diff --git a/src/app/api/providers/[id]/refresh-cursor/route.ts b/src/app/api/providers/[id]/refresh-cursor/route.ts
index a1c0b098d9..4859d3e9a8 100644
--- a/src/app/api/providers/[id]/refresh-cursor/route.ts
+++ b/src/app/api/providers/[id]/refresh-cursor/route.ts
@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getCachedProviderConnectionById } from "@/lib/localDb";
+import { getCachedProviderConnectionById } from "@/lib/db/readCache";
 import { updateProviderConnection } from "@/lib/db/providers";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { tryIdeAuth } from "@/lib/cursor/tokenExtractor";
diff --git a/src/lib/tokenHealthCheckCursor.ts b/src/lib/tokenHealthCheckCursor.ts
index ba9d799f72..beee152554 100644
--- a/src/lib/tokenHealthCheckCursor.ts
+++ b/src/lib/tokenHealthCheckCursor.ts
@@ -6,11 +6,12 @@
  *
  * Sibling to tokenHealthCheckCopilot.ts (same injection-to-avoid-circular-
  * import technique — tokenHealthCheck.ts-private helpers passed as params
- * rather than imported, and updateProviderConnection imported directly from
- * @/lib/localDb) but greenfield: type-checked normally, no @ts-nocheck.
+ * rather than imported) but greenfield: type-checked normally, no
+ * @ts-nocheck, and imports updateProviderConnection directly from its
+ * owning module rather than the localDb barrel (Hard Rule #2).
  */
 
-import { updateProviderConnection } from "@/lib/localDb";
+import { updateProviderConnection } from "@/lib/db/providers";
 import {
   renewCursorConnection,
   buildCursorRenewedUpdate,