---
id: ADR-COM-ORD-008
title: Background work runs as one every-minute sweeper
product_area: commerce
module: orders
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Use one concurrency-limited minute schedule for ordered recovery and expiry passes, discovering across
  workspaces and writing within each selected workspace.
constrains:
  - WF-COM-ORD-006
  - SVC-COM-ORD-checkout
  - SVC-COM-ORD-orders
  - SVC-COM-ORD-entitlements
origin: >-
  services-platform docs/queued-work.md and docs/row-level-security.md, as cited by the code (not readable in
  this job, FND-COM-ORD-048); D-P4-02
alternatives:
  - option: Give each timed pass a separate function
    why_not: Separate functions add infrastructure while offering stronger isolation than the current design.
  - option: Feed recovery exclusively from write-generated messages
    why_not: Queues would replace the present table-driven discovery mechanism with additional infrastructure.
consequences:
  - Cross-workspace access discovers candidates while writes retain workspace isolation.
  - A propagated early failure prevents later passes from running.
  - Several recovery paths depend on the same scheduled function.
supersedes: []
evidence:
  - >-
    services-commerce at c8b66a98: modules/checkout/aws/lambda/SWEEPER.ts; aws/checkout.module.ts; the sweep
    select policies in the migrations.
---

# Background work runs as one every-minute sweeper

## Context

Several records need time-based expiry or recovery.

## Decision

Run ordered passes in one scheduled function with concurrency one, bounded discovery and ordinary workspace policies for writes.

## Alternatives Considered

Independent schedules improve failure isolation at greater infrastructure cost. Write-fed queues offer another architecture but are not the implementation examined.

## Consequences

A propagated failure can skip unrelated later work repeatedly. The existing finding recommends isolating pass and record failures before relying on this mechanism for recovery.