There should be a configuration option which determines after how many SITE-UNREACHABLE events (combined with a timeout), a site is declared as offline. (The count should be reset when there is a successful RPC to the remote site).

Once a site is taken offline, then no RPCs would be sent to it, until it is taken online again (manually, by a sysadmin), and the state transfer has completed.