diff --git a/open-sse/config/constants.ts b/open-sse/config/constants.ts
index ab2d154c91..9b4aeaf720 100644
--- a/open-sse/config/constants.ts
+++ b/open-sse/config/constants.ts
@@ -163,6 +163,9 @@ export const PROVIDER_PROFILES = {
     circuitBreakerThreshold: 5, // More tolerant (occasional 502 is normal)
     circuitBreakerReset: 30000, // 30s reset
   },
+  // Local providers (localhost inference backends like Ollama, LM Studio, oMLX).
+  // Not yet wired into getProviderProfile() — will be used when local provider_nodes
+  // are integrated into the resilience layer. Kept here to avoid a second constants change.
   local: {
     transientCooldown: 2000, // 2s (local — very fast recovery)
     rateLimitCooldown: 5000, // 5s (local — no real rate limits)
diff --git a/open-sse/config/providerRegistry.ts b/open-sse/config/providerRegistry.ts
index 579b0b9787..1ba3995987 100644
--- a/open-sse/config/providerRegistry.ts
+++ b/open-sse/config/providerRegistry.ts
@@ -1044,6 +1044,7 @@ export function generateAliasMap(): Record<string, string> {
 
 // ── Local Provider Detection ──────────────────────────────────────────────
 
+// Evaluated once at module load time — process restart required for env var changes.
 const LOCAL_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",
diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index 451d145cbb..d4f6ead196 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -566,17 +566,15 @@ export async function markAccountUnavailable(
     if (!shouldFallback) return { shouldFallback: false, cooldownMs: 0 };
 
     // ── Local provider 404: model-only lockout, connection stays active ──
+    // Detection: URL-based only (apiKey===null heuristic was too broad — could match
+    // cloud providers with non-standard auth stored in providerSpecificData).
     const connBaseUrl = (conn?.providerSpecificData as Record<string, unknown>)?.baseUrl as
       | string
       | undefined;
-    const isLocal =
-      isLocalProvider(connBaseUrl) || (conn?.apiKey === null && conn?.accessToken === null);
 
-    if (isLocal && status === 404) {
+    if (isLocalProvider(connBaseUrl) && status === 404 && provider && model) {
       const localCooldown = COOLDOWN_MS.notFoundLocal;
-      if (provider && model) {
-        lockModel(provider, connectionId, model, "local_not_found", localCooldown);
-      }
+      lockModel(provider, connectionId, model, "local_not_found", localCooldown);
       log.info(
         "AUTH",
         `Local 404 for ${model} — model-only lockout ${localCooldown / 1000}s (connection stays active)`