private void markWantToFail(Node node, boolean wantToFail, String reason, Mutex lock) {
        if (node.status().wantToFail() != wantToFail) {
            node = wantToFail ?
                    node.withWantToFail(Agent.NodeFailer, clock().instant(), reason) :
                    node.with(node.status().withWantToFail(false));
            nodeRepository().nodes().write(node, lock);
        }
    }
Called when a node should be moved to the failed state: Do that if it seems safe,
which is when the node repo has available capacity to replace the node (and all its tenant nodes if host).
Otherwise, not replacing the node ensures (by Orchestrator check) that no further action will be taken.
node-repository/src/main/java/com/yahoo/vespa/hosted/provision/maintenance/NodeFailer.java