Only the authoritative zone is restored from backup. Everything derived is rebuilt by replaying execution-events, which shrinks the recovery surface to one Cosmos account and one Blob account.
Payloads are never inlined into state or into messages beyond 64 KB. The claim-check pattern keeps message size bounded and keeps a 40 KB p99 payload from becoming a 40 KB RU charge on every state transition.
Telemetry is explicitly not a system of record. If an answer is only available in Log Analytics, it is not auditable — audit facts are execution events, exported to immutable Blob.
Partition keys and retention
executions and execution-events are partitioned on workflowExecutionId, which co-locates an execution's entire state and is what makes the transactional batch in view 13 possible.
workflow-definitions and dead-letters are partitioned on tenantId, because their access pattern is tenant-scoped listing rather than execution-scoped read.
Retention: events 90 days then archived, dead-letters 180 days, payloads 30 days, definitions forever, audit export 7 years. Every one of these is a cost decision as much as a compliance one.
Risks
A 500-task execution concentrates on one logical partition, bounded at 20 GB and 10,000 RU/s. With payloads externalised this is comfortable, but it is the design's hardest ceiling.
Session consistency is chosen over strong. A read from a different region or session may lag; every orchestration read that matters is a point read within the session that wrote it.
Blob lifecycle to cool storage after 30 days assumes dead-letter investigation happens inside that window. A slower operations process would silently raise rehydration cost.
