tone

Health of the sigil, driving the status dot / status-text color. Only Protected earns the reserved green — a forged, active identity. Everything else stays neutral or error so the chip never signals "protected" while the sigil is absent, initializing, or failed (green-when-disconnected was a lie).