Build a small `dead_letter_handler(msg, retry_count, max_retries)` that returns one of `"retry"`, `"deadletter"`, or `"drop"`: 1. `msg.get("malformed", False) is True` → `"drop"` (never retry corrupt input — it'll fail forever). 2. `retry_count < max_retries` → `"retry"` (still under the budget). 3. `retry_count == max_retries` → `"deadletter"` (used up the budget — route to DLQ for ops review). 4. `retry_count > max_retries` → `"drop"` (already DLQ'd; subsequent failures drop silently to stop noise). This pattern is what protects every production queue from poison-message storms.