---
id: WF-PFM-QRY-017
title: Repair the search index on its schedules
trigger: >-
  Search maintenance runs target resubmission every fifteen minutes, distributed nightly
  reconciliation and daily tombstone cleanup.
product_area: platform
module: queries
revision: 1
status: draft
design_intent: confirmed
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
inference: []
implements:
  - CAP-PFM-QRY-017
moves:
  - STATE-PFM-QRY-013
crosses:
  - SVC-PFM-QRY-quick-search
idempotency: >-
  Bounded passes join existing rebuilds, use versioned repair writes and recheck tombstone cutoffs.
  Repeated passes still perform inspection work.
concurrency: >-
  The maintenance function reserves one invocation. Scope reconciliation defers when its target
  generation is ahead of the active ledger value.
hops:
  - 'n': 1
    actor_or_service: Resubmission pass (15 minutes)
    action: >-
      Request rebuilds for unsatisfied targets or outdated provider settings, respecting per-type
      backoff.
    anchor: 'services-platform:modules/quick-search/services/maintenance/resubmit-targets.ts'
    seam: schedule
    on_failure: A later pass retries incomplete resubmission.
    left_inconsistent: The scope can remain behind its desired configuration.
    observer: per-rule silence alarm paging operations
    provenance: observed
    source: 'services-platform:modules/quick-search/aws/logic/quick-search-maintenance.lambda.ts'
  - 'n': 2
    actor_or_service: Reconciliation sweep (nightly per scope)
    action: >-
      Compare source records, claims and provider documents, reindex drift and remove unsupported
      documents within the work budget.
    anchor: 'services-platform:modules/quick-search/services/maintenance/reconcile.ts'
    seam: schedule
    on_failure: Incomplete repair carries into later scheduled coverage rather than proving a clean scope.
    left_inconsistent: Residual drift can remain visible between passes.
    observer: last-reconciled counts on the index state
    provenance: observed
    source: 'services-platform:modules/quick-search/services/maintenance/reconcile.ts'
  - 'n': 3
    actor_or_service: Tombstone purge (daily)
    action: >-
      Inspect deletion claims older than fourteen days, remove remaining provider documents first
      and then retire eligible counters.
    anchor: 'services-platform:modules/quick-search/services/maintenance/purge-tombstones.ts'
    seam: schedule
    on_failure: Missing credentials block work; budget exhaustion leaves additional work for another pass.
    left_inconsistent: Old claims remain longer until cleanup succeeds.
    observer: the purge rule's silence alarm
    provenance: observed
    source: 'services-platform:modules/quick-search/services/maintenance/purge-tombstones.ts'
branches: []
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/quick-search/aws/logic/quick-search-maintenance.lambda.ts;
    services/maintenance/*.ts; docs/quick-search.md
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Repair the search index on its schedules

## What It Does

Search maintenance runs target resubmission every fifteen minutes, distributed nightly reconciliation and daily tombstone cleanup. 

## The Flow

```mermaid
sequenceDiagram
  participant C as Request or schedule
  participant H0 as Resubmission pass 15 minutes
  participant H1 as Reconciliation sweep nightly per scope
  participant H2 as Tombstone purge daily
  C-)H0: Request rebuilds for unsatisfied targets or outdated provider settings, respecting per-type backoff
  H0-)H1: Compare source records, claims and provider documents, reindex drift and remove unsupported document
  H1-)H2: Inspect deletion claims older than fourteen days, remove remaining provider documents first and then
```

Request rebuilds for unsatisfied targets or outdated provider settings, respecting per-type backoff. Compare source records, claims and provider documents, reindex drift and remove unsupported documents within the work budget. Inspect deletion claims older than fourteen days, remove remaining provider documents first and then retire eligible counters.

## When Something Fails

A later pass retries incomplete resubmission. The scope can remain behind its desired configuration. Incomplete repair carries into later scheduled coverage rather than proving a clean scope. Residual drift can remain visible between passes. Missing credentials block work; budget exhaustion leaves additional work for another pass. Old claims remain longer until cleanup succeeds.

## Idempotency and Concurrency

Bounded passes join existing rebuilds, use versioned repair writes and recheck tombstone cutoffs. Repeated passes still perform inspection work. The maintenance function reserves one invocation. Scope reconciliation defers when its target generation is ahead of the active ledger value.