(WIP) Immutable headnodes

This is probably worth looking at now; there's still some work to do, but it's roughly the shape I'm shooting for.
I think we want 'start' to mark the headnode frozen first, and /then/ power it on.  This way, if the commit fails, the headnode is still off---rather than having a headnode be on but unfrozen.