diff --git a/local/scripts/verify-tracked-sources.sh b/local/scripts/verify-tracked-sources.sh
index 5655cc7af5..8584ed7b82 100755
--- a/local/scripts/verify-tracked-sources.sh
+++ b/local/scripts/verify-tracked-sources.sh
@@ -244,8 +244,20 @@ redbear_is_firstparty() {
         dir="$(dirname "$dir")"
     done
     [ -f "$dir/recipe.toml" ] || return 1
+    # Fetchable origin keys.
     grep -qE '^[[:space:]]*(tar|git)[[:space:]]*=' "$dir/recipe.toml" && return 1
-    grep -qE 'upstream:[[:space:]]*http|https?://[^[:space:]]+\.(tar|git)' "$dir/recipe.toml" && return 1
+    # Provenance recorded in prose by a vendored fork. Case-INSENSITIVE and not
+    # restricted to .tar/.git URLs: brush writes
+    #     # Upstream: https://github.com/reubeno/brush
+    # which a case-sensitive `upstream:` + \.(tar|git) match missed on both
+    # counts, misfiling a genuine fork as first-party.
+    #
+    # Matched narrowly -- an explicit `upstream:`/`snapshot:` label followed by a
+    # URL -- NOT any bare URL in a comment. A stray bug-tracker link must never
+    # be read as provenance, because that error direction (first-party treated
+    # as vendored) is the one that loses irreplaceable work.
+    grep -qiE '^[[:space:]]*#?[[:space:]]*(upstream|snapshot|origin)[[:space:]]*:[[:space:]]*(https?://|[A-Za-z0-9_.-]+/)' \
+        "$dir/recipe.toml" && return 1
     return 0
 }