Transaction failure should not leave the protocol in a faulty state