--fail-on turns a threshold into a process failure (partial_failure, exit 8) so CI and agents do not parse text. It accepts success_rate and dlq_depth with comparisons and ||. Here failed, pending_retries, and dlq_depth are non-zero, so continue into inspection.
Page older results with --cursor — it is forward-only and bound to this exact query and window. Don’t widen --limit to dodge paging; narrow the query. Full query grammar and cursor rules are in Search & filters.
events get truncates the body by default. Always check body.truncated; if it is true, re-fetch with --full for the complete payload. Use events diff to explain why one webhook behaved differently from another.
Credential headers and secret-like fields are redacted; PII is not. See Transcript safety before copying any payload into a transcript.
forwards search finds candidate attempts fast (use --failed rather than a status: query); forwards chain is the authoritative per-attempt timeline — order, response code, latency, retry intent, and terminal status — for one event and forwarder. Search to locate, chain to drill in.
The chain’s will_retry / next_retry_at are the forwarder’s automatic retries (its retry policy). Deliberately re-sending an event is a replay — a separate, manual action covered in Replay deliveries.