changeset(automation): name the pre-existing phantom this guard makes visible

The changeset is what reaches release notes, and the operator-facing
consequence was only in the PR body. It now says that a run that COMPLETED is
journalled and reported stranded when its completed history row throws, that
repairing such a run re-runs the flow, that the phantom and its double run were
measurable before this change rather than created by it, and that it is filed
as #15944.

Text only. engine.ts is byte-identical at blob e6fa6ff, and no pin, ablation
leg or source line moves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Author: os-warren

.changeset/strand-verdict-survives-bookkeeping-throw.md

@@ -12,4 +12,6 @@ The window is now guarded. The bookkeeping may still fail — and says so loudly
 
 The guard opens **after** the journal, so only a run that demonstrably has a snapshot can reach the stamp: a throw from the journal itself still propagates, every exit above the consumption point still carries no status at all, and cascade-failed ancestors — which journal nothing — are untouched and still correctly non-repairable.
 
+⚠️ This change also makes a pre-existing fault **visible** rather than creating it. The completion path's history write sits inside the same `try` as the node-failure arm, so a run that **completed** — every node succeeded — is journalled and reported `stranded` when its `completed` history row throws, and repairing such a run **re-runs the flow**. That phantom, its repair snapshot and the double run were all measurable before this change; what changes here is only that more store failures now report the verdict instead of throwing over it, so an operator can now be told to repair a completed run. Filed as #15944, with the measurement on both trees.
+
 ⚠️ `repairable` remains a point-in-time fact, and this change does not make it durable: the run in the case above has no terminal history row (that write is what failed), so the repair rides on the in-memory journal and a restart loses it. The verdict reports what an operator can do now, which is exactly what was being denied.