Service

Automate Operations with Fault-Tolerant Worker Queues

Campaign automation that duplicates? Document ingestion that drops files? Background queues that lose jobs on restart? I build atomic claim-leasing, idempotency keys, and three-category lease recovery so every job runs exactly once — even through host failure. A killed worker cannot duplicate work, because the claim is conditional and only a genuinely expired lease is recoverable.

Problems this solves

• Naive SELECT-then-UPDATE loops producing duplicate dispatches when a worker host restarts

• Jobs silently lost during host failures with no recovery mechanism

• No idempotency — same job can execute multiple times, corrupting downstream systems

• Manual database cleanup required after any infrastructure incident

What you get

✓ Atomic claim-leasing with full attempt tracking using SQL UPDATE OUTPUT

✓ Transactional outbox pattern for guaranteed job recovery after host failure

✓ Egress-controlled ingestion with built-in SSRF protection for external data sources

✓ Resilient cancellation and error handling — every job carries an idempotency key

Who it is for

Organisations running background processing at scale — marketing automation, document ingestion, batch data jobs, campaign triggers. Suitable where duplicate execution causes real business harm: double-charging customers, sending duplicate emails, or corrupting ledger data.

How it works

The claim-lease pattern replaces SELECT-then-UPDATE with a single atomic SQL statement: UPDATE job SET ClaimedBy = @worker, ClaimExpires = @timeout OUTPUT INSERTED.* WHERE ClaimedBy IS NULL. No polling gap, no duplication window. The outbox table doubles as the recovery source — if a host fails, uncompleted jobs are reclaimed by the next available worker after the lease expires.

Atomic Claim-Lease Outbox Recovery Idempotency Keys SSRF Protection BackgroundService

Related work

See the distributed worker queue case study — atomic claim-lease with outbox recovery. Outcome: an idempotency key per job and recovery restricted to expired leases, so an incident needs no manual database cleanup. Also see egress-controlled document ingestion, where each provider URL is resolved once and pinned before connect.

View related case studies

Does your background processing survive a host failure?

Book a free 30-minute call. I will review your current worker architecture and explain how atomic claim-leasing eliminates duplicate execution at any scale.