Mailbox rotation

The naive version cycles through mailboxes in order. It fails the moment they differ: a mailbox halfway through its ramp gets the same share as an established one, hits its ceiling early, and the rest of the day's volume piles onto whoever is left.

The better rule is least normalised usage — pick the mailbox that has used the smallest fraction of what it is allowed today. Weighted distribution falls out of that automatically, and it interleaves smoothly: a mailbox with twice the allocation gets picked twice as often rather than twice in a row.

Selection that depends on a database session, a clock read or a random number cannot be tested without sending, and two workers given the same state can disagree. Making it a function of the pool, today's counters and the current time means every rotation rule is unit-testable and reproducible.

That is also what makes the behaviour explainable. When someone asks why a message went out from a particular mailbox, the answer is arithmetic that can be shown, not a heuristic somebody remembers writing.

Rotation distributes volume; it does not make volume safe. A list with a bad address rate spread across six mailboxes damages six reputations instead of one. The same is true of copy that generates complaints.

Treat it as one control among several — caps bound the exposure per mailbox, ramps bound how fast a new one grows, health scoring pulls a failing mailbox out. Rotation on its own, with no ceiling and no health input, mostly spreads the harm.

SalesShift picks the mailbox with the lowest normalised usage: sent today divided by (today's effective cap × weight × health multiplier). The lowest fraction wins, so a mailbox that is behind catches up and one that is ramping or unhealthy takes proportionally less. The selector is a pure function of the pool, the day's counters and the time.