diff --git a/.claude/skills/cli-toolbox_publish/SKILL.md b/.claude/skills/cli-toolbox_publish/SKILL.md
index 0a2df48..9ce1ad9 100644
--- a/.claude/skills/cli-toolbox_publish/SKILL.md
+++ b/.claude/skills/cli-toolbox_publish/SKILL.md
@@ -44,7 +44,6 @@ This will:
 - Update `crates/<tool>/Cargo.toml`
 - Run `cargo check -p <tool>`
 - Create a commit: `<tool>: bump version to <version>`
-- Create a tag: `<tool>-v<version>`
 
 ## Step 4: Push commits
 
@@ -53,7 +52,16 @@ Push all bump commits at once:
 git push
 ```
 
-## Step 5: Push tags ONE AT A TIME
+## Step 5: Create tags
+
+For each tool, create the tag locally:
+```bash
+git tag <tool>-v<version>
+```
+
+Tags must only be created on `main` after bump commits have been pushed (or merged via PR).
+
+## Step 6: Push tags ONE AT A TIME
 
 **This is the critical step.** Push each tag individually, not with `git push --tags`:
 
@@ -63,7 +71,7 @@ git push origin refs/tags/<tool>-v<version>
 
 Do this for each tool, one at a time. This ensures each tag triggers its own GitHub Actions workflow.
 
-## Step 6: Monitor pipelines
+## Step 7: Monitor pipelines
 
 After pushing all tags, monitor the release pipelines:
 1. Run `gh run list --limit <n>` to see all triggered runs
@@ -72,7 +80,7 @@ After pushing all tags, monitor the release pipelines:
 
 If a pipeline fails, show the failure details and ask the user how to proceed.
 
-## Step 7: Verify releases
+## Step 8: Verify releases
 
 For each tool, verify the GitHub Release was created with binaries:
 ```
@@ -81,7 +89,7 @@ gh release view <tool>-v<version>
 
 Report: tool name, version, assets (macos-arm64, linux-x86_64).
 
-## Step 8: Install locally (if --install)
+## Step 9: Install locally (if --install)
 
 If `--install` was requested, run:
 ```
diff --git a/CLAUDE.md b/CLAUDE.md
index e0b6b0e..e700158 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,6 +4,7 @@
 
 - Create a feature branch and open a draft PR for review. Do not commit directly to `main`.
 - **Before publishing a tool**, always check for uncommitted changes in its crate directory and commit them first. The bump script only commits the version change — any pending code changes will be left out of the tagged release.
+- **Version bumps go in PRs, tags go on main.** `scripts/bump.sh` updates the version and commits — safe to use on any branch. Tags (`<tool>-v<version>`) are created only on `main` after the PR merges, because tags trigger CI release builds. Never push tags from feature branches.
 
 ## Bugs and Issues
 
diff --git a/Cargo.lock b/Cargo.lock
index 98c8ac3..eecc55f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2035,7 +2035,7 @@ dependencies = [
 
 [[package]]
 name = "tb-devctl"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "chrono",
  "clap",
diff --git a/crates/tb-devctl/Cargo.toml b/crates/tb-devctl/Cargo.toml
index 959b0c2..3e89d54 100644
--- a/crates/tb-devctl/Cargo.toml
+++ b/crates/tb-devctl/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "tb-devctl"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 description = "Local dev environment orchestrator for Productive services"
 authors.workspace = true
diff --git a/crates/tb-devctl/src/commands/local.rs b/crates/tb-devctl/src/commands/local.rs
index d4447bd..96d4a99 100644
--- a/crates/tb-devctl/src/commands/local.rs
+++ b/crates/tb-devctl/src/commands/local.rs
@@ -129,7 +129,7 @@ pub fn start(
     if !svc.start.is_empty() {
         println!("{}", "Running setup steps...".blue());
         for step in &svc.start {
-            // git pull: skip if working tree is dirty
+            // git pull: skip if working tree is dirty or branch has no upstream
             if step.starts_with("git pull") {
                 let output = Command::new("git")
                     .args(["status", "--porcelain"])
@@ -139,6 +139,19 @@ pub fn start(
                     println!("  {} git pull (dirty working tree, skipping)", "!".yellow());
                     continue;
                 }
+
+                let upstream = Command::new("git")
+                    .args(["rev-parse", "--abbrev-ref", "@{upstream}"])
+                    .current_dir(&svc_dir)
+                    .stderr(std::process::Stdio::null())
+                    .output()?;
+                if !upstream.status.success() {
+                    println!(
+                        "  {} git pull (no upstream tracking, skipping)",
+                        "!".yellow()
+                    );
+                    continue;
+                }
             }
 
             // git restore: clean up generated files after migrations
diff --git a/scripts/bump.sh b/scripts/bump.sh
index e348924..239230d 100755
--- a/scripts/bump.sh
+++ b/scripts/bump.sh
@@ -6,7 +6,7 @@ VALID_TOOLS="tb-prod tb-sem tb-bug tb-lf tb-devctl tb-session"
 usage() {
   echo "Usage: $0 <tool> <version>"
   echo ""
-  echo "Bump a tool's version, commit, and create a tag."
+  echo "Bump a tool's version and commit. Tags are created during publish."
   echo ""
   echo "Tools: $VALID_TOOLS"
   echo "Example: $0 tb-prod 0.2.0"
@@ -51,13 +51,10 @@ rm -f "$cargo_toml.bak"
 echo "Running cargo check..."
 cargo check -p "$tool"
 
-# Commit and tag
+# Commit
 git add "$cargo_toml" Cargo.lock
 git commit -m "$tool: bump version to $version"
-git tag "$tool-v$version"
 
 echo ""
-echo "Done! Created commit and tag: $tool-v$version"
-echo ""
-echo "To release, run:"
-echo "  git push && git push --tags"
+echo "Done! Bumped $tool to $version."
+echo "Tag will be created when publishing (see publish skill)."