This looks like a bug in the autocommit. I would have expected that the autocommit would have triggered the before commit event on order. Now it looks like it is autocommitting without events...
It is try that auto-committed objects are found in the database. The retrieve from database doesn't do anything with memory objects, it simply selects all objects in the database table.
The reason for having 'auto-committed' objects is to insert data into the database, to keep relationships consistent. Therefore every database retrieve will find auto-commited objects, and your retrieve action will not know the difference between auto-commit and regular committed objects.
When an object is auto-committed it will not trigger the commit object events nor domain model validation rules, this has always been the behavior since the concept of auto-commit was introduced.
The reason why this might have worked in Mx4, is because the Mx5 releases have some significant differences in how (commit) actions and other microflows worked with transactions, there are also some minor differences in auto commit behavior but nothing significant.
My guess would be that the behavior in Mx4 and 5 regarding auto committed objects is the same, but because of the way transactions were handled in 4 your microflow could never find the auto committed object because it was still part of another active transaction.
I recently wrote a documentation page explaining what happens during the different events. In the explanation of the commit it also explains when and how auto committed objects are stored.
I'm still planning on writing a more extensive piece about auto-committed objects, how to improve, detect and prevent them. But I still need to start on that.
To add to the point of Ronald if this were a bug or not, I don't think so. But I do think that the platform could handle this much smarter than it is currently doing, and should be able to provide you with better insight and assistance.
I think this is because the retrieve action will also check the memory. In your retrieve action, could you try to say: [ID != $InputParameter] ....(The $inputParameter represents the order that you don't want to retrieve)