Two failure sources, one queue for humans. Native Service Bus dead-letters and application dead-letters land in the same Cosmos-backed store with the same shape, so an operator never has to know which mechanism produced a failure.
The dead-letter record carries everything the requirement asks for and one thing it does not: the trace id. Without it, the record tells you what failed but not what the system was doing at the time.
Discard requires a reason and terminate fires the workflow's compensation branch if one exists. Destructive operator actions are audited with an actor, because a dead-letter queue is where data loss becomes deliberate.
Operator semantics
Retry replays the single task within the original execution, preserving the attempt history and adding a new task_attempt. The execution continues from where it stopped.
Replay creates a new execution linked to its parent, used when the original is too old or its version has been deprecated. It never mutates the original.
Alerting is on DLQ arrival rate, not depth alone — more than 50 in 15 minutes pages, because a slow trickle of dead-letters is a backlog while a burst is an incident.
Risks
Bulk retry of a large dead-letter backlog can re-saturate the downstream that caused it. The operator API rate-limits bulk actions and requires a confirmation above 100 items.
Payload snapshots may contain personal data and are retained 180 days. They inherit the workflow's data classification and are subject to deletion requests, which is an operational process rather than an automated one.
Event Grid dead-letters land in Blob and are not yet merged into this store. Known gap for V1.1, listed in view 07.
