In-memory holding queue for logs that couldn't be shipped (currently only populated by AuditTrail.Shipper when the Loki adapter exhausts its retries — see shipper_retries in the README's buffer-tuning config).

Entries are retried automatically on a timer (dead_letter_redrive_interval, default 30s). This module is for inspecting/managing that queue directly — e.g. from iex in production, or an admin LiveView:

AuditTrail.DeadLetter.count()
#=> 42

AuditTrail.DeadLetter.dump()
#=> [%{event_type: "item:approved", ...}, ...]

# Loki was down, you just brought it back — don't wait for the timer
AuditTrail.DeadLetter.redrive()

# Give up on these entries entirely (e.g. Loki config changed, they'll
# never deliver)
AuditTrail.DeadLetter.clear()

Capacity is capped at max_dead_letter (default 10,000) — beyond that, new entries are dropped (logged via Logger.warning, and a [:audit_trail, :dead_letter, :dropped] telemetry event — see the README's "Telemetry" section) rather than growing unbounded.

By default this queue is ETS-backed and does not survive a node restart — entries queued when the node goes down are lost. Set dead_letter_persistent: true (see AuditTrail.Config.dead_letter_persistent?/0) to back it with :dets instead, so queued entries are reloaded from disk on the next boot. Using the Postgres or TimescaleDB adapter instead of Loki avoids needing this queue at all.