docs(reorg): reconcile the guidance list with the corrected failure model

The Guidance section still carried both claims the rest of the note had
already dropped: that every step before the commit point is safe to
re-enter, and that the phase marker was a mistake protecting an
impossible failure.

Rule 1 now asks which of atomic, compensatable, or recoverable applies
per store, because 'safe to re-enter' assumed each step either happens or
does not, and the shard-walking UTXO commit does not honour that.

Rule 2 keeps its point about mechanisms for impossible failures and drops
the example, which was not one: a checkpoint can retain a UTXO commit
whose undo record was lost with the journal, and a durable boundary is a
way to detect it.

Author: metaphorics

docs/solutions/architecture-patterns/node-reorg-execution-design.md

@@ -173,11 +173,17 @@ hash and height where it wedged.
 ## Guidance
 
 1. **Name the commit point before writing any of it.** Which single mutation
-   decides that the disconnect happened? Everything before it must be safe to
-   re-enter; everything after is cleanup.
-2. **Do not add a mechanism whose failure mode cannot occur.** The phase marker
-   here was that mistake — it protects boundaries in a store whose partial
-   states never persist.
+   decides that the disconnect happened? Everything after it is cleanup.
+   Everything before it must be atomic, compensatable, or recoverable, and you
+   must say which for each store. "Safe to re-enter" was the earlier wording and
+   it was wishful: it assumed each step either happens or does not, which the
+   shard-walking UTXO commit does not honour.
+2. **Do not add a mechanism whose failure mode cannot occur, and do not assume a
+   failure mode cannot occur because one store is in RAM.** The phase marker was
+   called a mistake on that reasoning. It is not settled: a checkpoint can
+   retain a UTXO commit whose undo record was lost with the journal, and a
+   durable boundary is one way to detect that. Decide it with the recovery
+   protocol.
 3. **A trait default that returns success is a silent-corruption path.** When a
    consumer must participate in rollback, make the default refuse. See
    `IndexError::UnsupportedRollback`.