private static FailingNode shouldFail(Node fresh, FailingNode stale) {
        // Now that we have gotten the node object under the proper lock, sanity-check it still makes sense to fail
        if (!Objects.equals(stale.node.allocation().map(Allocation::owner), fresh.allocation().map(Allocation::owner)))
            return null;
        if (fresh.state() == Node.State.failed)
            return null;
        if (!Objects.equals(stale.node.state(), fresh.state()))
            return null;
        return new FailingNode(fresh, stale.reason);
    }
Called when a node should be moved to the failed state: Do that if it seems safe,
which is when the node repo has available capacity to replace the node (and all its tenant nodes if host).
Otherwise, not replacing the node ensures (by Orchestrator check) that no further action will be taken.
node-repository/src/main/java/com/yahoo/vespa/hosted/provision/maintenance/NodeFailer.java