diff --git a/.gitignore b/.gitignore
index 526192506f..84483ac12e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,14 +26,6 @@ recipes/**/source-old
 recipes/**/source.tar
 recipes/**/source.tar.tmp
 recipes/**/source.pre-preservation-test/
-# A `source.tar` is ALWAYS the downloaded tarball fetch-cache (verified against
-# recipe.toml's blake3), never durable code — unlike `source/` (the fork model).
-# The `recipes/**` rules above only match the mainline recipes/ tree, so
-# local/recipes/ tarball caches slipped through and got committed. They then went
-# stale on version bumps (Qt 6.11.0 tars shadowing 6.11.1 URLs -> blake3
-# mismatch, build failure). Ignoring the tarball (not source/) is safe.
-local/recipes/**/source.tar
-local/recipes/**/source.tar.tmp
 local/recipes/archives/uutils-tar/source
 local/recipes/dev/ninja-build/source
 
diff --git a/local/scripts/build-redbear.sh b/local/scripts/build-redbear.sh
index 0beff86b51..d0115aa0db 100755
--- a/local/scripts/build-redbear.sh
+++ b/local/scripts/build-redbear.sh
@@ -928,16 +928,20 @@ for pkg in $PRECOOK_PKGS; do
     if [ ! -f "$PROJECT_ROOT/repo/x86_64-unknown-redox/$pkg.pkgar" ]; then
         echo "    cooking $pkg..."
         log=$(mktemp)
-        # Pre-cook offline/upstream policy must match the main build phase:
-        # the previous hardcoded COOKBOOK_OFFLINE=false meant pre-cook could
-        # fetch packages the main phase refused to use, leaving the repo in
-        # an inconsistent state when ALLOW_UPSTREAM was not set.
-        case "${REDBEAR_ALLOW_UPSTREAM:-0}" in
-            1)
-                PRECOOK_OFFLINE=false ;;
-            *)
-                PRECOOK_OFFLINE=true ;;
-        esac
+        # Pre-cook offline/upstream policy must match the main build phase
+        # (see the `make live` dispatch below). The main phase goes online when
+        # EITHER the REDBEAR_ALLOW_UPSTREAM env var is 1 OR the --upstream flag
+        # (ALLOW_UPSTREAM=1) is passed; it goes offline in release mode. The
+        # pre-cook previously honored only REDBEAR_ALLOW_UPSTREAM, so a plain
+        # `--upstream` invocation left the pre-cook OFFLINE while the main phase
+        # was ONLINE — any package missing its source.tar cache (e.g. after a
+        # version bump) then failed the pre-cook with "Opening file for blake3
+        # failed ... source.tar: No such file". Honor ALLOW_UPSTREAM here too.
+        if [ "${REDBEAR_ALLOW_UPSTREAM:-0}" = "1" ] || [ "${ALLOW_UPSTREAM:-0}" -eq 1 ]; then
+            PRECOOK_OFFLINE=false
+        else
+            PRECOOK_OFFLINE=true
+        fi
         if [ -n "${REDBEAR_RELEASE:-}" ]; then
             PRECOOK_OFFLINE=true
         fi