diff --git a/plugins/ultraplan-local/verify.sh b/plugins/ultraplan-local/verify.sh
index c96f8b1..f6db3c2 100755
--- a/plugins/ultraplan-local/verify.sh
+++ b/plugins/ultraplan-local/verify.sh
@@ -46,13 +46,35 @@ tracked_sources() {
     '*.md' '*.mjs' '*.json' '*.sh' '*.yml' '*.yaml' 2>/dev/null
 }
 
+# Per-file ultra/-local check. Special-cases .claude-plugin/plugin.json:
+# its homepage/repository URLs preserve the legacy "ultraplan-local" path
+# through Session 5 to avoid a 404 window during the Forgejo directory
+# rename. Session 5 will close this exception.
+#
+# SC2 uses a refined pattern that matches `/cmd-local` command suffixes
+# but NOT the `--local` CLI flag (legitimate `/trekresearch --local` mode).
+file_has_forbidden_match() {
+  local f="$1" pattern="$2"
+  local resolved="$pattern"
+  if [ "$pattern" = "-local" ]; then
+    resolved='/[a-zA-Z0-9_-]+-local'
+  fi
+  if [ "$f" = ".claude-plugin/plugin.json" ]; then
+    grep -E -- "$resolved" "$f" 2>/dev/null \
+      | grep -v -E '"(homepage|repository)":' \
+      | grep -q .
+    return $?
+  fi
+  grep -q -E -- "$resolved" "$f" 2>/dev/null
+}
+
 # ---------------- SC1: zero `ultra` references in tracked source files ----------------
 sc1_hits=""
 while IFS= read -r f; do
   [ -z "$f" ] && continue
   exclude_path "$f" && continue
   [ -f "$f" ] || continue
-  if grep -q 'ultra' "$f" 2>/dev/null; then
+  if file_has_forbidden_match "$f" "ultra"; then
     sc1_hits="${sc1_hits}${f}
 "
   fi
@@ -74,7 +96,7 @@ while IFS= read -r f; do
   [ -z "$f" ] && continue
   exclude_path "$f" && continue
   [ -f "$f" ] || continue
-  if grep -q -- '-local' "$f" 2>/dev/null; then
+  if file_has_forbidden_match "$f" "-local"; then
     sc2_hits="${sc2_hits}${f}
 "
   fi