Lifecycle

Derived deterministically; BLOCKED wins over everything except UNINITIALIZED; COMPLETE requires a fresh PASS plus a completed ACKit task.

status is read-only and never writes.