task_attempt is a separate entity from task_execution rather than a counter on it. Retry analysis, error taxonomy and the 'why did it take 47 seconds' question in view 25 all need per-attempt timing, worker identity and trace id.
outbox_message is part of the model, not an implementation detail. Its published_at being null is the entire definition of 'a task that must be dispatched', and the change feed over it is the dispatcher.
concurrency_lease carries a fencing token even though it is a fairness mechanism rather than a correctness one. Uniformity with the scheduler lease in view 30 is worth more than the bytes saved.
Keys and consistency
workflow_execution and task_execution share the /workflowExecutionId logical partition. That co-location is what allows a state change, its event and its outbox row to commit as one transactional batch.
Both carry _etag and every transition is an ETag-guarded replace. Two orchestrators racing the same completion means one succeeds and one retries against fresh state, which is correct rather than merely unlikely.
execution_event.sequence_no is gapless per execution, assigned inside the same batch. A gap is therefore evidence of a bug, which makes it a usable invariant to alert on.
Assumptions
Rendered as a relational model for reviewability; the physical store is Cosmos, where several of these entities are documents in one container distinguished by a type field.
idempotency_record is written by the worker, not the orchestrator, and expires at 7 days on the assumption that no retry window exceeds it.
The reporting star schema in Azure SQL is derived from these entities and is not modelled here.
