diff --git a/bin/AGENTS.md b/bin/AGENTS.md
index c1d786cd..92f883d5 100644
--- a/bin/AGENTS.md
+++ b/bin/AGENTS.md
@@ -9,7 +9,7 @@ Built punk shell executables (kits with the punk boot layer), assorted build/exp
 The `.cmd` scripts here (e.g `runtime.cmd`) are punk MULTISHELL polyglots GENERATED by
 `punk::mix::commandset::scriptwrap::multishell` from scriptset sources under
 `src/scriptapps/bin/` (the home for bin-deployed scriptsets, e.g `runtime.*` alongside
-`getzig.*`) or `src/scriptapps/` itself (e.g `tclargs.*`, `dtplite.*`): payload scripts
+`punk-getzig.*`) or `src/scriptapps/` itself (e.g `tclargs.*`, `dtplite.*`): payload scripts
 (`<name>.ps1`, `<name>.bash`, `<name>.tcl`, ...) plus a `<name>_wrap.toml`
 config, spliced into the `punk.multishell.cmd` template. The polyglot structure is
 deliberately fragile (mutual shell-hiding tricks, LF-only endings, cmd.exe's 512-byte
@@ -46,6 +46,19 @@ has no dtplite package installed.
 
 ## Local Contracts
 
+### Utility naming policy: punk- prefix (G-096)
+
+Punkshell-own utilities deployed to `bin/` take a `punk-` name prefix (e.g
+`punk-getzig`) so a user who adds `<project>/bin` to their PATH gets
+collision-resistant names. Exceptions: wrappers whose purpose is to present an
+external tool under its own name (`dtplite`, `sdx`, `kettle`), and `getpunk`
+(already punkshell-specific; intended future single-download cross-platform entry
+point). Policy decided by the user 2026-07-20 (G-096); the sweep of the remaining
+pre-policy names (`bits`, `runtime`, `tclargs`, the selfsign experiment scripts) is
+G-097. Where launchability convenience warrants it a `.ps1` twin of the generated
+`.cmd` ships alongside (windows users may start from cmd.exe or powershell); the twin
+is a byte-copy under the other extension - refresh both on re-wrap.
+
 ### Launch package modes (built punk shells)
 
 The first argument to a built punk shell may be a dash-delimited package mode composed of tokens from `dev`, `os`, `src`, `internal` (e.g. `punksys src`, `punk902z dev-os`). `internal` is the default and is always appended when absent. A first argument that is not a valid mode list is treated as a subcommand instead. Implementation: `src/vfs/_config/punk_main.tcl` (search `all_package_modes`).
diff --git a/bin/getzig.cmd b/bin/punk-getzig.cmd
similarity index 99%
rename from bin/getzig.cmd
rename to bin/punk-getzig.cmd
index d3c3f7f7..68093e4e 100644
--- a/bin/getzig.cmd
+++ b/bin/punk-getzig.cmd
@@ -1286,7 +1286,12 @@ tarball="zig-x86_64-linux-0.15.2.tar.xz"
 
 automation_name="punkshell+julian@precisium.com.au_target_by_latency"
 uristring="https://ziglang.org"
+
+#releases
 full_uristring="${uristring}/download/0.15.2/${tarball}?source=${automation_name}"
+#pre-releases
+#full_uristring="${uristring}/builds/${tarball}?source=${automation_name}"
+
 echo "Unimplemented: Download from ${full_uristring} and extract manually"
 #wget $full_uristring -O ./zig/zig-linux-x86_64-0.10.1.tar.xz
 #tar -xf ./zig/zig-linux-x86_64-0.10.1.tar.xz -C ./zig --strip-components=1
@@ -1589,8 +1594,8 @@ if ($match.Success) {
 #<powershell-payload>
 
 #launch example
-#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/getzig.cmd' -OutFile 'getzig.cmd'; Start-Process 'cmd.exe' -ArgumentList @('/c', 'getzig.cmd') -NoNewWindow -Wait"
-#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/getzig.cmd' -OutFile 'getzig.cmd'; Start-Process 'getzig.cmd' -NoNewWindow -Wait"
+#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/punk-getzig.cmd' -OutFile 'punk-getzig.cmd'; Start-Process 'cmd.exe' -ArgumentList @('/c', 'punk-getzig.cmd') -NoNewWindow -Wait"
+#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/punk-getzig.cmd' -OutFile 'punk-getzig.cmd'; Start-Process 'punk-getzig.cmd' -NoNewWindow -Wait"
 
 #Join-Path using verbose method to support powershell 5?
 #$outbase = Join-Path -Path $PSScriptRoot -ChildPath "../.." 
@@ -1604,7 +1609,7 @@ if (-not(Test-Path -Path $toolsfolder -PathType Container)) {
 }
 $zigfolder = Join-Path $toolsfolder -ChildPath "zig"
 $zigexe = Join-Path $zigfolder -ChildPath "zig.exe"
-# $releasearchive = "zig-x86_64-windows-0.15.1.zip" ;#zip on windows, tarball on every other platform
+#$releasearchive = "zig-x86_64-windows-0.15.1.zip" ;#zip on windows, tarball on every other platform
 #$releasearchive = "zig-x86_64-windows-0.16.0-dev.254+6dd0270a1.zip"
 #$releasearchive = "zig-x86_64-windows-0.16.0-dev.2193+fc517bd01.zip"
 $releasearchive = "zig-x86_64-windows-0.15.2.zip"
@@ -1673,7 +1678,7 @@ if (Get-Command "minisign" -ErrorAction SilentlyContinue) {
             #pwsh.exe
         #}
         if ($response -ieq "y") {
-            Start-Process 'getzig.cmd' -NoNewWindow -Wait
+            Start-Process 'punk-getzig.cmd' -NoNewWindow -Wait
         }
         exit
     }
@@ -1798,7 +1803,10 @@ if (-not $download_required) {
     exit 0
 }
 
+#index: https://ziglang.org/download/index.json
+
 $mirrors_url = "https://ziglang.org/download/community-mirrors.txt"
+#some mirrors have no index and the base url will produce a 404, some have an html index, some have a modified copy of the ziglang.org/download/index.json
 $mirrors_response = $(Invoke-WebRequest -Uri $mirrors_url)
 if ($mirrors_response.StatusCode -eq 200) {
     #https://www.gitea1.intx.com.au/jn/punkbin/raw/branch/master/win32-x86_64/tools/zig-x86_64-windows-0.15.1.zip
@@ -1897,8 +1905,10 @@ if ($mirrors_response.StatusCode -eq 200) {
     foreach ($hostinfo in $sorted_mirror_dicts) {
         $uristring = $hostinfo.uri
         if ($uristring -eq "https://ziglang.org") {
+            #if it's a release
             $full_uristring = "${uristring}/download/0.15.1/${releasearchive}?source=${automation_name}"
             $sig_uristring = "${uristring}/download/0.15.1/${releasearchive}.minisig?source=${automation_name}"
+            #if it's a pre-release?? /builds/${prereleasearchive} ?
         } else {
             $full_uristring = "${uristring}/${releasearchive}?source=${automation_name}"
             $sig_uristring = "${uristring}/${releasearchive}.minisig?source=${automation_name}"
diff --git a/src/scriptapps/bin/getzig.bash b/src/scriptapps/bin/punk-getzig.bash
similarity index 100%
rename from src/scriptapps/bin/getzig.bash
rename to src/scriptapps/bin/punk-getzig.bash
diff --git a/src/scriptapps/bin/getzig.ps1 b/src/scriptapps/bin/punk-getzig.ps1
similarity index 95%
rename from src/scriptapps/bin/getzig.ps1
rename to src/scriptapps/bin/punk-getzig.ps1
index 712633dd..6b2fac90 100644
--- a/src/scriptapps/bin/getzig.ps1
+++ b/src/scriptapps/bin/punk-getzig.ps1
@@ -1,7 +1,7 @@
 
 #launch example
-#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/getzig.cmd' -OutFile 'getzig.cmd'; Start-Process 'cmd.exe' -ArgumentList @('/c', 'getzig.cmd') -NoNewWindow -Wait"
-#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/getzig.cmd' -OutFile 'getzig.cmd'; Start-Process 'getzig.cmd' -NoNewWindow -Wait"
+#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/punk-getzig.cmd' -OutFile 'punk-getzig.cmd'; Start-Process 'cmd.exe' -ArgumentList @('/c', 'punk-getzig.cmd') -NoNewWindow -Wait"
+#powershell -Command "Invoke-WebRequest -Uri 'https://www.gitea1.intx.com.au/jn/punkshell/raw/branch/master/bin/punk-getzig.cmd' -OutFile 'punk-getzig.cmd'; Start-Process 'punk-getzig.cmd' -NoNewWindow -Wait"
 
 #Join-Path using verbose method to support powershell 5?
 #$outbase = Join-Path -Path $PSScriptRoot -ChildPath "../.." 
@@ -19,6 +19,13 @@ $zigexe = Join-Path $zigfolder -ChildPath "zig.exe"
 #$releasearchive = "zig-x86_64-windows-0.16.0-dev.254+6dd0270a1.zip"
 #$releasearchive = "zig-x86_64-windows-0.16.0-dev.2193+fc517bd01.zip"
 $releasearchive = "zig-x86_64-windows-0.15.2.zip"
+#single-source the pinned version from the archive name (used for ziglang.org release URLs)
+if ($releasearchive -match 'zig-x86_64-windows-(.+)\.zip$') {
+    $releaseversion = $Matches[1]
+} else {
+    Write-Error "cannot derive zig version from releasearchive name '$releasearchive'"
+    exit 1
+}
 Write-Output "powershell version: $($PSVersionTable.PSVersion)"
 
 if (Get-Command $zigexe -ErrorAction SilentlyContinue) {
@@ -84,7 +91,7 @@ if (Get-Command "minisign" -ErrorAction SilentlyContinue) {
             #pwsh.exe
         #}
         if ($response -ieq "y") {
-            Start-Process 'getzig.cmd' -NoNewWindow -Wait
+            Start-Process 'punk-getzig.cmd' -NoNewWindow -Wait
         }
         exit
     }
@@ -312,8 +319,8 @@ if ($mirrors_response.StatusCode -eq 200) {
         $uristring = $hostinfo.uri
         if ($uristring -eq "https://ziglang.org") {
             #if it's a release
-            $full_uristring = "${uristring}/download/0.15.1/${releasearchive}?source=${automation_name}"
-            $sig_uristring = "${uristring}/download/0.15.1/${releasearchive}.minisig?source=${automation_name}"
+            $full_uristring = "${uristring}/download/${releaseversion}/${releasearchive}?source=${automation_name}"
+            $sig_uristring = "${uristring}/download/${releaseversion}/${releasearchive}.minisig?source=${automation_name}"
             #if it's a pre-release?? /builds/${prereleasearchive} ?
         } else {
             $full_uristring = "${uristring}/${releasearchive}?source=${automation_name}"
diff --git a/src/scriptapps/bin/getzig_wrap.toml b/src/scriptapps/bin/punk-getzig_wrap.toml
similarity index 74%
rename from src/scriptapps/bin/getzig_wrap.toml
rename to src/scriptapps/bin/punk-getzig_wrap.toml
index 1606dc1f..755c405a 100644
--- a/src/scriptapps/bin/getzig_wrap.toml
+++ b/src/scriptapps/bin/punk-getzig_wrap.toml
@@ -5,11 +5,11 @@
     as_admin=false
 
     scripts=[
-        "getzig.ps1",
-        "getzig.bash"
+        "punk-getzig.ps1",
+        "punk-getzig.bash"
     ]
 
-    default_outputfile="getzig.cmd"
+    default_outputfile="punk-getzig.cmd"
     default_nextshellpath="/usr/bin/env bash"
     default_nextshelltype="bash"
 
@@ -18,4 +18,4 @@
 
     win32.nextshellpath="pwsh -nop -nol -ExecutionPolicy bypass -c"
     win32.nextshelltype="pwsh"
-    win32.outputfile="getzig.cmd"
+    win32.outputfile="punk-getzig.cmd"