Unwind in reverse, and never replay committed steps

Compensations run newest first. Later steps usually depend on earlier ones, so undoing in the order the work was done can fail for reasons that have nothing to do with the original fault.

def unwind(committed):
    for step in reversed(committed):
        run_compensation(step)

Once any step has committed, retrying the whole workflow from the top is not safe. The forward steps are not idempotent, so a replay re-applies work that already succeeded, and a second charge is a real consequence rather than a theoretical one.

Match the retry scope to the failure. Nothing committed means retry the step. Something committed means unwind to a known point and resume from there.