@@ -587,6 +587,43 @@ stage.
 
 ![Agentdesktop controller device inventory](images/controller-ui.png)
 
+### Configuration status
+
+Each apply reports the outcome for every managed program, next to the
+device-wide state. The device page in the controller lists them under
+"Managed programs" (`GET /api/v1/devices/{id}` returns them as `programs`):
+
+| State | Meaning |
+| --- | --- |
+| `applied` | The program is configured and its files were changed. |
+| `unchanged` | The program is configured and nothing needed to change. |
+| `removed` | The program is no longer configured and its managed content was removed. |
+| `conflict` | A managed file holds configuration the daemon will not overwrite; the detail names the file. |
+| `inactive` | The program uses the LLM gateway but the local LLM proxy is not running (see `llmProxy.error` in daemon-info), so its files point nowhere and were removed. |
+| `blocked` | The program had changes, but none were written because another program conflicted or failed; the detail names that program. |
+| `failed` | Planning or writing this program failed; the detail carries the error. |
+
+When several apply, the first in the list `failed`, `conflict`, `blocked`,
+`inactive`, `applied`/`removed`, `unchanged` is shown. An apply is all or
+nothing across programs: one conflict or failure means no file is written for
+any program, which is what `blocked` makes visible. Programs that are not
+configured and have nothing to clean up, and discovery-only tools, are not
+listed. After each apply the daemon logs one `program configuration outcome`
+line (`program`, `state`, `detail`) per program that is not `applied` or
+`unchanged`. A daemon restart reports again, because the controller re-sends
+the configuration on every connection; the files are already written by the
+startup apply of the saved configuration at that point, so the report after a
+restart usually says `unchanged` (the startup apply's outcome lines for programs
+that are not `applied` or `unchanged` are in the daemon log). If the controller
+rejects a report (an agent outside the reporting limits), it keeps the device
+status and the last accepted program rows; rows from an earlier revision show
+that revision on the device page. Agents and controllers can be upgraded
+in either order: an older agent shows as "Per-program status is not reported
+by this agent version", and an older controller ignores the new fields. The
+controller's database migration is one-way: once this controller has run, an
+older controller refuses the same database, so roll back from a database
+backup taken before the upgrade.
+
 ## Core capabilities
 
 - **AI tool discovery:** detect supported developer tools and their versions
 
@@ -430,9 +430,9 @@ where
                 .context("preview daemon configuration")?;
         } else {
             validate_one_shot(&config)?;
-            reconciler
-                .apply(&config)
-                .context("apply daemon configuration")?;
+            let (report, applied) = reconciler.apply_with_report(&config);
+            report.log();
+            applied.context("apply daemon configuration")?;
             println!("Reconciliation complete.");
         }
         return Ok(());
@@ -480,9 +480,10 @@ where
         Some(local_config)
     };
     if let Some(initial_config) = initial_config {
-        reconciler
-            .apply(&initial_config)
-            .context("apply initial daemon configuration")?;
+        // The outcomes are logged before a failure stops the daemon.
+        let (report, applied) = reconciler.apply_with_report(&initial_config);
+        report.log();
+        applied.context("apply initial daemon configuration")?;
         // With a controller, the cached controller configuration is what is in effect
         // from here, and start_gateway_authentication above only saw the local file.
         // Without one the two are the same configuration and it already ran.
@@ -607,7 +608,7 @@ fn attach_llm_proxy_pairing(
 /// failure is logged and reported as `bound: false` rather than propagated:
 /// the proxy is optional, the rest of the daemon is not.
 ///
-/// Invariant for callers: this runs before the initial `reconciler.apply`, so a
+/// Invariant for callers: this runs before the initial apply, so a
 /// reconciler that writes the proxy address into a client file must take the
 /// address from this result and must not write it when `bound` is false. The
 /// accept loop starts later, after discovery; connections in between queue in
 
@@ -3411,13 +3411,16 @@ mod tests {
             let key = format!("vscode-copilot\u{0}http://{address}/\u{0}agentgateway");
             // Inserted directly (bypassing `insert`'s expiry-margin floor,
             // which would otherwise refuse to cache anything this close to
-            // expiry) so the tunnel has time to open before the deadline.
+            // expiry). The cache reuses the entry for a minute, so the
+            // request always gets it however slowly it arrives; the
+            // credential itself expires in 300 ms, and that is the deadline
+            // the tunnel must close at.
             cache.entries.lock().unwrap().insert(
                 key,
                 CachedCredential {
                     credential: "short-lived".to_owned(),
                     device_id: "device-test".to_owned(),
-                    valid_until: std::time::Instant::now() + Duration::from_millis(300),
+                    valid_until: std::time::Instant::now() + Duration::from_secs(60),
                     valid_until_unix: now_unix() + 60,
                     expires: std::time::Instant::now() + Duration::from_millis(300),
                     expires_unix: now_unix() + 60,
 
@@ -70,6 +70,10 @@ impl ClaudeCode {
 
 #[async_trait::async_trait]
 impl Provider for ClaudeCode {
+    fn id(&self) -> &'static str {
+        Self::ID
+    }
+
     async fn discover(&self) -> Discovery {
         Discovery {
             agents: discovery::discover(&self.settings_path)
 
@@ -31,6 +31,10 @@ impl ClaudeDesktop {
 
 #[async_trait::async_trait]
 impl Provider for ClaudeDesktop {
+    fn id(&self) -> &'static str {
+        Self::ID
+    }
+
     async fn discover(&self) -> Discovery {
         Discovery {
             agents: discovery::discover(&self.managed_settings_path)
 
@@ -29,6 +29,10 @@ impl Codex {
 
 #[async_trait::async_trait]
 impl Provider for Codex {
+    fn id(&self) -> &'static str {
+        Self::ID
+    }
+
     async fn discover(&self) -> Discovery {
         Discovery {
             agents: discovery::discover().into_iter().collect(),
 
@@ -40,6 +40,10 @@ pub fn default_copilot_providers_path() -> anyhow::Result<PathBuf> {
 
 #[async_trait::async_trait]
 impl Provider for Copilot {
+    fn id(&self) -> &'static str {
+        Self::ID
+    }
+
     async fn discover(&self) -> Discovery {
         Discovery {
             agents: discovery::discover().into_iter().collect(),
 
@@ -112,6 +112,7 @@ pub(super) fn plan(
             path = %path.display(),
             "programs.copilot is configured but the local LLM proxy is not available, so the Copilot CLI is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); removing the managed Copilot CLI providers"
         );
+        plan.inactive(crate::reconcile::PROXY_ABSENT_REASON);
         remove(path, &state_path, None, plan)?;
         return Ok(());
     };
 
@@ -13,6 +13,10 @@ impl Cursor {
 
 #[async_trait::async_trait]
 impl Provider for Cursor {
+    fn id(&self) -> &'static str {
+        Self::ID
+    }
+
     async fn discover(&self) -> Discovery {
         Discovery {
             agents: discovery::discover().into_iter().collect(),
 
@@ -29,6 +29,10 @@ impl Grok {
 
 #[async_trait::async_trait]
 impl Provider for Grok {
+    fn id(&self) -> &'static str {
+        Self::ID
+    }
+
     async fn discover(&self) -> Discovery {
         Discovery {
             agents: discovery::discover().into_iter().collect(),