Fix failing test case.

In tesla_update_state, tweak the logic a little bit:
 * don't set the 'failure' flag unless the instance's mask matches the pattern's
 * take the 'update' route if the instance's key mask is a subset of the search key's, not the masked-by-transition-mask 'pattern'
 * do clone+update atomically