The one authoritative standing state for a principal (spec D2).Five states plus absence. Absence is not a variant — a principal with no standing row is
denied structurally (spec §7 obligation 1), which is what makes D7's connection-profile safety
hold by construction rather than by a check someone can forget.