Authorize-then-capture with expiry

Design the authorize-then-capture engine for a platform where an order is authorized at purchase but captured later (on ship, or per-item as items ship), authorizations expire after ~7 days (varies by network), and a single auth may be partially captured multiple times up to the authorized amount. ~2M orders/day. You must capture before the auth expires (or re-auth), never capture more than authorized in total, and handle the case where some items ship after the auth has already expired. How do you model and schedule this?