I'm 100% Confindent that ORDER_SAVE BADI is called at the one-order API layer. Most CRM BADI's for one-order are actually below the BOL level and you can usually tell that a BADI is above the the API layer if it contains UIU or is a "new-style" BADI as opposed to a "old-style" BADI.
The other comments about not doing BOL programming in the ORDER_SAVE BADI or in any one-order BADI are also correct. You would think someone would have written about some of this stuff already, oh well 
.
Take care,
Stephen