Termination failsafe

@thomasgubler This allows to make the failsafe (in both paths, force fail and IO's own failsafe detection) one-way - it can't be disabled once this flag is set once.

Compiles, not runtime tested.