diff --git a/tools/export-github.sh b/tools/export-github.sh
index 7c4ca2a5..baf9c824 100755
--- a/tools/export-github.sh
+++ b/tools/export-github.sh
@@ -261,6 +261,31 @@ echo "bundle: $BUNDLE"
 # --- 6. optional per-instance dists (both bases: /ops = dev, /shopdb = prod) ---
 # Two instances run on the box; each needs its own base-path build. Always
 # rebuild BOTH so prod never ships a stale frontend.
+# --dist IS MAIN ONLY.
+#
+# These paths are not branch-qualified and cannot safely be: update-prod-server
+# .cmd robocopies frontend-dist-subpath-shopdb onto the production server with
+# /MIR, a full mirror, and has no idea which branch built it. So --dist from a
+# site branch would replace production's frontend with unreleased work at the
+# next deploy, silently, and the deploy script could not tell.
+#
+# Branch-qualifying the directory would leave the same trap for whoever pointed
+# a deploy at the wrong one. Production runs the product; a site branch has no
+# business producing the artefact production installs.
+if [ "$BUILD_DIST" = 1 ] && [ "$BRANCH" != "main" ]; then
+  echo "REFUSED: --dist on branch '$BRANCH'." >&2
+  echo >&2
+  echo "The dist directories are what update-prod-server.cmd mirrors onto the" >&2
+  echo "production server, and they are not branch-qualified. Building them" >&2
+  echo "from '$BRANCH' would put unreleased work on production at the next" >&2
+  echo "deploy, with nothing to reveal it." >&2
+  echo >&2
+  echo "Promote the commits to main and export from there:" >&2
+  echo "    tools/wj-status.sh" >&2
+  echo "    tools/promote-to-main.sh <sha> ..." >&2
+  exit 1
+fi
+
 if [ "$BUILD_DIST" = 1 ]; then
   cd "$WORK/frontend"
   for base in ops shopdb; do