The "candidate" chain is always as strong or stronger than the "confirmed" chain, and all download/validation/confirmation work takes place on headers/blocks in the candidate chain. A sparse in-memory header tree is maintained relative to the candidate chain and reorgs into the candidate chain when a strong branch is found. When the header chain is confirmed to a point stronger than the confirmed chain, it is reorganized into the confirmed chain. So there is header reorg (tree to candidate) and block reorg (candidate to confirmed).