I let the update attempt go through again this evening now that I'm back from being on the road. After re-enabling updates on restart in developer options, and restarting as prompted, the update initially failed again, taking me back to the red no valid OS screen. So, that was twice in a row but with multiple days of separation in attempts. However, A/B partitions worked as intended after a few automatic restarts, the phone folded back, and the update was re-downloaded and re-installed. This time, it worked and my phone appears to be up to date now.
I'm fairly confident at this point that the way I broke my phone badly enough to require sideloading last time was by shutting down immediately after the A/B partition recovery, not giving the phone time to attempt applying the update again. Short of that specific sequence of events, the phone would probably survive to keep attempting the update until it takes. If you plug your phone in before going to bed and restart, you may not even notice that it takes multiple tries....
I tried using logcat to dump logs this time, before and after the update took. I don't really know what I'm looking at though. From "beginning of kernel" to "beginning of system" was very short on the failed reboot, but otherwise there doesn't seem to be anything of note. I could send the logs to a Graphene dev if anyone wants to see them. In reality, I'm guessing @chenxiaolong has probably already collected more info than I've got available. I did add a star to the Google issue here.