Every platform eventually needs a coordination substrate: somewhere to put locks, leases, leader epochs, catalog pointers, fencing tokens, and the other small records that decide who is allowed to do what. The byte count is often modest. The cost of getting one byte wrong is not.
etcd is the usual answer because its model is understandable and its guarantees are useful. Its ceilings are also familiar: one Raft group carries every operation, the practical storage envelope is small, and multitenancy is mostly an operational convention. Teams respond by running more clusters. The coordination substrate becomes a fleet.
FoundationDB sits at the other end. It is a remarkable transactional database, and it is more capable than Orbita today. But full database machinery and its operating model are a lot to adopt when what you needed was consistent key-value coordination.
Orbita sits between them: more room than etcd, less surface than a database.
The keyspace should grow, not the operational fleet
Orbita range-partitions each keyspace. A new keyspace starts as one partition and splits as it grows. The control plane owns only the map, membership, and epochs; ordinary reads and writes never flow through the leader group. The data path grows with partitions and workers.
Keyspaces are also the tenant boundary. Credentials, quotas, request limits, TTL defaults, and value ceilings belong to the keyspace rather than to a dedicated cluster. One substrate can serve many teams without pretending noisy neighbors do not exist.
Correctness has to be observable
“Strongly consistent” is easy to typeset. The interesting question is what happened when a replica missed an invalidation, the owner died after acknowledging the client, the replacement had a torn WAL tail, and a lease expired at exactly the wrong instant.
Orbita puts every source of nondeterminism behind a runtime seam. The simulator owns time, scheduling, transport, disk, object storage, and randomness. It can drop, delay, duplicate, and reorder messages; partially write a log; restart a node with or without its disk; and run an hour of lease expiry without waiting an hour.
The important detail is the seed. The same seed produces the same interleaving, so a failure from CI can be replayed locally and then pinned as a regression. A correctness failure stops being an anecdote and becomes a durable test case.
Evidence is a product surface
The intended launch artifact is not a badge that says “simulation tested.” It is a public correctness report: the histories checked, the failures injected, the seeds explored, and the violations found. Nightly runs should turn that report into a continuing record rather than a document that ages quietly after release day.
Orbita is not there yet. A single node works end to end; important multi-node and administrative pieces are still being built. Saying that plainly is part of the same posture. If the proposition is that infrastructure should be verifiable, the project status has to be verifiable too.