Why architecture matters here
Sagas fail on the compensation side. Getting the happy path right is easy; recovering when step 4 of 5 fails is where teams struggle. The architecture matters because compensations must be idempotent, deterministic, and safe to retry.
Choreography scales in code freedom but is hard to reason about globally. Orchestration centralizes the flow at the cost of a single coordinator that must not become a bottleneck.
Understanding the pieces lets you pick, monitor, and recover sagas without pinning your team to a whiteboard.
The architecture: every piece explained
The top strip is the shape choice. Initiator starts the saga (a user request, a scheduled event). Choreography uses events on a bus; each service reacts to prior events and emits its own. Orchestration uses a central saga coordinator (a state machine) that invokes each service in sequence and handles branching. Local transactions are per-service DB commits — the saga is a chain of these, not a single distributed commit.
The middle row is the safety machinery. Compensations undo prior local transactions if a later step fails. Timeouts prevent stuck sagas. Idempotency lets each step and compensation retry safely. Semantic isolation handles the reality that intermediate saga states are visible to other transactions — design UI and API to reflect "pending" states or use compensating logic to backpedal.
The lower rows are the substrate. State store persists saga state so it survives coordinator crashes. Observability traces per-step timing and detects dwell (stuck sagas). Ops includes poison saga isolation, manual intervention procedures, and audit trail.
End-to-end flow
End-to-end: an ecommerce checkout saga has 5 steps — reserve inventory, charge card, create shipment, update loyalty, send email. Orchestration coordinator invokes step 1; success. Step 2 charges the card; success. Step 3 shipment creation fails due to invalid address. Coordinator invokes compensations in reverse: refund charge (step 2 comp), release inventory (step 1 comp). User sees a clear error asking to correct address. Saga state store records the final aborted state. Observability shows the saga path. Idempotency keys ensured compensations were safe. No 2PC required.