diff --git a/ci-requirements.md b/ci-requirements.md
index 4132406..b5d8db7 100644
--- a/ci-requirements.md
+++ b/ci-requirements.md
@@ -151,3 +151,35 @@ files behind; `CARGO_HOME` points somewhere writable for that user.
 **Don't infer formatting from existing code.** Several lines in `local/store.rs`
 exceed 100 characters and survive only because rustfmt cannot break a string
 literal — copying that shape caused one of the four failures.
+
+## Pushing: `dev` is both a branch and a tag
+
+`git push origin dev` fails in this repo:
+
+```
+error: src refspec dev matches more than one
+```
+
+The rolling update channel is a release on a **fixed tag named `dev`** (the tag
+never moves — Forgejo has no `/releases/latest/download/<asset>` route, so the
+updater needs a permanent URL). Once that tag is fetched locally, the short name
+`dev` resolves to both `refs/heads/dev` and `refs/tags/dev`. Fully qualify it:
+
+```
+git push origin refs/heads/dev:refs/heads/dev
+```
+
+## Shell scripts have no CI lane
+
+Nothing lints `desktop/packaging/*.sh`, and a broken installer or publish script
+fails at the moment a user runs it, not in a build. Check them before pushing —
+`install.sh` is POSIX sh, the rest are bash:
+
+```
+dash -n desktop/packaging/install.sh          # or: sh -n
+bash -n desktop/packaging/publish-release.sh
+```
+
+Where a script resolves URLs from the Forgejo API, exercise the resolution
+against the live instance (plain `curl` reads, no install) rather than trusting
+the regex by eye. Both channel paths in `install.sh` were verified that way.