Orchestrators are part of your consistency model, not neutral plumbing.

Orchestrators are part of your consistency model, not neutral plumbing. Jepsen’s Orkes Conductor analysis shows concurrent task runs and forgotten executions can make retries, callbacks, and compensations merely look idempotent in tests. You must test and design against the orchestrator’s concrete semantics, and treat the orchestrator as a principal. Add durable execution IDs, server-visible idempotency checks, and harness-level tests that inject the same failures Jepsen did.