diff --git a/.github/CI.md b/.github/CI.md
index 7cb984d1..05667f76 100644
--- a/.github/CI.md
+++ b/.github/CI.md
@@ -1,8 +1,8 @@
 # Pull request CI
 
 The local workflow `workflows/pr-build-test.yml` restores and builds the application and runs the
-existing regression suites on GitHub-hosted Windows 2025. Publication is separately authorized;
-these local definitions have not run on GitHub. Logs and test results are retained for seven days.
+existing regression suites on GitHub-hosted Windows 2025. The fork's PR #8 run passed on
+20 October 2026. Logs and test results are retained for seven days.
 Official checkout, setup-dotnet, and upload-artifact actions are pinned to immutable commit hashes.
 
 It uses only `pull_request`, `contents: read`, and checkout with persisted credentials disabled.
@@ -14,3 +14,22 @@ The engine console runner runs on both net48 and net10.0. The speed-test console
 net48 with local fixtures only, without --worker or --internet. They use dotnet run because they
 are executable regression suites. Isolated WPF checks are distinct from interactive UI automation.
 The build SDK is .NET 10; the application and desktop runner continue targeting net48.
+
+## Release-channel verification
+
+`workflows/release-sync.yml` checks the upstream publisher's GitHub release, Chocolatey and
+WinGet channels. Its `verify` job runs only in `SteveTheKiller/KillerScan`, for both scheduled
+and manual invocations. Development forks intentionally skip this job, even if they have
+their own releases: the configured marketplace identifiers belong to the upstream publisher.
+This does not disable `pr-build-test.yml` or change any publishing workflow.
+
+On 23 October 2026, investigation found eleven scheduled failures in the fork after the
+upstream sync: the fork has no published releases, so `/releases/latest` returned HTTP 404.
+The script previously continued to an empty release tag and obscured the original error.
+The job guard prevents the inapplicable fork check; failed release API calls now stop with
+an explicit metadata-fetch error. Missing releases in the publisher's repository remain failures.
+
+Validation: actionlint and PowerShell syntax checks, plus isolated release-lookup cases
+(latest, explicit version, API failure and invalid tag). The patched workflow must reach
+the fork's default branch before scheduled runs use the guard. Old failed runs remain in
+history; rerunning their old revisions does not test this fix. No package was published.
diff --git a/.github/workflows/release-sync.yml b/.github/workflows/release-sync.yml
index 98971f65..d60eaff1 100644
--- a/.github/workflows/release-sync.yml
+++ b/.github/workflows/release-sync.yml
@@ -16,6 +16,8 @@ permissions:
 
 jobs:
   verify:
+    # These package IDs belong to the upstream publisher, not development forks.
+    if: github.repository == 'SteveTheKiller/KillerScan'
     runs-on: ubuntu-latest
     env:
       APP_NAME: KillerScan
@@ -44,7 +46,9 @@ jobs:
           } else {
               "repos/$repository/releases/latest"
           }
-          $release = gh api $releasePath | ConvertFrom-Json
+          $releaseJson = gh api $releasePath
+          if ($LASTEXITCODE -ne 0) { throw "Could not fetch release metadata from $releasePath (gh exit $LASTEXITCODE)." }
+          $release = $releaseJson | ConvertFrom-Json
           $tag = [string]$release.tag_name
           $version = $tag -replace '^v', ''
           if ($version -notmatch '^\d+\.\d+\.\d+$') { throw "Invalid release tag: $tag" }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6dc546ca..1a7a7ad4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
 - Per-tab scan options for neighbor cache, explicit ARP, ICMP, TCP discovery, DNS, mDNS, SSDP, port scanning and individual HTTP/TLS/SSH/SNMP/NetBIOS fingerprints. Profiles save the choices; scan, quick and deep paths enforce them in the engine. CLI `/skip` and PowerShell `-Skip` provide the same choices. Existing profiles and API calls keep their defaults.
 
 ### Fixed
+- Release Sync skips development forks because the checked marketplace channels belong to the upstream publisher; release API failures report the metadata lookup error instead of an empty tag (23 October 2026).
 - The shortcuts card shows shadows at its edges when more content is out of view.
 
 ## [1.8.3] - 2026-10-19