What happens to a message that cannot succeed: separating the permanently poison message that fails on its own content from the transiently blocked one whose dependency is down, and why an attempt counter cannot tell them apart; the dead-letter queue as a design with an owner, an alert and a redrive path; the record captured beside the payload; and the head-of-line decision in a partitioned log, where skipping a record trades a complete effect sequence for progress.
