(
  contactId: string,
  sequenceId: string,
  reason: 'replied' | 'opted_out' | 'manual' | 'completed'
) {
  await db.contactSequence.updateMany({
    where: { contactId, sequenceId, status: { in: ['active', 'paused'] } },
    data: { status: reason === 'completed' ? 'completed' : reason, exitedAt: new Date() }
  })
  await cancelPendingSteps(contactId, sequenceId)
}

At minimum, three exit reasons must be wired: completion, opt-out, and reply.