I took a slightly different approach:

* For mail, it will try up to 5 times (no more than once per hour) on failed mail. Permanently failed mail will be removed from the queue and dumped to a log file in data_custom/failed_mail. A health check will fail if that directory contains any log files.

* For notification digests, we're not using locks. Instead, two cut-offs are now used: item count and e-mail body size. If either is exceeded, the e-mail will be wrapped up. Remaining items will be sent in another digest one hour later [because the hook only runs once per hour] (truncation of items was a bad idea IMO because notification digests cannot easily be opened in full).