List the outbox facts this gateway destroyed
Walks the terminal INVALID rows of this tenant’s outbox, oldest first: the money facts this gateway DESTROYED.
The dispatcher never retries a row here, and switching a relay on afterwards recovers nothing. POST /v1/consignado/event-delivery/invalid//requeue puts one row back in the dispatcher’s queue; this operation is a read and moves nothing.
The event PAYLOAD never leaves the store. It is the whole envelope of the fact, business data and CPF included, and an operator deciding what to do about a destroyed fact does not need its body. The recorded failure text does not leave either: it travels as ‘last_error_class’, a MECHANISM, because a publish error can carry a tenant identifier, a contract number or a rail payload. ‘unclassified’ covers both a message no rule recognises and a row with no message at all, which are the same thing to an operator.
‘event_type’ is the stable relay type the dispatcher routed on, not the business fact’s name: the concrete fact rides inside the envelope this read never opens. ‘id’ is the id the requeue operation takes.
There is deliberately NO time window. A window would hide exactly the old destroyed fact nobody ever noticed, which is what this surface exists to show.
Paging is keyset over the row’s creation instant and its id. Send the previous page’s page.next_after as after. has_more is true exactly when another page exists, and next_after is null exactly when it is false, so a client loop may terminate on either. The cursor never expires; a cursor this service did not mint is refused with 422 rather than silently restarting the scan from the top. A fact reaches INVALID under its original creation instant, on its first destruction or when a requeued fact fails again, so a walk already past that instant does not see it: restart from the top after a requeue and read the census count as the total.
It answers from a LOCAL table and never reaches the Dataprev rail, so it cannot answer 501. The tenant is derived from the validated identity and is never read from the request.