Per-contact frequency cap across all campaigns

Minimum spacing prevents back-to-back emails within a single send pair; frequency capping prevents runaway volume over a rolling window. A contact enrolled in four simultaneous sequences, each with a 24-hour minimum spacing, can still receive four emails per day — 28 per week — without violating any per-pair spacing rule. CWE-770 (Allocation of Resources Without Limits) applies at the application layer: the system places no global bound on how many times it contacts a single recipient. Under CAN-SPAM Act Sec. 5 and GDPR Art. 6, the volume of commercial email must reflect the reasonable expectations of the subscriber — not the maximum throughput the queue can sustain.

Enforce a rolling-window frequency cap per contact at send time, counting sends across all campaigns. When the cap is reached, defer (do not drop) the send until the oldest send in the window ages out.

const MAX_EMAILS_PER_WEEK = 5

async function checkFrequencyCap(contactId: string): Promise<{ allowed: boolean; resetsAt?: Date }> {
  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000)
  const recentCount = await db.emailSend.count({
    where: { contactId, sentAt: { gte: sevenDaysAgo } }
  })
  if (recentCount >= MAX_EMAILS_PER_WEEK) {
    const oldest = await db.emailSend.findFirst({
      where: { contactId, sentAt: { gte: sevenDaysAgo } },
      orderBy: { sentAt: 'asc' }
    })
    return { allowed: false, resetsAt: new Date(oldest!.sentAt.getTime() + 7 * 24 * 60 * 60 * 1000) }
  }
  return { allowed: true }
}

Call checkFrequencyCap before every sequence send — not only within a single sequence handler.