When ctx.States() provides verdicts, let them control the overall status; only fall back to deriving crit from FCrDNS failure count when no states are available.