@@ -140,7 +140,11 @@ Avoid repeating `/v1` in both URLs.
 programs that use the proxy (`programs.copilot`, `programs.vscode`). With
 `failClosed`, the default, the daemon leaves their managed entries as they
 are: the Copilot CLI and VS Code stay pointed at the loopback port, and those
-requests fail instead of reaching GitHub past the gateway. If the address could
+requests fail instead of reaching GitHub past the gateway. This needs entries
+to be in place: on a first apply without the proxy, or after the entries were
+removed by hand, nothing points at the loopback port, so VS Code on GitHub's
+models talks to GitHub directly and the Copilot CLI and VS Code on own models
+have no gateway models; the status says so. If the address could
 not be bound because another process holds it, that process receives those
 requests, with VS Code's Copilot tokens and the pairing value: use the default
 on devices with a single user, as for the proxy in general. With
@@ -348,7 +352,10 @@ startup stops the daemon from starting, as for the other programs). If the
 daemon's sidecar next to the file is gone, entries under the managed names
 that carry a pairing header are replaced on the next apply, and those that
 carry this daemon's own pairing value are removed when the program goes
-away; entries with another pairing value are left alone. The file is written owner-only. The
+away; entries with another pairing value are left alone. While the daemon runs
+without the proxy it has no pairing of its own, so any pairing value counts
+(only an agentdesktop daemon writes that header). The file is written
+owner-only. The
 daemon's sidecar next to it (`.providers.json.agentdesktop`, owner-only) keeps
 a copy of the file as last written, including the user's own providers and
 their `apiKey` values, until the next apply. Removing
@@ -432,7 +439,8 @@ resolved (and stops the daemon at startup, as for the other programs); an
 empty file is filled. If the daemon's sidecar next to the file is gone, an
 `agentdesktop` entry carrying a pairing header is replaced on the next apply,
 and one carrying this daemon's own pairing value is removed when the program
-goes away. Pass-through
+goes away (while the daemon runs without the proxy, one carrying any pairing
+value). Pass-through
 model keys are written as given, so a misspelt key reaches VS Code unchanged.
 The daemon's sidecar next to the file (`.chatLanguageModels.json.agentdesktop`,
 owner-only) keeps a copy of the file as last written, including the user's
@@ -672,7 +680,7 @@ device-wide state. The device page in the controller lists them under
 | `unchanged` | The program is configured and nothing needed to change. |
 | `removed` | The program is no longer configured and its managed content was removed. |
 | `conflict` | A managed file holds configuration the daemon will not overwrite; the detail names the file. |
-| `inactive` | The program uses the LLM gateway but the local LLM proxy is not running (see `llmProxy.error` in daemon-info): its entries were left pointing at the loopback port (`whenProxyUnavailable: failClosed`, the default) or removed (`failOpen`). |
+| `inactive` | The program uses the LLM gateway but the local LLM proxy is not running (see `llmProxy.error` in daemon-info): its entries were left pointing at the loopback port (`whenProxyUnavailable: failClosed`, the default; the detail says when no entries were in place, so the tool keeps its own settings) or removed (`failOpen`). |
 | `blocked` | The program had changes, but none were written because another program conflicted or failed; the detail names that program. |
 | `failed` | Planning or writing this program failed; the detail carries the error. |
 
 
@@ -108,18 +108,18 @@ pub(super) fn plan(
         return Ok(());
     };
     let Some((listen, pairing)) = proxy else {
-        if crate::reconcile::fail_closed_without_proxy(gateway, plan) {
+        if crate::reconcile::fail_closed_without_proxy(gateway, plan, || in_place(path, plan)) {
             tracing::debug!(
                 path = %path.display(),
-                "programs.copilot is configured but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the managed Copilot CLI providers are left as they are"
+                "programs.copilot is configured but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the Copilot CLI providers file is left as it is"
             );
             return Ok(());
         }
         tracing::debug!(
             path = %path.display(),
             "programs.copilot is configured but the local LLM proxy is not available, so the Copilot CLI is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); whenProxyUnavailable: failOpen, removing the managed Copilot CLI providers"
         );
-        plan.inactive(crate::reconcile::PROXY_ABSENT_REASON);
+        plan.inactive(crate::reconcile::FAIL_OPEN_REASON);
         remove(path, &state_path, None, plan)?;
         return Ok(());
     };
@@ -164,13 +164,40 @@ fn remove(
     plan: &ReconcilePlan,
 ) -> anyhow::Result<()> {
     if !json_merge::plan_remove_with(path, state_path, DESCRIPTION, DISPLAY_NAME, options(), plan)?
-        && let Some(pairing) = pairing
     {
         plan_remove_orphaned(path, pairing, plan)?;
     }
     Ok(())
 }
 
+/// Whether a provider under a managed name carries a pairing header: with
+/// `Some(value)` that value only; with `None` (the daemon runs without the
+/// proxy and has no pairing of its own) any value, since only an
+/// agentdesktop daemon writes that header.
+fn paired(provider: &Value, pairing: Option<&str>) -> bool {
+    let header = &provider["headers"][crate::llm_proxy::PAIRING_HEADER];
+    let name = provider["name"].as_str();
+    name.is_some_and(|name| name == PROVIDER_OPENAI || name == PROVIDER_ANTHROPIC)
+        && match pairing {
+            Some(pairing) => header == pairing,
+            None => !header.is_null(),
+        }
+}
+
+/// Whether the file holds a provider entry an agentdesktop daemon wrote (a
+/// managed name with a pairing header). A missing file is not in place; a
+/// file that cannot be read or parsed is logged and counts as not in place.
+fn in_place(path: &Path, plan: &ReconcilePlan) -> bool {
+    match read_object(path, plan) {
+        Ok(Some(current)) => providers(&current).any(|provider| paired(provider, None)),
+        Ok(None) => false,
+        Err(error) => {
+            warn!(error = %format!("{error:#}"), "reading the Copilot CLI providers file");
+            false
+        }
+    }
+}
+
 /// Before agentdesktop has written the file (no sidecar), an entry under a
 /// managed key is the user's: a provider with one of the managed names that
 /// carries no pairing header, or a model under a managed provider name whose
@@ -228,12 +255,17 @@ fn foreign_managed_entry(
 }
 
 /// Removal without a sidecar: entries under the managed names that carry
-/// this daemon's own pairing value were written for this daemon (before its
-/// sidecar was deleted), so they and the models under them are taken out by
-/// key; the file keeps its mode and is never deleted here. Entries with
-/// another pairing value, or none, are left alone, and a file that cannot be
-/// read is skipped with a warning rather than failing the whole apply.
-fn plan_remove_orphaned(path: &Path, pairing: &str, plan: &ReconcilePlan) -> anyhow::Result<()> {
+/// this daemon's pairing value (any pairing value while the daemon runs
+/// without the proxy and has none of its own) were written by an agentdesktop
+/// daemon, so they and the models under them are taken out by key; the file
+/// keeps its mode and is never deleted here. Entries with another pairing
+/// value, or none, are left alone, and a file that cannot be read is skipped
+/// with a warning rather than failing the whole apply.
+fn plan_remove_orphaned(
+    path: &Path,
+    pairing: Option<&str>,
+    plan: &ReconcilePlan,
+) -> anyhow::Result<()> {
     let current = match read_object(path, plan) {
         Ok(Some(current)) => current,
         Ok(None) => return Ok(()),
@@ -243,9 +275,8 @@ fn plan_remove_orphaned(path: &Path, pairing: &str, plan: &ReconcilePlan) -> any
         }
     };
     let orphaned: Vec<String> = providers(&current)
-        .filter(|provider| provider["headers"][crate::llm_proxy::PAIRING_HEADER] == pairing)
+        .filter(|provider| paired(provider, pairing))
         .filter_map(|provider| provider["name"].as_str().map(str::to_owned))
-        .filter(|name| name == PROVIDER_OPENAI || name == PROVIDER_ANTHROPIC)
         .collect();
     if orphaned.is_empty() {
         return Ok(());
 
@@ -1129,3 +1129,143 @@ fn config_rejects_a_non_object_entry_and_names_the_entry() {
         "{error:#}"
     );
 }
+
+// --- failClosed in place, failOpen reason, cleanup without a sidecar --------
+
+fn fail_open_gateway() -> LlmGatewayConfig {
+    let mut gateway = sample_gateway();
+    gateway.when_proxy_unavailable = ProxyUnavailable::FailOpen;
+    gateway
+}
+
+#[test]
+fn fail_closed_first_apply_reports_not_in_place() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("providers.json");
+    let config = sample_config();
+    let gateway = sample_gateway();
+
+    let changes = ReconcilePlan::default();
+    plan(&path, None, Some((&config, Some(&gateway))), &changes).unwrap();
+    assert_eq!(
+        changes.inactive_reason().as_deref(),
+        Some(crate::reconcile::FAIL_CLOSED_NOT_IN_PLACE_REASON)
+    );
+    changes.apply().unwrap();
+    assert!(
+        !path.exists(),
+        "nothing is written when nothing is in place"
+    );
+    assert!(!super::super::json_merge::state_path(&path).exists());
+}
+
+#[test]
+fn fail_open_reports_the_policy() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("providers.json");
+    let config = sample_config();
+    let gateway = fail_open_gateway();
+    apply_managed_with(&path, &config, &gateway);
+
+    let changes = ReconcilePlan::default();
+    plan(&path, None, Some((&config, Some(&gateway))), &changes).unwrap();
+    assert_eq!(
+        changes.inactive_reason().as_deref(),
+        Some(crate::reconcile::FAIL_OPEN_REASON)
+    );
+}
+
+fn apply_managed_with(path: &std::path::Path, config: &CopilotConfig, gateway: &LlmGatewayConfig) {
+    let changes = ReconcilePlan::default();
+    plan(
+        path,
+        Some((listen_addr(), PAIRING)),
+        Some((config, Some(gateway))),
+        &changes,
+    )
+    .unwrap();
+    assert!(!changes.has_conflicts(), "{}", changes.render());
+    changes.apply().unwrap();
+}
+
+/// A user-owned file with our entries applied, the sidecar gone and the mode
+/// loosened to 0640.
+fn paired_entries_without_a_sidecar(path: &std::path::Path, gateway: &LlmGatewayConfig) {
+    write_user_owned_document(path);
+    apply_managed_with(path, &sample_config(), gateway);
+    fs::remove_file(super::super::json_merge::state_path(path)).unwrap();
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        fs::set_permissions(path, fs::Permissions::from_mode(0o640)).unwrap();
+    }
+    assert_eq!(our_provider_count(&read(path)), 2);
+}
+
+fn assert_paired_entries_gone_user_entries_kept(path: &std::path::Path) {
+    let after = read(path);
+    assert_eq!(our_provider_count(&after), 0, "{after}");
+    assert!(
+        after["models"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .all(|m| m["provider"] == "my-own-openai"),
+        "{after}"
+    );
+    assert_user_entries_present(&after);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        assert_eq!(
+            fs::metadata(path).unwrap().permissions().mode() & 0o777,
+            0o640,
+            "the file keeps its mode"
+        );
+    }
+}
+
+#[test]
+fn fail_open_without_sidecar_removes_paired_entries_and_keeps_user_entries() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("providers.json");
+    let config = sample_config();
+    let gateway = fail_open_gateway();
+    paired_entries_without_a_sidecar(&path, &gateway);
+
+    // No proxy, so no pairing is known.
+    let changes = ReconcilePlan::default();
+    plan(&path, None, Some((&config, Some(&gateway))), &changes).unwrap();
+    changes.apply().unwrap();
+    assert_paired_entries_gone_user_entries_kept(&path);
+}
+
+#[test]
+fn removal_without_proxy_and_sidecar_removes_paired_entries() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("providers.json");
+    paired_entries_without_a_sidecar(&path, &sample_gateway());
+
+    let changes = ReconcilePlan::default();
+    plan(&path, None, None, &changes).unwrap();
+    changes.apply().unwrap();
+    assert_paired_entries_gone_user_entries_kept(&path);
+}
+
+#[test]
+fn known_pairing_keeps_entries_with_another_pairing() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("providers.json");
+    paired_entries_without_a_sidecar(&path, &sample_gateway());
+
+    let changes = ReconcilePlan::default();
+    plan(
+        &path,
+        Some((listen_addr(), "PAIRING-OTHER")),
+        None,
+        &changes,
+    )
+    .unwrap();
+    changes.apply().unwrap();
+    assert_eq!(our_provider_count(&read(&path)), 2);
+}
@@ -103,18 +103,18 @@ pub(super) fn plan(
         return Ok(());
     };
     let Some((listen, pairing)) = proxy else {
-        if crate::reconcile::fail_closed_without_proxy(gateway, plan) {
+        if crate::reconcile::fail_closed_without_proxy(gateway, plan, || in_place(path, plan)) {
             tracing::debug!(
                 path = %path.display(),
-                "programs.vscode is configured but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the managed chat language models are left as they are"
+                "programs.vscode is configured but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the chat language models file is left as it is"
             );
             return Ok(());
         }
         tracing::debug!(
             path = %path.display(),
             "programs.vscode is configured but the local LLM proxy is not available, so VS Code is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); whenProxyUnavailable: failOpen, removing the managed chat language models"
         );
-        plan.inactive(crate::reconcile::PROXY_ABSENT_REASON);
+        plan.inactive(crate::reconcile::FAIL_OPEN_REASON);
         remove(path, &state_path, None, plan)?;
         return Ok(());
     };
@@ -149,7 +149,7 @@ pub(super) fn plan(
 }
 
 /// Managed entries are removed through the sidecar when there is one, and by
-/// this daemon's pairing value when there is none.
+/// pairing value when there is none (any value when `pairing` is `None`).
 fn remove(
     path: &Path,
     state_path: &Path,
@@ -163,13 +163,29 @@ fn remove(
         VsCode::DISPLAY_NAME,
         options(),
         plan,
-    )? && let Some(pairing) = pairing
-    {
+    )? {
         plan_remove_orphaned(path, pairing, plan)?;
     }
     Ok(())
 }
 
+/// Whether the file holds the `agentdesktop` vendor entry an agentdesktop
+/// daemon wrote (a model with a pairing header). A missing file is not in
+/// place; a file that cannot be read or parsed is logged and counts as not
+/// in place.
+fn in_place(path: &Path, plan: &ReconcilePlan) -> bool {
+    match read_array(path, plan) {
+        Ok(Some(current)) => current.iter().any(|vendor| {
+            vendor["name"] == VsCodeConfig::VENDOR_NAME && carries_pairing(vendor, None)
+        }),
+        Ok(None) => false,
+        Err(error) => {
+            warn!(error = %format!("{error:#}"), "reading the VS Code chat language models file");
+            false
+        }
+    }
+}
+
 /// Whether a vendor entry carries the pairing header on one of its models,
 /// which only an agentdesktop daemon writes. With `Some(value)`, only that
 /// pairing value counts.
@@ -212,10 +228,15 @@ fn foreign_managed_entry(
 }
 
 /// Removal without a sidecar: the vendor entry named `agentdesktop` whose
-/// models carry this daemon's own pairing value was written for this daemon,
-/// so it is taken out; the file keeps its mode and is never deleted here. A
-/// file that cannot be read is skipped with a warning.
-fn plan_remove_orphaned(path: &Path, pairing: &str, plan: &ReconcilePlan) -> anyhow::Result<()> {
+/// models carry this daemon's pairing value (any pairing value while the
+/// daemon runs without the proxy and has none of its own) was written by an
+/// agentdesktop daemon, so it is taken out; the file keeps its mode and is
+/// never deleted here. A file that cannot be read is skipped with a warning.
+fn plan_remove_orphaned(
+    path: &Path,
+    pairing: Option<&str>,
+    plan: &ReconcilePlan,
+) -> anyhow::Result<()> {
     let current = match read_array(path, plan) {
         Ok(Some(current)) => current,
         Ok(None) => return Ok(()),
@@ -227,7 +248,7 @@ fn plan_remove_orphaned(path: &Path, pairing: &str, plan: &ReconcilePlan) -> any
     let remaining: Vec<Value> = current
         .iter()
         .filter(|vendor| {
-            !(vendor["name"] == VsCodeConfig::VENDOR_NAME && carries_pairing(vendor, Some(pairing)))
+            !(vendor["name"] == VsCodeConfig::VENDOR_NAME && carries_pairing(vendor, pairing))
         })
         .cloned()
         .collect();