diff --git a/cmd/tapir/processor.go b/cmd/tapir/processor.go
index dc5b483..c815262 100644
--- a/cmd/tapir/processor.go
+++ b/cmd/tapir/processor.go
@@ -137,6 +137,20 @@ func chatModels(cfg config.Config) []string {
 	return models
 }
 
+// uploadChatModels is the chat switcher for a PRIVATE uploaded recording: the same
+// ordered set as chatModels, local models only. The whole transcript (up to 90,000
+// characters) is sent to the one chosen, so a cloud model the video chat offers must not
+// be offered here; with none local, none is offered (ADR-035 review).
+func uploadChatModels(cfg config.Config) []string {
+	var local []string
+	for _, m := range chatModels(cfg) {
+		if config.IsLocalModel(m) {
+			local = append(local, m)
+		}
+	}
+	return local
+}
+
 // buildChat wires the per-video chat service (ADR-027): a Completer factory over
 // the SAME LiteLLM gateway the summarizer uses (a different alias per model, not a
 // second client config) and the same transcript-truncation budget. It returns nil