Returns the declared backend token, its non-secret per-provider coordinates,
whether a credential is sealed, the derived activationState and the
last recorded self-test verdict — the same five-member projection
PUT /backend/configuration answers with and
POST /backend/activate embeds. It is composed in one place and

rendered here unchanged, so a console that reloads sees exactly what the write
reported.

A deployment that was never configured answers 200 with activationState: NOT_CONFIGURED and null coordinates. That is an

ordinary state of this resource, not an error: a 404 here would force the console
to treat "not configured yet" — the state every first-run operator is in — as a
failure.

activationState is derived per request and stored

in no table. It is composed from the declaration, the credential presence, the last
self-test verdict and the immutable binding, each read once, so the word returned
is always internally consistent.

The credential is write-only and stays that way. This surface

says one thing about it — credentialPresent, a boolean. No value, no
mask, no prefix, no length, no fingerprint. lastSelfTest carries the
closed SelfTestReason vocabulary, so a failing backend can be
described without describing the backend: no ARN, Azure account URL, project path, region,
account id or vendor SDK message appears in any field, in any state.

Unlike the write, this read is not refused once the backend is

bound: reading changes nothing, and a bound deployment is the one whose
ACTIVE state the operator most needs to see. Non-mutating, unaudited,

contacts nothing. ROOT-only (platform.bootstrap).