This needs some investigation but I believe that if a delete operation fails then the database transaction COMMITS. This appears to be because the Orchestration#destroy method is not within a transaction and the ROLLBACK is just an ordinary exception.

It may be that this is more or less complicated than that but this what I have seen.

I admit that I cannot see how this is possible, so maybe I am wrong.