Backend bound (ACTIVE), or an idempotent no-op when it already was.

The backend is not in a bindable state.

The declared backend is not admissible on this deployment (§165): the operator allowlist, the deployment key-protection policy, or the tenant's entitlement does not admit it. The body is identical for every refused backend and names none of them.

The wrap/unwrap self-test did not round-trip; the state reverts to DECLARED_PENDING_BIND.