At some point, when a system has entered a failure mode for a while, it makes sense to start shedding load, rather than attempting to deliver every single push

At some point, when a system has entered a failure mode for a while, it makes sense to start shedding load, rather than attempting to deliver every single push notification. Also worth mentioning, a minute of downtime is already a million backed up pushes. Beyond that, it becomes infeasible to attempt deliver them. Edit: Also worth mentioning, the 50k buffer is for a single server, we run multiple push servers in the cluster.