From what I can see the only place in the spec that mandates Orphan Mitigation is the last paragraph:
If the Platform encounters an internal error provisioning a Service Instance or Service Binding (for example, saving to the database fails), then it MUST at least send a single delete or unbind request to the Service Broker to prevent the creation of an orphan.
However I'd argue that Platform can be implemented in a way that won't create orphans in case of internal error. If Platform creates and persists a record for Service Instance before issuing provisioning request the record will stay there and can be processed later.
Also Orphan Mitigation doesn't guarantee lack of orphans, e.g. bugs in brokers can lead to resource leaks, so Platform may decide to use some background garbage collecting process instead or in addition to it.
My mistake. I thought if Platform keeps a record of Service Instance then this is fine, but it seems it should delete all Service Instances that were not provisioned successfully.
From what I can see the only place in the spec that mandates Orphan Mitigation is the last paragraph:
However I'd argue that Platform can be implemented in a way that won't create orphans in case of internal error. If Platform creates and persists a record for Service Instance before issuing provisioning request the record will stay there and can be processed later.
Also Orphan Mitigation doesn't guarantee lack of orphans, e.g. bugs in brokers can lead to resource leaks, so Platform may decide to use some background garbage collecting process instead or in addition to it.