Retries, dead letters and circuit breakers

Every delivery job ends as delivered, failed or dead. A retryable failure is retried with exponential backoff and full jitter, never sooner than the vendor’s Retry-After. A job that runs out of attempts or age becomes a dead letter that the operator can requeue; a permanent 4xx rejection is marked failed and not retried.

Each destination has a circuit breaker. When its vendor keeps failing, workers stop claiming its jobs, then let one probe job through to test recovery before resuming.