# Requirement change

Support had a bad week. When a notification finally gives up, right now it just — goes. The receipt
comes back to whoever called us, and if that was a batch job at 2am then nobody ever looks at it, and
the first we hear about it is the customer ringing up.

So I want a **dead-letter list**. Anything that finally failed goes in it, and I can ask the service
for it.

What I need to be true:

- Ask for the dead letters and I get back the receipts of every notification that ended up **failed**
  — everything we tried and could not get out of the door.
- **In the order they failed**, oldest first, so support can work down it.
- Something we **delivered** is not a dead letter. Obviously.
- Something we **held back on purpose** — quiet hours, somebody who has told us not to contact them
  — is not a dead letter either. Nothing went wrong there; that was us doing what we were told. I do
  not want support chasing those.
- **One entry per notification, not per call.** Our upstream resubmits, and if a resubmission of
  something that already failed puts a second copy on the list then the list is useless — support
  will be looking at the same broken notification four times.
- The list I get back is **mine to look at, not to edit**. If I sort it or clear it in my own code
  that must not touch what the service holds.
- Lots of things call this at once, and reading the list while notifications are failing must not
  blow up.

Nothing else changes. The retry schedule is the same, when we give up is the same, and what the
caller gets back from a send is the same — I am not asking you to change a single outcome, only to
remember the bad ones.
