diff --git a/tools/export-github.sh b/tools/export-github.sh
index 5c0bfadc..0a99e084 100755
--- a/tools/export-github.sh
+++ b/tools/export-github.sh
@@ -29,6 +29,22 @@ done
 [ -n "$MSG" ] || { echo "usage: $0 [--dist] \"commit message\""; exit 1; }
 [ -d "$PUB/.git" ] || { echo "publication repo missing at $PUB"; exit 1; }
 
+# --- 0. which branch is being published -------------------------------------
+#
+# This syncs the WORKING TREE, not a branch, and it used to commit whatever it
+# found onto the publication repo's main and print "git push origin main". So
+# running it while checked out on a site branch published that site's work AS
+# THE PRODUCT, to the repository every other site consumes, without saying a
+# word about it.
+#
+# The publication repo now mirrors the branch you are actually on.
+BRANCH="$(git -C "$WORK" rev-parse --abbrev-ref HEAD)"
+if [ "$BRANCH" = "HEAD" ]; then
+  echo "detached HEAD in $WORK - check out a branch before exporting" >&2
+  exit 1
+fi
+echo "==> publishing branch: $BRANCH"
+
 # --- 1. sync the tree (working -> pub), minus everything never published ---
 #
 # NOTE the deploy/windows/installer/bundle exclude below. That is ~100MB of build
@@ -141,6 +157,19 @@ fi
 
 cd "$PUB"
 
+# Mirror the branch. The rsync above has already overwritten the tree, so this
+# has to happen with the working tree ignored - checkout would otherwise refuse
+# or clobber. --force is safe here precisely because the tree is a mirror: it
+# holds nothing that is not about to be replaced from $WORK.
+if git show-ref --verify --quiet "refs/heads/$BRANCH"; then
+  git checkout --force "$BRANCH" >/dev/null
+else
+  # A new site branch starts from main, the same way it does in the dev repo,
+  # so its history is the product's history plus whatever it adds.
+  echo "==> publication repo: creating branch $BRANCH from main"
+  git checkout --force -b "$BRANCH" main >/dev/null
+fi
+
 # --- 2. re-apply the publication wording (idempotent) ---
 # docs/ lives only in the wiki on the GitHub side.
 # NOTE the `|| true` on each scrub grep below. grep exits 1 when it matches
@@ -205,7 +234,8 @@ fi
 git log --oneline -3
 
 # --- 5. bundle for transfer (full bundle: stateless, fetch takes only new) ---
-git bundle create "$OUT/shopdb-flask-pub.bundle" HEAD main --tags
+# Carries the branch that was published, not a hardcoded main.
+git bundle create "$OUT/shopdb-flask-pub.bundle" HEAD "$BRANCH" --tags
 git bundle verify "$OUT/shopdb-flask-pub.bundle" >/dev/null
 echo "bundle: $OUT/shopdb-flask-pub.bundle"
 
@@ -222,10 +252,22 @@ if [ "$BUILD_DIST" = 1 ]; then
   done
 fi
 
-cat <<'EOF'
+cat <<EOF
 
 On the work PC (in the shopdb-flask-pub clone):
-  git fetch <path-to>\shopdb-flask-pub.bundle main
+  git checkout $BRANCH
+  git fetch <path-to>\shopdb-flask-pub.bundle $BRANCH
   git merge --ff-only FETCH_HEAD
-  git push origin main
+  git push origin $BRANCH
 EOF
+
+if [ "$BRANCH" != "main" ]; then
+  cat <<EOF
+
+NOTE: this published $BRANCH, not main. Other sites read main, so nothing here
+reaches them until these commits are promoted:
+
+  tools/wj-status.sh
+  tools/promote-to-main.sh <sha> ...
+EOF
+fi