diff --git a/.gitattributes b/.gitattributes
index c12806f..fe1a4b9 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -7,3 +7,7 @@
 # The checksum manifest must stay LF: `sha256sum -c` treats a trailing CR as
 # part of the filename and reports every entry as missing.
 CHECKSUMS.txt text eol=lf
+releases/*.sha256 text eol=lf
+
+# Release zips are binary and immutable.
+releases/*.zip binary
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb9357c..fa35f39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,17 @@ Notable changes to the Evomedia.net Token Savers.
   credentials and RSA signing keys.
 
 ### Added
+- **Versioned releases: `zversion`, `zrelease`, `releases/`** — the toolkit now
+  carries one version in the SmartPlant 5-segment scheme,
+  `v{major}.{rc}.{beta}.{alpha}.{build}`. `zversion bump` (one per PR / defect
+  fix) and `zversion bump-stage release|rc|beta|alpha` (zeroes every lower
+  segment) rewrite `build-version.json`, stamp `# Version:` into every script
+  header — so a lone copied script still says which release it came from — and
+  regenerate `CHECKSUMS.txt` in the same step. `zrelease` packages the current
+  version as `releases/zscripts-<version>.zip` with a `.sha256` beside it: one
+  hash verifies the download, the bundled `CHECKSUMS.txt` verifies the
+  extracted contents, so nobody needs to clone the repo to get a verifiable
+  copy. Released zips are immutable — `zrelease` refuses to overwrite one.
 - **`zchecksums` + `CHECKSUMS.txt`** — a SHA-256 manifest covering every `.ps1`
   and `.cmd`, so a download can be verified before anything is run. `zchecksums`
   checks them; `zchecksums -Update` regenerates after an intentional edit. The
diff --git a/CHECKSUMS.txt b/CHECKSUMS.txt
index ef7fca8..cc7c9cd 100644
--- a/CHECKSUMS.txt
+++ b/CHECKSUMS.txt
@@ -1,38 +1,42 @@
-b3452601fafaf1799be9286c41bc9badd95aad7fe45093d3239c968f4ee16e75  setup_backup_schedule.ps1
-dd39a7be920e5e9b2e99aafcc598491413b89bc902c2efd99ac9464d18f24ee1  token-count.ps1
-d05ef5941a97911781d638a0a209b10affe777b1021f89071c5414471bf6b097  zbackup.cmd
-90f05dc2db328d6a8797c6d3dfc0b9cb9e1c068de7180826928bae94deda2e77  zbackup.ps1
-1fa2a6587f4d3a0b3cc0a2b2c265e1b520c7b7caf21e6cd9e110794e803375fa  zbackup_and_sync.ps1
-dc6f31069607a7f60cd45399a27a88abe01695879f0b2d9272537d63b0a71d99  zbackup_ec2.cmd
-5a88b72c1e15036346e9fe8e48ba83acb6465acdb35b7d94239f03263e095ccc  zbackup_ec2.ps1
-c6f8da4b90d5531f245b7c55f6b4acb7e69edcc1fa2c966bc52aa8bc4f23417f  zchecksums.cmd
-94a96f879db64ac5f2e9f1e991c9a4a506fade5d538e3c0c7c4588124595659e  zchecksums.ps1
-b2c9a2f0205768e7b301c152b1f4cf042962125d4e982812befc2e536c0f7c6b  zdeploy.cmd
-30bc24780b2c6772f57232eee077b3295892afbb8f8298091b11e815d8a07b23  zdeploy.ps1
-9b2702ac57115c2cd6df1f0ad33b0f8b4fd73a54dcd99475b9cacb1070a235d5  zec2.cmd
-69696d75c1430ef0afe773880b962f08316c5ced4a118fe8abd71171c7e9359b  zec2.ps1
-2fbd24b329f90a1b6982e3f4b8fc9068fc99e900fe718eb9ff2af7c6a98dfb4f  zec2_rotatekeys.cmd
-a0016e48c3b4b9b1f7e800315bbef7d2b2ca3267bf51a0ce31e41a28cb74b71b  zec2_rotatekeys.ps1
-60e7ab58ca786b1a075ac268e4c2f8454bfcff47ed077cd0219f74c8d0eeaf78  zec2online.cmd
-0177d8fbb6fba66a82fdde437ed9e7d43f3ef1e2227a418e9783380c549066cf  zec2online.ps1
-77060d8e30cc43ce9114c58e9f2f2f76d647e3237a3357299ca1820131128636  ZHelpers.ps1
-79074a4dbd4d9fa0388cdac6ce0543a72d2b09c4779750d453c7566e500868ab  zkill.cmd
-d9ca58bf5baf8be8eb90fb8d414f55cd33deee35ea063dc4df7d9c9d4ed0e72c  zkill.ps1
-d419dd7d407ac19b0ca83a54b622399c2343d63bfe53c1ff05e7b5b15c0c7a0f  ZKiller.ps1
-ba9b2204945b19b912420290361191661a80887ecfd5d2c31d32b0686382e9a0  ZKillOnly.ps1
-462ccd1d8a8600a76885a8a62a11ba64e3123bc273815ee1c7197d2bca48d7bf  zrepair.cmd
-e16f4971d58ccaa9a9b0de1dedc0eb0acc126d195628831e186f2855e7895d0d  zrepair.ps1
-eaa25fce9a0564df24378bedfed0815eb24c4faf9a16fdd490dafe22bcf81f4b  zrestart.cmd
-c1909e96e158a24f17a52053f3faeacbcbd366011bbcb1bd8a4c83d381f0355b  zrestart.ps1
-ec2161b28bd9ab89fe7212a153fb948a29de6ef987b7d794ee3f8c605fd60cc6  zrestartd.cmd
-48debde34be2910de9c084b155894e502f0b9447314564a6c12ffd64973c4d91  zsetup.cmd
-5ec860041f07487b3322d47a874daad93dc67b1dd009204201956f3137c34205  zsetup.ps1
-b5d61fc4105fefb738653f5dfd3440d6c9126c63925e42a2d0ba2adc26afdbbc  zsetup_mail.ps1
-08b943c5eb9d085274a56179f7bcb56740aefd0cfb166d45cfc65d0e6cf8ec31  zstart.cmd
-e54c85132f99c6a435091758e9bbda3399a1a6833bf6ab9962362b8de62fb46b  zstart.ps1
-d416fc6b781e3f130de79791c54d10b74402de0eca8582b0efcb91e4252b0d30  zstart_docker.cmd
-77d498086653961c4b6febffaad889652224d46a47473273aa40acfca4916ba7  zstart_docker.ps1
-0edc7c975dfbe3cb9cd6c3c63e3e43b3b49e92a89e317283acd31a29d04d3239  zstartd.cmd
-09aa986839f3a969c06ca1300365b2eb5ae0da49b27275aa1cfb9c2cf00517bf  zstop.ps1
-7102ec4d459c663aeb571fa2527c069ab0d82a038e4d1ed115d107506226aa14  zsync.cmd
-4e40a178eda57e986bd050f95d98ea15aa1197a9edde8df64a468c4b2948d89f  zsync.ps1
+90e4105107d27a44ee7199e459f86941013d5e29d2a7a53882d48347e05b1530  setup_backup_schedule.ps1
+00ea2054ca36dd84133aaaa381437d39374407b1fcd33caecbdea09b4967247f  token-count.ps1
+4903f0194fe749269bb61ffacace6e957ce44503522d625560dcc882b69f91b4  zbackup.cmd
+7d8446fc5f04ec1d0f695b6390db5bbfb86f410f6d8aac14720fd3aa4bfa3525  zbackup.ps1
+8b375c8a759e37b812293ae168dcf19ae1ca0c136c9d3f2d7ae90a84c1e26f3f  zbackup_and_sync.ps1
+c336a61cb8563736bd6550671d7dc90b14702a43f25a97b1ac15ffd64605fbf6  zbackup_ec2.cmd
+47ccde67ba8502997105c995e509c1ed1016ffac264df60c6ac539a5b99eda08  zbackup_ec2.ps1
+20e6282901a919aa32ea717c739ba2dc9657426dff860f0e5fce201edefd99da  zchecksums.cmd
+692b7b0ff9e51e5d9b880358b33c54d2db4f967297a5350e154df1ce6f06ebc6  zchecksums.ps1
+b56085112e7c573926a70a58872163b71416d58ce91ea7114b1f5de5fc96c982  zdeploy.cmd
+8f52b2114c8d84e397b7a4f4e1f45ea7201c59fe3e1b4147fa08ad26d0325035  zdeploy.ps1
+fa817d3bd7bba98b03b411d3c5a82b210d3cca316ac0c9785afa5b4ac5fe0766  zec2.cmd
+5f70432af23df3459a98d9ad6a0da723783f2269dd5f5ab8ecdd6366ebc84942  zec2.ps1
+4df94eda29b6f5b2cb6bfa63e0add4d90ea24d936305f36a69988e8dd5d69154  zec2_rotatekeys.cmd
+cc980bec4a9205a774c05ee1a7e0473e604adf5370b548015a5cb47412dd5853  zec2_rotatekeys.ps1
+fae88c3d77efaef1a60d8d74bd0ca880ca67f85a2ab302fd182dfeb33e9465ce  zec2online.cmd
+daf58f09cf118128c69282d51bbcece71cdeb1ce423737f6583ed00be460d98f  zec2online.ps1
+2cb21bc7c18ab18e05403b10ca6316b334215ecf359796d53e1b3fe295ac88f2  ZHelpers.ps1
+bace82f5efc0cf63f260ccd5e134032029b70fe633900d3a6345f7eb079c121e  zkill.cmd
+443af456a5ababda04d882abf28f18079473708a90249c7294d03f8120db60f6  zkill.ps1
+0e95bebabe8e56894c19519b38f57544bfb6903a3fe2f093fb7bf592c68b86da  ZKiller.ps1
+957784b0261010baec0966319fddf887171b7835770cd0d4f55fb0c58ee70db2  ZKillOnly.ps1
+70330253df23a140ca4c87a10107eb6dde86fa66292de6a56cda300889b8f329  zrelease.cmd
+e29782135c4ca25eeff9655751a80fecda6c8fa8031a478a263ececb29a14937  zrelease.ps1
+8031864bc4ad92e1fc23a6f9ff1886e2b54bde5cda48658f3e4b60b90846937e  zrepair.cmd
+51ca23196efefa8482a8be88f66239830dbce9e1dcabb98e7c5edf493dc30a2e  zrepair.ps1
+b45c4ce12cb0d907cb2bb53a6fb1b4a0e0cfd61d8cc54f14a1badc73a953befb  zrestart.cmd
+2cb349166a8cc93353fec4b59bbe4b3d9acb10597a06ae6f7317ebd5287a17b1  zrestart.ps1
+7e760b07cbcc0599afc7cbf2a45a05818300e6c1a96c1df7ce835f6d502e080e  zrestartd.cmd
+f4808922ba1529a50d0f6b69fa1b73c02edbeeba48bd4bb2ada7790d220413d6  zsetup.cmd
+f669146bd46a3bebeb66b1cde8ed451557e7528282e4d7f5a04563a23572179f  zsetup.ps1
+634a9376513846ba2ee3635afdf515d68626e0144e731d045cbfd7ea60018923  zsetup_mail.ps1
+85f3301616f7409720e4eeb3f3f4e367f0bb1d336fe13123b9ce6674361a6251  zstart.cmd
+2e353bee9e7bf78d39c32b98b3375eebff89d5b9c2313fa05b3ff3161e836b91  zstart.ps1
+f6107ca1d887ef1b3f94f51a40772a59d01fa1a582420a74766a2acc68bbe01f  zstart_docker.cmd
+5f15a05f5972dd8a3d33efa224db2d2640f3562436ec1bc2efb7354fc9b4653f  zstart_docker.ps1
+92bd61afa382b1c38bbd33cf19661084ba64cdb8b2ca6690d44c9ea1ee85a6af  zstartd.cmd
+ecd3bad1348fcd31c15b7365a9bb48742066cf98f0b1dd0aace4c4ce7a384242  zstop.ps1
+8f75cd61112cec34a504073cd6086c18ad5c1c368cd62f9603c04bcd50156189  zsync.cmd
+10e22effc5425d29ef3dc6eec9d69709dd02754a3baa5276ffdb1bbfe03a4dde  zsync.ps1
+2746c4e003c744f860cec2356844409304c2e9d577bbe6f895f39bc3140ca7d7  zversion.cmd
+529d4b2ae72603d2591475d65969bccd3f629522234315051ac95a88f6290a51  zversion.ps1
diff --git a/README.md b/README.md
index 44b253d..bb7d197 100644
--- a/README.md
+++ b/README.md
@@ -132,6 +132,8 @@ The `.cmd` wrappers are the everyday interface. Every command takes one or more
 | `zsync [<key>]` | Copy new backups offsite (or build + mirror a vite dist) |
 | `zstart_docker` | Run a local docker compose stack from `scriptsRoot\docker\` |
 | `zchecksums [-Update]` | Verify every script against `CHECKSUMS.txt` (SHA-256) |
+| `zversion [bump \| bump-stage <s> \| set <v>]` | Show or advance the toolkit version (stamps every header) |
+| `zrelease [-Verify]` | Package the current version as `releases/zscripts-<version>.zip` + `.sha256` |
 
 ### Local development
 
@@ -386,6 +388,18 @@ Give the project a `verify` block instead, and `zdeploy` checks the app **from t
 2. That's it: `zstart`, `zkill`, `zrestart`, `zbackup`, `zdeploy`, `zec2`, `zec2online`, `zrepair`, `zstop` all accept the new key immediately.
 3. A project whose deploy doesn't fit the python/vite/nextjs/edge/docker patterns needs its own `Invoke-<Kind>Deploy` function in `zdeploy.ps1` — copy an existing handler; they're all variations on zip → upload → compose up → verify.
 
+## Downloading without cloning
+
+Each release is packaged as a zip in [`releases/`](releases/) — grab the latest `zscripts-v*.zip`, check it, unzip, done:
+
+```bash
+sha256sum -c zscripts-v1.0.0.0.0.zip.sha256   # verify the download
+unzip zscripts-v1.0.0.0.0.zip -d zscripts     # extract
+cd zscripts && sha256sum -c CHECKSUMS.txt     # verify the contents
+```
+
+The zip contains every command, `CHECKSUMS.txt`, `zconfig.example.json`, and the docs. Versions follow `v{major}.{rc}.{beta}.{alpha}.{build}`; every script header carries the release version it shipped in, so even a single copied file can be traced to its release.
+
 ## Verifying what you downloaded
 
 `CHECKSUMS.txt` holds a SHA-256 for every `.ps1` and `.cmd` in the repo. Check them before running anything:
diff --git a/ZHelpers.ps1 b/ZHelpers.ps1
index 4295bb9..e497c20 100644
--- a/ZHelpers.ps1
+++ b/ZHelpers.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # ZHelpers.ps1 — shared library dot-sourced by every z script. Not run directly.
 
diff --git a/ZKillOnly.ps1 b/ZKillOnly.ps1
index e4a2f1e..4277e20 100644
--- a/ZKillOnly.ps1
+++ b/ZKillOnly.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # ZKillOnly.ps1 — stop local dev server listeners for any project in zconfig.json.
 #
diff --git a/ZKiller.ps1 b/ZKiller.ps1
index 4af1689..bb2f90c 100644
--- a/ZKiller.ps1
+++ b/ZKiller.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # ZKiller.ps1 — kill then restart dev servers for any project in zconfig.json.
 #
diff --git a/build-version.json b/build-version.json
new file mode 100644
index 0000000..b3930d1
--- /dev/null
+++ b/build-version.json
@@ -0,0 +1,3 @@
+{
+    "version":  "v1.0.0.0.0"
+}
diff --git a/releases/zscripts-v1.0.0.0.0.zip b/releases/zscripts-v1.0.0.0.0.zip
new file mode 100644
index 0000000..32387f5
Binary files /dev/null and b/releases/zscripts-v1.0.0.0.0.zip differ
diff --git a/releases/zscripts-v1.0.0.0.0.zip.sha256 b/releases/zscripts-v1.0.0.0.0.zip.sha256
new file mode 100644
index 0000000..0e1e2e7
--- /dev/null
+++ b/releases/zscripts-v1.0.0.0.0.zip.sha256
@@ -0,0 +1 @@
+17202e39be7b4a5f46418b9f2d1bbfc58c356f591abf416a1c9348b85241f006  zscripts-v1.0.0.0.0.zip
diff --git a/setup_backup_schedule.ps1 b/setup_backup_schedule.ps1
index 90e904f..5313c87 100644
--- a/setup_backup_schedule.ps1
+++ b/setup_backup_schedule.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # setup_backup_schedule.ps1 — create a scheduled task for daily backups + OneDrive sync
 #
diff --git a/token-count.ps1 b/token-count.ps1
index c6667bc..849944c 100644
--- a/token-count.ps1
+++ b/token-count.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # token-count.ps1 — measure script output volume to estimate AI agent token costs.
 #
diff --git a/zbackup.cmd b/zbackup.cmd
index e29f314..983002e 100644
--- a/zbackup.cmd
+++ b/zbackup.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zbackup.ps1" %*
diff --git a/zbackup.ps1 b/zbackup.ps1
index a030764..a709384 100644
--- a/zbackup.ps1
+++ b/zbackup.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zbackup.ps1 — local backups: zip project sources (plus a Postgres dump when the
 # project's .env has a DATABASE_URL) into the backups folder.
diff --git a/zbackup_and_sync.ps1 b/zbackup_and_sync.ps1
index 19d9af1..76c38a2 100644
--- a/zbackup_and_sync.ps1
+++ b/zbackup_and_sync.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zbackup_and_sync.ps1 — run backups, then sync the backups folder offsite.
 #
diff --git a/zbackup_ec2.cmd b/zbackup_ec2.cmd
index 5d01bfa..c99a0cb 100644
--- a/zbackup_ec2.cmd
+++ b/zbackup_ec2.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zbackup_ec2.ps1" %*
diff --git a/zbackup_ec2.ps1 b/zbackup_ec2.ps1
index 7d017bd..9de5b54 100644
--- a/zbackup_ec2.ps1
+++ b/zbackup_ec2.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zbackup_ec2.ps1 — pull backups down from the server: a Postgres dump for projects
 # with a "db" config block, plus a zip of server-side data dirs (uploads/archive/dist).
diff --git a/zchecksums.cmd b/zchecksums.cmd
index 13eb07a..19c6ebb 100644
--- a/zchecksums.cmd
+++ b/zchecksums.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zchecksums.ps1" %*
diff --git a/zchecksums.ps1 b/zchecksums.ps1
index c43c4b8..c33fcd0 100644
--- a/zchecksums.ps1
+++ b/zchecksums.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zchecksums.ps1 - verify (or regenerate) SHA-256 checksums for the scripts.
 #
diff --git a/zdeploy.cmd b/zdeploy.cmd
index 21928fb..55e7331 100644
--- a/zdeploy.cmd
+++ b/zdeploy.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zdeploy.ps1" %*
diff --git a/zdeploy.ps1 b/zdeploy.ps1
index 5092170..60103ea 100644
--- a/zdeploy.ps1
+++ b/zdeploy.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zdeploy.ps1 — deploy any project defined in zconfig.json to the server.
 # Each project runs its own docker compose stack; the handler is picked by the
diff --git a/zec2.cmd b/zec2.cmd
index 5e068b7..c49c9a9 100644
--- a/zec2.cmd
+++ b/zec2.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zec2.ps1" %*
diff --git a/zec2.ps1 b/zec2.ps1
index d5ecbe0..5d20a8e 100644
--- a/zec2.ps1
+++ b/zec2.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zec2.ps1 — quick reachability check (TCP + HTTP + live build version) for deployed projects.
 #
diff --git a/zec2_rotatekeys.cmd b/zec2_rotatekeys.cmd
index 4354967..7ab1d2b 100644
--- a/zec2_rotatekeys.cmd
+++ b/zec2_rotatekeys.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zec2_rotatekeys.ps1" %*
diff --git a/zec2_rotatekeys.ps1 b/zec2_rotatekeys.ps1
index a4dbc7e..728f49f 100644
--- a/zec2_rotatekeys.ps1
+++ b/zec2_rotatekeys.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zec2_rotatekeys.ps1 - rotate / reset secret keys in a project's SERVER-SIDE
 # .env, in place, without the values ever passing through this machine's shell
diff --git a/zec2online.cmd b/zec2online.cmd
index f0afb45..31672e4 100644
--- a/zec2online.cmd
+++ b/zec2online.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zec2online.ps1" %*
diff --git a/zec2online.ps1 b/zec2online.ps1
index 4143eea..85f9310 100644
--- a/zec2online.ps1
+++ b/zec2online.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zec2online.ps1 — deep health check: verify apps are live AND running the expected
 # build; auto-start downed stacks via docker compose and stream diagnostics.
diff --git a/zkill.cmd b/zkill.cmd
index fd3fb33..8a9148a 100644
--- a/zkill.cmd
+++ b/zkill.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0ZKillOnly.ps1" %*
diff --git a/zkill.ps1 b/zkill.ps1
index 67aded4..08c52c0 100644
--- a/zkill.ps1
+++ b/zkill.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zkill.ps1 — alias for ZKillOnly.ps1 (kept so both names work). All args pass through.
 & (Join-Path $PSScriptRoot "ZKillOnly.ps1") @args
diff --git a/zrelease.cmd b/zrelease.cmd
new file mode 100644
index 0000000..64293cd
--- /dev/null
+++ b/zrelease.cmd
@@ -0,0 +1,7 @@
+REM Evomedia.net — https://github.com/kellymichels/zscripts-token-savers
+REM Created by Kelly Michels · dev@evomedia.net
+REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
+
+@echo off
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zrelease.ps1" %*
diff --git a/zrelease.ps1 b/zrelease.ps1
new file mode 100644
index 0000000..4fcae24
--- /dev/null
+++ b/zrelease.ps1
@@ -0,0 +1,146 @@
+# Evomedia.net — https://github.com/kellymichels/zscripts-token-savers
+# Created by Kelly Michels · dev@evomedia.net
+# Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
+
+# zrelease.ps1 - package the current version as a downloadable zip.
+#
+# Usage:
+#   zrelease            build releases/zscripts-<version>.zip
+#   zrelease -Force     overwrite an existing zip for this version
+#   zrelease -Verify    re-check the zip already on disk for this version
+#
+# For people who want the toolkit without cloning: one zip, one hash to check.
+#
+# WHAT GOES IN
+# ------------
+#   every *.ps1 / *.cmd      the commands themselves
+#   CHECKSUMS.txt            per-file manifest, so the contents can be
+#                            re-verified after unzipping
+#   zconfig.example.json     you need it to configure anything
+#   README.md, CHANGELOG.md, LICENSE, TOKEN_SAVINGS.md
+#   build-version.json       which release this is
+#
+# Left out: tests/ (a user does not need the suite to run the commands) and
+# releases/ (never package the packages).
+#
+# WHAT COMES OUT
+#   releases/zscripts-v1.0.0.0.1.zip
+#   releases/zscripts-v1.0.0.0.1.zip.sha256   <- sha256sum format, one line
+#
+# Two layers on purpose: the .sha256 verifies you downloaded the zip intact,
+# and CHECKSUMS.txt inside verifies the individual scripts after extraction.
+# Both are integrity checks, not signatures - see the note in zchecksums.ps1.
+
+[CmdletBinding()]
+param(
+    [switch]$Force,
+    [switch]$Verify
+)
+
+$ErrorActionPreference = "Stop"
+
+$ReleasesDir = Join-Path $PSScriptRoot "releases"
+$VersionFile = Join-Path $PSScriptRoot "build-version.json"
+
+if (-not (Test-Path -LiteralPath $VersionFile)) {
+    Write-Host "ERROR: build-version.json not found. Run 'zversion set v1.0.0.0.0' first." -ForegroundColor Red
+    exit 1
+}
+$version = (Get-Content -LiteralPath $VersionFile -Raw -Encoding UTF8 | ConvertFrom-Json).version
+if ($version -notmatch '^v\d+\.\d+\.\d+\.\d+\.\d+$') {
+    Write-Host "ERROR: build-version.json holds an invalid version '$version'." -ForegroundColor Red
+    exit 1
+}
+
+$zipName = "zscripts-$version.zip"
+$zipPath = Join-Path $ReleasesDir $zipName
+$shaPath = "$zipPath.sha256"
+
+function Get-Sha256([string]$Path) {
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+
+# ---- verify mode -------------------------------------------------------------
+if ($Verify) {
+    if (-not (Test-Path -LiteralPath $zipPath)) {
+        Write-Host "ERROR: $zipName not found in releases/." -ForegroundColor Red
+        exit 1
+    }
+    if (-not (Test-Path -LiteralPath $shaPath)) {
+        Write-Host "ERROR: $zipName.sha256 not found." -ForegroundColor Red
+        exit 1
+    }
+    $expected = ((Get-Content -LiteralPath $shaPath -Raw) -split '\s+')[0].ToLowerInvariant()
+    $actual = Get-Sha256 $zipPath
+    Write-Host ""
+    Write-Host "=== zrelease (verify) ===" -ForegroundColor Cyan
+    if ($actual -eq $expected) {
+        Write-Host "  OK - $zipName matches its .sha256." -ForegroundColor Green
+        Write-Host ""
+        exit 0
+    }
+    Write-Host "  FAILED - $zipName does not match its .sha256." -ForegroundColor Red
+    Write-Host ""
+    exit 1
+}
+
+# ---- build mode --------------------------------------------------------------
+if ((Test-Path -LiteralPath $zipPath) -and -not $Force) {
+    Write-Host ""
+    Write-Host "ERROR: releases/$zipName already exists." -ForegroundColor Red
+    Write-Host "  A released version is immutable - bump instead: zversion bump" -ForegroundColor DarkGray
+    Write-Host "  (or pass -Force if you are rebuilding one that was never published)" -ForegroundColor DarkGray
+    Write-Host ""
+    exit 1
+}
+
+# Refuse to package scripts that disagree with the manifest.
+& (Join-Path $PSScriptRoot "zchecksums.ps1") -Quiet | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    Write-Host ""
+    Write-Host "ERROR: checksum verification failed - refusing to package." -ForegroundColor Red
+    Write-Host "  Run 'zchecksums' to see what differs, then 'zversion bump' to restamp." -ForegroundColor DarkGray
+    Write-Host ""
+    exit 1
+}
+
+New-Item -ItemType Directory -Force -Path $ReleasesDir | Out-Null
+
+$staging = Join-Path ([IO.Path]::GetTempPath()) ("zrel-" + [guid]::NewGuid().ToString("N"))
+New-Item -ItemType Directory -Path $staging -Force | Out-Null
+try {
+    $scripts = @(Get-ChildItem -LiteralPath $PSScriptRoot -File | Where-Object { $_.Extension -in @('.ps1', '.cmd') })
+    foreach ($f in $scripts) { Copy-Item -LiteralPath $f.FullName -Destination $staging }
+
+    $extras = @('CHECKSUMS.txt', 'zconfig.example.json', 'README.md', 'CHANGELOG.md', 'LICENSE', 'TOKEN_SAVINGS.md', 'build-version.json')
+    $included = @()
+    foreach ($name in $extras) {
+        $p = Join-Path $PSScriptRoot $name
+        if (Test-Path -LiteralPath $p) { Copy-Item -LiteralPath $p -Destination $staging; $included += $name }
+    }
+
+    if (Test-Path -LiteralPath $zipPath) { Remove-Item -LiteralPath $zipPath -Force }
+    Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction SilentlyContinue
+    [IO.Compression.ZipFile]::CreateFromDirectory($staging, $zipPath, [IO.Compression.CompressionLevel]::Optimal, $false)
+}
+finally {
+    Remove-Item -LiteralPath $staging -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+$hash = Get-Sha256 $zipPath
+# sha256sum format, LF ending, so `sha256sum -c` works on Linux/macOS.
+[IO.File]::WriteAllText($shaPath, "$hash  $zipName`n", (New-Object Text.UTF8Encoding($false)))
+
+$sizeKb = [math]::Round((Get-Item -LiteralPath $zipPath).Length / 1KB, 1)
+
+Write-Host ""
+Write-Host "=== zrelease ===" -ForegroundColor Cyan
+Write-Host "  Version: $version" -ForegroundColor Green
+Write-Host "  Zip:     releases/$zipName  ($sizeKb KB, $($scripts.Count) scripts + $($included.Count) support file(s))" -ForegroundColor Gray
+Write-Host "  SHA-256: $hash" -ForegroundColor Gray
+Write-Host "  Digest:  releases/$zipName.sha256" -ForegroundColor Gray
+Write-Host ""
+Write-Host "  Commit both files - a release lives in the repo under releases/." -ForegroundColor DarkGray
+Write-Host ""
+exit 0
diff --git a/zrepair.cmd b/zrepair.cmd
index 534c11e..6e06d6b 100644
--- a/zrepair.cmd
+++ b/zrepair.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zrepair.ps1" %*
diff --git a/zrepair.ps1 b/zrepair.ps1
index 23e2a15..8c7ce52 100644
--- a/zrepair.ps1
+++ b/zrepair.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zrepair.ps1 — audit and repair container/proxy routing on the server, then smoke test.
 #
diff --git a/zrestart.cmd b/zrestart.cmd
index 92f7cd3..ff41d9f 100644
--- a/zrestart.cmd
+++ b/zrestart.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0ZKiller.ps1" %*
diff --git a/zrestart.ps1 b/zrestart.ps1
index 1554cf2..2f1b38b 100644
--- a/zrestart.ps1
+++ b/zrestart.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zrestart.ps1 — alias for ZKiller.ps1 (kept so both names work). All args pass through.
 & (Join-Path $PSScriptRoot "ZKiller.ps1") @args
diff --git a/zrestartd.cmd b/zrestartd.cmd
index fc4f5ab..9d1e417 100644
--- a/zrestartd.cmd
+++ b/zrestartd.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0ZKiller.ps1" -Detached %*
diff --git a/zsetup.cmd b/zsetup.cmd
index 4d645bd..2584dad 100644
--- a/zsetup.cmd
+++ b/zsetup.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zsetup.ps1" %*
diff --git a/zsetup.ps1 b/zsetup.ps1
index 84e95d9..bf7e9dc 100644
--- a/zsetup.ps1
+++ b/zsetup.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zsetup.ps1 — prepare a project for local dev: create its Python venv and install
 # dependencies (python kind), or run `npm install` (vite/nextjs). Idempotent -
diff --git a/zsetup_mail.ps1 b/zsetup_mail.ps1
index 35c1579..887b11d 100644
--- a/zsetup_mail.ps1
+++ b/zsetup_mail.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zsetup_mail.ps1 — create admin@ and noreply@ mailboxes in a docker-mailserver
 # container on the server, and print the DNS records + SMTP/IMAP settings to use.
diff --git a/zstart.cmd b/zstart.cmd
index c5ef5e9..5bad45c 100644
--- a/zstart.cmd
+++ b/zstart.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0ZStart.ps1" %*
diff --git a/zstart.ps1 b/zstart.ps1
index 363d23d..b19a106 100644
--- a/zstart.ps1
+++ b/zstart.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zstart.ps1 — start local dev servers for any project defined in zconfig.json.
 #
diff --git a/zstart_docker.cmd b/zstart_docker.cmd
index b97487f..f96091d 100644
--- a/zstart_docker.cmd
+++ b/zstart_docker.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zstart_docker.ps1" %*
diff --git a/zstart_docker.ps1 b/zstart_docker.ps1
index 7834ec9..347e64a 100644
--- a/zstart_docker.ps1
+++ b/zstart_docker.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zstart_docker.ps1 — bring up a local docker compose stack from <scriptsRoot>\docker\.
 #
diff --git a/zstartd.cmd b/zstartd.cmd
index a4c9b65..2013960 100644
--- a/zstartd.cmd
+++ b/zstartd.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0ZStart.ps1" -Detached %*
diff --git a/zstop.ps1 b/zstop.ps1
index 891ca44..cbd2ddd 100644
--- a/zstop.ps1
+++ b/zstop.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zstop.ps1 — stop docker compose stacks on the server without removing data or files.
 #
diff --git a/zsync.cmd b/zsync.cmd
index c13b346..aa821ea 100644
--- a/zsync.cmd
+++ b/zsync.cmd
@@ -1,6 +1,7 @@
 REM Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 REM Created by Kelly Michels · dev@evomedia.net
 REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
 
 @echo off
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zsync.ps1" %*
diff --git a/zsync.ps1 b/zsync.ps1
index 057e6b0..2cab3ec 100644
--- a/zsync.ps1
+++ b/zsync.ps1
@@ -1,6 +1,7 @@
 # Evomedia.net Token Savers — https://github.com/kellymichels/zscripts-token-savers
 # Created by Kelly Michels · dev@evomedia.net
 # Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
 
 # zsync.ps1 — copy new backup files offsite; or build + mirror a vite project's dist.
 #
diff --git a/zversion.cmd b/zversion.cmd
new file mode 100644
index 0000000..961a178
--- /dev/null
+++ b/zversion.cmd
@@ -0,0 +1,7 @@
+REM Evomedia.net — https://github.com/kellymichels/zscripts-token-savers
+REM Created by Kelly Michels · dev@evomedia.net
+REM Licensed under the MIT License. See LICENSE.
+REM Version: v1.0.0.0.0
+
+@echo off
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0zversion.ps1" %*
diff --git a/zversion.ps1 b/zversion.ps1
new file mode 100644
index 0000000..14f2840
--- /dev/null
+++ b/zversion.ps1
@@ -0,0 +1,154 @@
+# Evomedia.net — https://github.com/kellymichels/zscripts-token-savers
+# Created by Kelly Michels · dev@evomedia.net
+# Licensed under the MIT License. See LICENSE.
+# Version: v1.0.0.0.0
+
+# zversion.ps1 - manage the toolkit version.
+#
+# Usage:
+#   zversion                     print the current version
+#   zversion bump                build + 1        (one bump per PR / per defect fix)
+#   zversion bump-stage alpha    alpha + 1, build -> 0
+#   zversion bump-stage beta     beta  + 1, alpha/build -> 0
+#   zversion bump-stage rc       rc    + 1, beta/alpha/build -> 0
+#   zversion bump-stage release  major + 1, everything below -> 0
+#   zversion set v1.2.0.0.5      set an exact version
+#
+# THE SCHEME
+# ----------
+#   v{major}.{rc}.{beta}.{alpha}.{build}
+#
+# Priority runs left to right, and bumping any stage zeroes every lower segment
+# including build. One version for the whole toolkit, not per script.
+#
+# WHAT A BUMP TOUCHES
+# -------------------
+# Anything other than a plain read rewrites three things together, because they
+# are only useful if they agree:
+#   1. build-version.json  - the source of truth
+#   2. the "# Version:" line in every .ps1 / .cmd header, so a script that has
+#      been copied out of the repo still says which release it came from
+#   3. CHECKSUMS.txt       - stamping changes every file, so the manifest must
+#                            be regenerated or verification fails immediately
+#
+# Run this on a clean checkout: it hashes files as they sit on disk, and an
+# editor that writes LF leaves a file git still considers unchanged. See the
+# note in zchecksums.ps1.
+
+[CmdletBinding()]
+param(
+    [Parameter(Position = 0)][string]$Command = "get",
+    [Parameter(Position = 1)][string]$Value
+)
+
+$ErrorActionPreference = "Stop"
+
+$VersionFile = Join-Path $PSScriptRoot "build-version.json"
+$VersionRe = '^v(\d+)\.(\d+)\.(\d+)\.(\d+)\.(\d+)$'
+$DefaultVersion = "v1.0.0.0.0"
+
+function Read-Version {
+    if (-not (Test-Path -LiteralPath $VersionFile)) { return $DefaultVersion }
+    try {
+        $v = (Get-Content -LiteralPath $VersionFile -Raw -Encoding UTF8 | ConvertFrom-Json).version
+        if ($v -match $VersionRe) { return $v }
+    } catch { }
+    return $DefaultVersion
+}
+
+function Write-Version([string]$Version) {
+    $json = [ordered]@{ version = $Version } | ConvertTo-Json
+    [IO.File]::WriteAllText($VersionFile, $json + "`n", (New-Object Text.UTF8Encoding($false)))
+}
+
+function Split-Version([string]$Version) {
+    if ($Version -notmatch $VersionRe) {
+        throw "Invalid version '$Version'. Expected v{major}.{rc}.{beta}.{alpha}.{build}, e.g. v1.0.0.0.3."
+    }
+    return [int[]]@($Matches[1], $Matches[2], $Matches[3], $Matches[4], $Matches[5])
+}
+
+# Rewrite (or insert) the "# Version:" header line in every covered script.
+function Set-ScriptVersionHeaders([string]$Version) {
+    $stamped = 0
+    foreach ($f in Get-ChildItem -LiteralPath $PSScriptRoot -File | Where-Object { $_.Extension -in @('.ps1', '.cmd') }) {
+        $text = [IO.File]::ReadAllText($f.FullName)
+        # Keep each file's own comment marker: # for PowerShell, REM for cmd.
+        $marker = if ($f.Extension -eq '.cmd') { 'REM' } else { '#' }
+        $line = "$marker Version: $Version"
+        if ($text -match "(?m)^(#|REM) Version: v[\d\.]+\r?$") {
+            $new = [regex]::Replace($text, "(?m)^(#|REM) Version: v[\d\.]+\r?$", [System.Text.RegularExpressions.MatchEvaluator] { param($m) $line })
+        } else {
+            # Insert directly after the licence line, which every header carries.
+            $pattern = "(?m)^((#|REM) Licensed under the MIT License\. See LICENSE\.)\r?$"
+            if ($text -notmatch $pattern) { continue }
+            $new = [regex]::Replace($text, $pattern, [System.Text.RegularExpressions.MatchEvaluator] { param($m) $m.Groups[1].Value + "`r`n" + $line }, 1)
+        }
+        if ($new -ne $text) {
+            # .ps1/.cmd are pinned to CRLF by .gitattributes - write them that
+            # way or every stamped file shows up as changed on the next clone.
+            $new = ($new -replace "`r`n", "`n") -replace "`n", "`r`n"
+            [IO.File]::WriteAllText($f.FullName, $new, (New-Object Text.UTF8Encoding($false)))
+            $stamped++
+        }
+    }
+    return $stamped
+}
+
+function Update-Everything([string]$Version) {
+    Write-Version $Version
+    $n = Set-ScriptVersionHeaders $Version
+    & (Join-Path $PSScriptRoot "zchecksums.ps1") -Update | Out-Null
+    Write-Host ""
+    Write-Host "=== zversion ===" -ForegroundColor Cyan
+    Write-Host "  Version:   $Version" -ForegroundColor Green
+    Write-Host "  Stamped:   $n script header(s)" -ForegroundColor Gray
+    Write-Host "  Refreshed: CHECKSUMS.txt" -ForegroundColor Gray
+    Write-Host "  Commit build-version.json, the stamped scripts and CHECKSUMS.txt together." -ForegroundColor DarkGray
+    Write-Host ""
+}
+
+$current = Read-Version
+
+switch ($Command.ToLowerInvariant().TrimStart('-')) {
+    "get" {
+        Write-Host $current
+        exit 0
+    }
+    "bump" {
+        $p = Split-Version $current
+        Update-Everything ("v{0}.{1}.{2}.{3}.{4}" -f $p[0], $p[1], $p[2], $p[3], ($p[4] + 1))
+        exit 0
+    }
+    "bump-stage" {
+        $p = Split-Version $current
+        $major, $rc, $beta, $alpha = $p[0], $p[1], $p[2], $p[3]
+        switch (("$Value").ToLowerInvariant()) {
+            "release" { $major++; $rc = 0; $beta = 0; $alpha = 0 }
+            "rc"      { $rc++; $beta = 0; $alpha = 0 }
+            "beta"    { $beta++; $alpha = 0 }
+            "alpha"   { $alpha++ }
+            default {
+                Write-Host "ERROR: stage must be one of: release, rc, beta, alpha" -ForegroundColor Red
+                exit 1
+            }
+        }
+        # Bumping a stage zeroes every lower segment, build included.
+        Update-Everything ("v{0}.{1}.{2}.{3}.0" -f $major, $rc, $beta, $alpha)
+        exit 0
+    }
+    "set" {
+        [void](Split-Version $Value)
+        Update-Everything $Value
+        exit 0
+    }
+    default {
+        Write-Host ""
+        Write-Host "Usage: zversion [get | bump | bump-stage <release|rc|beta|alpha> | set <version>]" -ForegroundColor Yellow
+        Write-Host "  Scheme: v{major}.{rc}.{beta}.{alpha}.{build}  (current: $current)" -ForegroundColor Gray
+        Write-Host "  bump        build + 1 - one per PR, one per defect fix" -ForegroundColor Gray
+        Write-Host "  bump-stage  raise a stage; every lower segment resets to 0" -ForegroundColor Gray
+        Write-Host ""
+        exit 1
+    }
+}