Simulation.set_jet_amplitude validated before upload and committed host state after it, but after an uncertain device write nothing stopped reuse. Record the failure in Simulation._failed and refuse every public device call except close() (FixedPatchStepper already uses status 'failed'). Invalid input stays side-effect free and retryable. Adds host fault tests for both owners and states the rule in docs/lifecycle.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>