Snow-plow routing jobs sometimes receive poison messages that crash workers and block the queue. How should the team ensure recoverability?
Select an answer to reveal the explanation.
Short Explanation
A bad snow-route message shouldn’t freeze the whole plow plan. Idempotent workers plus a DLQ quarantine the poison so good jobs keep moving.
Full Explanation
Snow-plow routing jobs that crash workers on poison messages need isolation and analysis paths, not infinite head-of-line blocking. Making workers idempotent and routing repeatedly failing messages to a dead-letter queue preserves main-queue throughput while preserving failed payloads for engineering review. Retrying forever on the main queue with no DLQ keeps poison messages at the head indefinitely. Dropping failed messages silently with no DLQ and no metrics hides data loss. Processing each message only in memory with no persistence and no retry controls fails recoverability. Exam caveat: DLQ alarms and replay procedures are mandatory—otherwise poison messages become forgotten dead letters. Operational check: inject a deliberately bad message, confirm it lands on the DLQ after maxReceiveCount, verify healthy messages continue, and practice a safe replay after fixing the worker. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.