fix: prevent duplicate outreach and follow-ups

tests/repository-account-isolation.test.ts

@@ -5,6 +5,7 @@ import { runMigrations } from '../src/database/client.js';
 import {
   ActivityLogRepository,
   ConversationOutcomesRepository,
+  ConversationAutomationClaimRepository,
   ConversationStateRepository,
   DeliveryOutboxRepository,
   MessagesRepository,
@@ -101,6 +102,45 @@ describe('account-bound domain repositories', () => {
     expect(statesB.get('same-room')?.boundaries).toContain('does not want further sexual escalation');
   });
 
+  it('atomically claims each inbound automation event once per account', () => {
+    const claimsA = new ConversationAutomationClaimRepository(db, ACCOUNT_A);
+    const claimsB = new ConversationAutomationClaimRepository(db, ACCOUNT_B);
+
+    expect(claimsA.tryClaim('same-room', 'same-event', 10)).toBe(true);
+    expect(claimsA.tryClaim('same-room', 'same-event', 11)).toBe(false);
+    expect(claimsB.tryClaim('same-room', 'same-event', 12)).toBe(true);
+    expect(claimsA.markSent('same-room', 'same-event', 13)).toBe(true);
+    expect(claimsA.markSent('same-room', 'same-event', 14)).toBe(false);
+  });
+
+  it('claims recipients globally and blocks usernames with existing chat history', () => {
+    db.prepare(`
+      INSERT INTO reddit_conversations (
+        account_id, conversation_id, username, room_name, payload_json, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?)
+    `).run(
+      ACCOUNT_A,
+      'historical-room',
+      'Historical_User',
+      'Historical User',
+      JSON.stringify({
+        messages: [{ sender: 'Me', text: 'prior opener', timestamp: 1, isSelf: true }],
+      }),
+      2,
+    );
+    const history = new RecipientHistoryRepository(db);
+
+    expect(history.hasSentTo('historical_user')).toBe(true);
+    expect(history.tryClaim('HISTORICAL_USER', 3)).toBe(false);
+    expect(history.tryClaim('new_user', 4)).toBe(true);
+    expect(history.tryClaim('NEW_USER', 5)).toBe(false);
+    history.releaseClaim('new_user');
+    expect(history.tryClaim('new_user', 6)).toBe(true);
+    history.commitClaim('new_user');
+    history.releaseClaim('new_user');
+    expect(history.hasSentTo('NEW_USER')).toBe(true);
+  });
+
   it('isolates outbox claims, successful examples, activity and outcomes', () => {
     const postsA = new PostsRepository(db, ACCOUNT_A);
     const postsB = new PostsRepository(db, ACCOUNT_B);