- Status: Accepted
- Date: 2026-06-22
Settlement spans multiple services and an external rail: reserve funds, post to the ledger, notify the rail, confirm. There is no distributed ACID transaction across these boundaries; partial failure must be handled with compensating actions.
Use an orchestration-based SAGA: a single coordinator (SettlementSaga) drives each step,
persists state (saga_instance) for crash recovery, and runs compensations in reverse order on
failure (a rail rejection after the ledger posted triggers a ledger reversal). Orchestration is
chosen over choreography because the workflow is non-trivial and we want one place to reason about
state, timeouts, and compensation.
The companion pricing-orchestration repo intentionally demonstrates the choreography variant for
contrast.
- Positive: explicit, observable workflow; centralized compensation logic; recoverable.
- Negative: the orchestrator is a potential coupling point; must avoid it becoming a god-service.
- Compensations are business-level (a reversal entry), never a hard delete -- correct for finance.