docs/tests: state the S3a commit point; cover a failed hold-record upload

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/moving_bodies.md

@@ -374,9 +374,13 @@ recorded as not runnable rather than replaced by another test.
   `MovingCircleLinks` (`u_w = u + omega x r` at the hit point) → static curved →
   `OneStep` → swap → force region → sensors → synchronize → read `no_donor` →
   commit (`applied := pending.offset`) → upload the hold record
-  (`c_old = c_new = applied`, `u = 0`). Hold steps launch no M1 and are the
-  S2a path. Any failure from the upload on marks the circles and the
-  Simulation failed; nothing is committed.
+  (`c_old = c_new = applied`, `u = 0`) → synchronize. Hold steps launch no M1
+  and are the S2a path. Commit point: the advancing step-group sync plus a
+  zero `no_donor` count; a failure before it commits nothing. The hold-record
+  upload stages the next step after the commit: if it (or its sync) fails,
+  `applied` already matches the moved device geometry, but the Simulation is
+  still marked failed and refuses reuse. Any failure from the first upload on
+  marks the circles and the Simulation failed.
 - M1 classifies with the old/new predicates only (no flag reads). Covered
   cells add raw `sum c G` / `sum G` of `G^{n-1}` to `cover_*` and become
   `SOLID|OBSTACLE|BC_CURVED`. Uncovered cells: donors are fluid in both