Module failed 

Transitions from Failed. Legal events:

• LocalRollbackCompleted — agent has executed rollback per manifest policy; drives Failed → Reverted. Single signed source of truth is the manifest; CP issued no signal (RFC-0005 §4.1).
• RemoteRollbackComplete — CP mirror sees the same; emits RemoteInsertQuarantine for the bad closure on the channel.

For halt-only policy, Failed is terminal — no rollback event arrives, operator action lifts it via a new signed manifest.

Functions

handle 🔒