Returns the complete first-run setup readiness state: whether provisioning has
completed, the declared backend token, whether the key-material
backend is bound, whether this platform can actually perform key operations, the
single server-computed setupState the console renders, the last
recorded self-test verdict AND the closed-vocabulary reason behind it, and the
operator-facing host activation command.

The verdict is the last one RECORDED in this process — written by the boot self-test, and re-written by POST /api/v3/admin/platform/setup/key-backend/test when an operator

runs one. This read never runs a round trip itself, so polling it costs the
backend nothing.

Three of these are closed enumerations and carry no free text, so a broken backend can be described without describing the backend: no Azure account URL, ARN, resource path, region, account id, credential-presence flag or vendor SDK message appears in any field of this response, in any state.

backendReDeclarationBlocked is the GATE and backendBound is the REPORT. They sit beside each other and

they are not interchangeable. The gate answers "would this server accept a
re-declaration or a withdrawal right now?", resolving every uncertainty — a
timeout, an unreachable backend, a contradicted bind, a corroboration read that
throws — to "still bound". The report withholds boundness on that same
uncertainty. Example 6 below is the divergence: backendBound is
false while backendReDeclarationBlocked is
true. A client that offers a backend selector or a withdrawal button

on backendBound offers both there and is answered
409.

backendBound and keyBackendRuntimeReady answer

different questions and are both needed. The first says a backend is bound; the
second says this instance is serving it AND its boot round trip did not fail. A
deployment can be bound and not runtime-ready — that is the post-bind restart
window, and it is also the state a placeholder credential produces.

Non-mutating; provisions nothing, contacts the backend only through a throttled read-only resolve, and never shells out to the host. ROOT-only (platform.bootstrap).