diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index 4543a82..a8483d3 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -2,8 +2,8 @@
   "version": 1,
   "isRoot": true,
   "tools": {
-    "fallout.globaltools": {
-      "version": "2026.1.0-preview.104.g6583d78d2c",
+    "fallout.globaltool": {
+      "version": "10.4.0",
       "commands": [
         "fallout"
       ]
diff --git a/.fallout/build.schema.json b/.fallout/build.schema.json
index 46496eb..05c35ae 100644
--- a/.fallout/build.schema.json
+++ b/.fallout/build.schema.json
@@ -24,12 +24,11 @@
     "ExecutableTarget": {
       "type": "string",
       "enum": [
-        "Compile",
-        "Pack",
-        "Publish",
-        "PublishMarketplace",
-        "PublishOpenVsx",
-        "Restore"
+        "CompileVsix",
+        "PackVsix",
+        "PublishVsix",
+        "RestoreVsix",
+        "VerifyVsixCredentials"
       ]
     },
     "Verbosity": {
@@ -108,7 +107,21 @@
     }
   },
   "allOf": [
-    {},
+    {
+      "properties": {
+        "PreRelease": {
+          "type": "boolean",
+          "description": "Mark the packaged extension as a marketplace pre-release"
+        },
+        "PublishVsixTo": {
+          "type": "array",
+          "description": "Publish only to these named registries (default: all configured VsixPublishTargets)",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
     {
       "$ref": "#/definitions/FalloutBuild"
     }
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..d43304e
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,10 @@
+<!-- Keep it terse: one-line summary, then short "what changed" bullets. -->
+<!-- Link the issue and summarize it — don't recite it. -->
+
+<!-- Apply ONE category label so this lands in the right release-notes section: -->
+<!--   breaking-change / enhancement / bug / security / dependencies / documentation -->
+<!-- Housekeeping with no user-facing note? Use skip-changelog instead. -->
+<!-- The taxonomy lives in .github/release.yml. -->
+
+<!-- The label IS the changelog — there is no CHANGELOG.md to update. -->
+<!-- Write the PR title as the line you'd want to read in the release notes. -->
diff --git a/.github/release.yml b/.github/release.yml
new file mode 100644
index 0000000..adf9141
--- /dev/null
+++ b/.github/release.yml
@@ -0,0 +1,54 @@
+# Source of truth for the PR label taxonomy, mirroring the Fallout repo's own
+# .github/release.yml so contributors and tooling meet one convention across both.
+#
+# GitHub reads this to auto-generate release notes, grouping merged PRs into the
+# sections below by label. Releases are cut with `gh release create --generate-notes`,
+# so the label you put on a PR is what appears in the release.
+#
+# When raising a PR: apply the one category label that matches the change. A PR with
+# no category label falls through to "Other Changes" — prefer a real category.
+#
+# This is the ONLY changelog. There is no CHANGELOG.md — a hand-maintained file would
+# duplicate what these labels already record, and its version heading is unknowable in
+# advance anyway (the patch component is a Nerdbank.GitVersioning git height, so the
+# number is not settled until the release is cut). If the marketplace page ever needs
+# a rendered changelog, generate it into the .vsix at pack time from these notes.
+changelog:
+  exclude:
+    labels:
+      # skip-changelog: housekeeping with no consumer-facing note (CI, tooling,
+      # internal refactors). Keeps the notes signal-heavy.
+      - skip-changelog
+      # dependencies: dependency bumps — folded out of the notes as noise. Also a
+      # category below, so the label is documented once; the exclude wins.
+      - dependencies
+    authors:
+      - dependabot
+  categories:
+    # breaking-change: removes/renames a command ID, setting, or view ID; drops
+    # support for a VS Code or Fallout version; changes the build-graph contract.
+    - title: "⚠️ Breaking Changes"
+      labels:
+        - breaking-change
+    # enhancement: a new feature or user-facing capability.
+    - title: "✨ New Features"
+      labels:
+        - enhancement
+    # bug: fixes incorrect behavior.
+    - title: "🐛 Bug Fixes"
+      labels:
+        - bug
+    # security: fixes a vulnerability or hardens a security-sensitive surface.
+    - title: "🔒 Security"
+      labels:
+        - security
+    # dependencies: dependency version bumps (excluded above — kept for completeness).
+    - title: "📦 Dependencies"
+      labels:
+        - dependencies
+    # documentation: docs, comments, and agent-instruction changes only.
+    - title: "📖 Documentation"
+      labels:
+        - documentation
+    # Fallback for PRs carrying none of the labels above — don't rely on it.
+    - title: "Other Changes"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..623691c
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,56 @@
+# ------------------------------------------------------------------------------
+# <auto-generated>
+#
+#     This code was generated.
+#
+#     - To turn off auto-generation set:
+#
+#         [GitHubActions (AutoGenerate = false)]
+#
+#     - To trigger manual generation invoke:
+#
+#         fallout --generate-configuration GitHubActions_build --host GitHubActions
+#
+# </auto-generated>
+# ------------------------------------------------------------------------------
+
+name: build
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**/*.md'
+      - '.github/**'
+      - '!.github/workflows/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ubuntu-latest:
+    name: ubuntu-latest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.head_ref }}
+      - name: 'Cache: .fallout/temp, ~/.nuget/packages'
+        uses: actions/cache@v6
+        with:
+          path: |
+            .fallout/temp
+            ~/.nuget/packages
+          key: ${{ runner.os }}-${{ hashFiles('**/global.json', '**/*.csproj', '**/Directory.Packages.props') }}
+      - name: 'Setup: .NET SDK'
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+      - name: 'Restore: dotnet tools'
+        run: dotnet tool restore
+      - name: 'Run: PackVsix'
+        run: dotnet fallout PackVsix
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d4565d1..b03051e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,61 +1,250 @@
-# Publishes the extension to the VS Marketplace and Open VSX, and attaches the
-# .vsix to the GitHub Release. Fires on a version tag (e.g. v2026.1.0).
+# Release pipeline for the extension. Shape deliberately mirrors the Fallout repo's
+# publish-packages-release.yml, so the two repos are read with one mental model.
 #
-# Dogfood: the actual build/package/publish is a Fallout build (build/Build.cs),
-# invoked here via ./build.sh. This workflow only provisions the toolchains and
-# passes the marketplace tokens through the environment.
+# Dogfood: the build, package and publish steps are a Fallout build (build/Build.cs)
+# driving the Fallout.Vsce plugin (plugins/Fallout.Vsce). This workflow only provisions
+# toolchains, routes channels, and carries the tokens.
+#
+#   validate-ref -> pack -> fan out to three channel jobs, each its own GH Environment
+#
+# Channel routing — GitHub is the pre-stage, the marketplaces are promoted into:
+#
+#   | Channel                        | Trigger                          | Gating              |
+#   |--------------------------------|----------------------------------|---------------------|
+#   | github-releases (pre-stage)    | any release tag                  | none                |
+#   | vs-marketplace                 | workflow_dispatch opt-in flag    | flag + approval     |
+#   | open-vsx                       | workflow_dispatch opt-in flag    | flag + approval     |
+#
+# A tag push NEVER reaches a marketplace. Promotion is a conscious act: dispatch with
+# publish-to-marketplaces=true, then approve the environment. Two independent layers,
+# matching how Fallout gates nuget.org.
+#
+#   gh workflow run publish.yml -f tag=v10.4.16 -f publish-to-marketplaces=true
+#
+# On release candidates: both registries reject semver prerelease versions, so an rc tag
+# produces an ordinary three-integer .vsix carrying a pre-release bit in its manifest, and
+# is published only as a GitHub pre-release. The -rc.N suffix lives on the tag alone.
+# Because an rc never reaches a marketplace, its version number stays free for the GA.
 #
 # Required repository secrets:
-#   VSCE_PAT               - Azure DevOps PAT, scope Marketplace > Manage (VS Marketplace)
-#   OVSX_TOKEN             - Open VSX access token (Eclipse Foundation account)
-#   FALLOUT_PACKAGES_TOKEN - token with read:packages, to restore Fallout -preview
-#                            packages (the build framework + CLI) from GitHub Packages
+#   VSCE_PAT   - Azure DevOps PAT, scope Marketplace > Manage (VS Marketplace)
+#   OVSX_TOKEN - Open VSX access token (Eclipse Foundation account)
 name: publish
 
 on:
   push:
     tags:
-      - 'v*'
-  # Manual dry-run: restore (incl. Fallout -preview from GitHub Packages) + compile +
-  # package, WITHOUT publishing. Validates the toolchain and secrets before tagging.
+      # Patterns must match the whole ref, so a stable tag cannot match the rc pattern
+      # or vice versa. Anything else (v10.4, v10.4.16-beta) triggers nothing.
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+'
+  # Manual path, for two scenarios:
+  #   1. Re-running a partial release after a transient failure (pick the tag, leave
+  #      publish-to-marketplaces at its default).
+  #   2. Promoting a released version to the marketplaces (pick the tag, set the flag).
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to (re-)release (e.g. v10.4.16)'
+        required: true
+      publish-to-marketplaces:
+        description: 'Publish to VS Marketplace + Open VSX? Default false — opt-in for promotion only.'
+        required: false
+        type: boolean
+        default: false
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  publish:
+  validate-ref:
+    name: validate ref
     runs-on: ubuntu-latest
+    if: github.event_name == 'push'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: 'Verify tag is reachable from a release branch'
+        run: |
+          set -euo pipefail
+          REACHABLE=$(git branch -r --contains "${{ github.sha }}" \
+            | grep -E 'origin/(main|release/v[0-9]+\.[0-9]+)$' || true)
+          if [ -z "$REACHABLE" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} is not reachable from main or a release/vX.Y branch."
+            exit 1
+          fi
+          echo "Tag ${GITHUB_REF_NAME} validated. Reachable from:"
+          echo "$REACHABLE"
+
+  pack:
+    name: pack
+    runs-on: ubuntu-latest
+    needs: [validate-ref]
+    # Runs when validate-ref succeeded (tag push) OR was skipped (workflow_dispatch).
+    if: always() && (needs.validate-ref.result == 'success' || needs.validate-ref.result == 'skipped')
+    outputs:
+      is-rc: ${{ steps.classify.outputs.is-rc }}
+      tag: ${{ steps.classify.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0           # Nerdbank.GitVersioning needs full history
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: npm
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
-      # Tag push -> Publish (both registries). Manual dispatch -> Pack only (dry-run).
-      - name: 'Fallout build'
-        run: ./build.sh ${{ github.event_name == 'push' && 'Publish' || 'Pack' }}
+
+      - name: Classify the trigger
+        id: classify
+        run: |
+          set -euo pipefail
+          TAG="${{ inputs.tag || github.ref_name }}"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          if [[ "$TAG" == *-rc.* ]]; then
+            echo 'is-rc=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'is-rc=false' >> "$GITHUB_OUTPUT"
+          fi
+
+      # An rc marks the package as a marketplace pre-release. Fallout resolves parameters
+      # from the environment, so PreRelease is passed that way.
+      #
+      # PublicRelease: we check out a tag above, so HEAD is detached and matches none of
+      # version.json's publicReleaseRefSpec entries (all branch refs — nbgv never matches
+      # that spec against refs/tags/*). Without this, NB.GV stamps a git-height suffix and
+      # the marketplace version would not be a clean triple.
+      - name: 'Fallout build (PackVsix)'
+        run: ./build.sh PackVsix
         env:
-          # Restores Fallout -preview (framework + CLI tool) from GitHub Packages.
-          FALLOUT_PACKAGES_TOKEN: ${{ secrets.FALLOUT_PACKAGES_TOKEN }}
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}
-          # ovsx reads OVSX_PAT from the environment; our secret is named OVSX_TOKEN.
-          OVSX_PAT: ${{ secrets.OVSX_TOKEN }}
-      # Dry-run only: prove the marketplace credentials + publisher/namespace align
-      # before a real tag, without publishing anything.
-      - name: 'Verify publish credentials'
+          PreRelease: ${{ steps.classify.outputs.is-rc }}
+          PublicRelease: true
+
+      # Prove the tokens still work before a promotion needs them. Publishes nothing.
+      - name: 'Verify marketplace credentials'
         if: github.event_name == 'workflow_dispatch'
+        run: ./build.sh VerifyVsixCredentials
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}
           OVSX_PAT: ${{ secrets.OVSX_TOKEN }}
-        run: |
-          npx vsce verify-pat fallout
-          npx ovsx verify-pat fallout
-      - name: Attach .vsix to the GitHub Release
-        if: github.event_name == 'push'
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: fallout-vsix
+          path: fallout.vsix
+          retention-days: 7
+          if-no-files-found: error
+
+  # Pre-stage. Every release tag lands here first, and this is the only channel a
+  # release candidate ever reaches.
+  publish-github-releases:
+    name: publish → GitHub Releases
+    runs-on: ubuntu-latest
+    needs: [pack]
+    if: always() && needs.pack.result == 'success'
+    permissions:
+      contents: write
+    environment:
+      name: github-releases
+      url: https://github.com/Fallout-build/Fallout.Extensions.VSCode/releases
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
+        with:
+          name: fallout-vsix
+      - name: 'Create or update the GitHub release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload "${GITHUB_REF_NAME}" fallout.vsix --clobber
+          TAG: ${{ needs.pack.outputs.tag }}
+          IS_RC: ${{ needs.pack.outputs.is-rc }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" > /dev/null 2>&1; then
+            echo "Release $TAG already exists — uploading asset with --clobber."
+            gh release upload "$TAG" fallout.vsix --clobber
+          else
+            # --generate-notes groups merged PRs by the label taxonomy in .github/release.yml.
+            ARGS=(--title "$TAG" --generate-notes --verify-tag)
+            if [ "$IS_RC" = "true" ]; then
+              ARGS+=(--prerelease)
+            fi
+            gh release create "$TAG" "${ARGS[@]}" fallout.vsix
+          fi
+
+  # Promotion tier. Opt-in flag AND environment approval, and never for a release
+  # candidate. See the header for why the condition tolerates a string 'true': a
+  # type: boolean input only arrives as a real boolean from the Actions UI, while the
+  # REST API — and therefore `gh workflow run` — can only send strings. Comparing a
+  # string to a boolean casts both to numbers, so a bare `== true` would silently skip
+  # every CLI-triggered promotion while still reporting success.
+  publish-vs-marketplace:
+    name: publish → VS Marketplace
+    runs-on: ubuntu-latest
+    needs: [pack]
+    if: >-
+      always() && needs.pack.result == 'success'
+      && needs.pack.outputs.is-rc == 'false'
+      && github.event_name == 'workflow_dispatch'
+      && (inputs.publish-to-marketplaces == true || inputs.publish-to-marketplaces == 'true')
+    environment:
+      name: vs-marketplace
+      url: https://marketplace.visualstudio.com/items?itemName=fallout.fallout
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+      - uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+      - uses: actions/download-artifact@v8
+        with:
+          name: fallout-vsix
+      # --skip PackVsix publishes the exact artifact that was packed and validated,
+      # rather than rebuilding it here and publishing bits nothing has seen.
+      - name: 'Fallout build (PublishVsix → vs-marketplace)'
+        run: ./build.sh PublishVsix --publish-vsix-to vs-marketplace --skip PackVsix
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+          PublicRelease: true
+
+  publish-open-vsx:
+    name: publish → Open VSX
+    runs-on: ubuntu-latest
+    needs: [pack]
+    if: >-
+      always() && needs.pack.result == 'success'
+      && needs.pack.outputs.is-rc == 'false'
+      && github.event_name == 'workflow_dispatch'
+      && (inputs.publish-to-marketplaces == true || inputs.publish-to-marketplaces == 'true')
+    environment:
+      name: open-vsx
+      url: https://open-vsx.org/extension/fallout/fallout
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+      - uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+      - uses: actions/download-artifact@v8
+        with:
+          name: fallout-vsix
+      - name: 'Fallout build (PublishVsix → open-vsx)'
+        run: ./build.sh PublishVsix --publish-vsix-to open-vsx --skip PackVsix
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_TOKEN }}
+          PublicRelease: true
diff --git a/.gitignore b/.gitignore
index ec73a56..a0343ba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,7 @@ out/
 *.vsix
 .vscode-test/
 
-# Fallout build
+# Fallout build (build/ is the build project, plugins/ the Fallout plugins it consumes)
 .fallout/temp/
-build/bin/
-build/obj/
+bin/
+obj/
diff --git a/.vscodeignore b/.vscodeignore
index d1357a5..303531f 100644
--- a/.vscodeignore
+++ b/.vscodeignore
@@ -11,11 +11,15 @@ tsconfig.json
 # Fallout build scaffold — build/publish tooling, not part of the shipped extension.
 .fallout/**
 build/**
+plugins/**
 .config/**
 global.json
 nuget.config
+version.json
 build.ps1
 build.sh
+# Maintainer-facing; the marketplace page renders README.md + CHANGELOG.md only.
+RELEASING.md
 
 # Ship only Mermaid's self-contained UMD bundle (loaded by the graph webview via a
 # classic <script> tag), not its entire dependency tree or the code-split ESM build.
diff --git a/CHANGELOG.md b/CHANGELOG.md
deleted file mode 100644
index 8a75e4d..0000000
--- a/CHANGELOG.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Changelog
-
-## 2026.1.0
-
-Initial release.
-
-- **Targets view** in the activity bar — lists build targets from `build-graph.json`, showing the default target, unlisted targets, and each target's `depends on` / `runs after` / `triggered by` / `triggers` relations as expandable children.
-- **Run Target** — runs a target in an integrated `Fallout` terminal via `./build.ps1` (Windows) or `./build.sh`.
-- **Go to Definition** — jumps to a target's C# declaration, using the workspace symbol provider with a regex fallback over `.cs` files.
-- **Build Graph** — a Mermaid webview rendering the dependency graph; click a node to run that target.
-- Live refresh: watches `build-graph.json` and updates the view and graph on change.
diff --git a/README.md b/README.md
index 6c00e77..c0786c8 100644
--- a/README.md
+++ b/README.md
@@ -12,11 +12,13 @@ Explore, run, and visualize your [Fallout](https://github.com/Fallout-build/Fall
 
 ## Requirements
 
-The extension reads a `build-graph.json` emitted by the Fallout build into `.fallout/temp/` (or the legacy `.nuke/temp/`). Run the build once (e.g. `./build.ps1 --plan`) to generate it.
+**Fallout 10.4.0 or later.** The extension reads a `build-graph.json` that the Fallout build writes into `.fallout/temp/` (or the legacy `.nuke/temp/`) on every build initialization — the emission landed in 10.4.0, so older framework versions produce no graph at all. Run the build once (e.g. `./build.ps1 --plan`) to generate it.
 
 ## Versioning
 
-The extension's `major.minor` track the Fallout framework version it targets; the patch moves independently. A mismatch between the extension and the framework your workspace builds with surfaces as a non-blocking warning.
+The extension's `major.minor` track the Fallout framework release line it targets — 10.4.x builds against Fallout 10.4 — while the patch moves independently. A mismatch between the extension and the framework your workspace builds with surfaces as a non-blocking warning.
+
+Versions are computed by [Nerdbank.GitVersioning](https://github.com/dotnet/Nerdbank.GitVersioning) from `version.json`, the same as the framework itself; the build fails if the declared line drifts from the Fallout version it actually references. Release candidates are published as GitHub pre-releases only — see [RELEASING.md](RELEASING.md).
 
 ## License
 
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..f3fe702
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,94 @@
+# Releasing
+
+Maintainer reference. Mirrors the Fallout repo's [branching-and-release](https://github.com/Fallout-build/Fallout/blob/main/docs/branching-and-release.md) model, adapted to extension marketplaces.
+
+## Versioning
+
+[Nerdbank.GitVersioning](https://github.com/dotnet/Nerdbank.GitVersioning) computes the version from `version.json`, as in the framework repo.
+
+- `version.json`'s `version` pins the **Fallout release line** this extension targets (`10.4`). The third component is the git height and moves on its own.
+- The build asserts the declared line still matches the referenced `Fallout.Common`. Bumping one without the other fails the build rather than shipping a version that misstates its target.
+- `versionHeightOffset` exists because height restarts when `version.json` is introduced or its `version` changes. Marketplace versions must increase monotonically, so the offset keeps the sequence moving forward.
+
+Check what will be produced:
+
+```bash
+dotnet nbgv get-version
+```
+
+### Why release candidates aren't `-rc.N`
+
+Both registries take **exactly three integers**. `vsce` refuses a semver prerelease outright:
+
+> The VS Marketplace doesn't support prerelease versions
+
+So an RC is an ordinary triple carrying a pre-release bit in the VSIX manifest (`Microsoft.VisualStudio.Code.PreRelease`), and the `-rc.N` suffix lives only on the git tag and the GitHub release.
+
+The consequence that shapes the whole pipeline: **a version is pre-release or stable, never both.** Publishing `10.4.16` as a marketplace pre-release would burn that number, forcing GA to `10.4.17`. Release candidates therefore never reach a marketplace — they stop at GitHub, and the number stays free.
+
+## Channels
+
+GitHub is the pre-stage; each marketplace is a promotion target with its own environment.
+
+| Channel | Trigger | Gating |
+|---|---|---|
+| `github-releases` | any release tag | none |
+| `vs-marketplace` | `workflow_dispatch` opt-in flag | flag + approval |
+| `open-vsx` | `workflow_dispatch` opt-in flag | flag + approval |
+
+A tag push **never** reaches a marketplace. Promotion is deliberate: set the flag, then approve the environment — two independent layers, matching how Fallout gates nuget.org.
+
+## Cutting a release candidate
+
+```bash
+git switch main && git pull --ff-only
+dotnet nbgv get-version          # the number this release will carry
+gh release create v10.4.16-rc.1 --target main --prerelease --generate-notes
+```
+
+The tag must match the version `nbgv` computes for that commit — the workflow packages from the checked-out tag, not from the tag name, so a mismatch ships a `.vsix` whose version disagrees with its release.
+
+The tag push builds the `.vsix` with the pre-release bit set and attaches it to a GitHub pre-release. Install it with **Extensions: Install from VSIX…** to dogfood.
+
+## Cutting a stable release
+
+```bash
+gh release create v10.4.16 --target main --generate-notes
+```
+
+That publishes to GitHub Releases only. To then promote to the marketplaces:
+
+```bash
+gh workflow run publish.yml -f tag=v10.4.16 -f publish-to-marketplaces=true
+```
+
+Both `vs-marketplace` and `open-vsx` pause for approval on the run page (*Review deployments*). Approve each. The job publishes the exact artifact the `pack` job produced (`--skip PackVsix`), not a rebuild.
+
+You can rehearse the wiring without burning a release: set the flag, wait for the approval prompt, then cancel without approving.
+
+## If a publish fails partway
+
+Both CLIs are invoked with `--skip-duplicate`, so re-running is idempotent on whatever already landed:
+
+```bash
+gh workflow run publish.yml -f tag=v10.4.16 -f publish-to-marketplaces=true
+```
+
+## Release notes
+
+Generated by GitHub from merged PR labels — the taxonomy lives in [`.github/release.yml`](.github/release.yml) and matches the Fallout repo's. Apply one category label per PR (`enhancement`, `bug`, `breaking-change`, `security`, `documentation`, `dependencies`), or `skip-changelog` for housekeeping.
+
+There is no `CHANGELOG.md`. The labels are the changelog — a hand-maintained file would duplicate them, and its version heading could not be written correctly in advance since the patch is a git height. If the marketplace page ever needs a rendered changelog, it should be **generated into the `.vsix` at pack time** from these notes, not reinstated as a tracked file.
+
+## Tokens
+
+| Secret | Used by | Scope |
+|---|---|---|
+| `VSCE_PAT` | `vs-marketplace` | Azure DevOps PAT, Marketplace > Manage |
+| `OVSX_TOKEN` | `open-vsx` | Open VSX access token (mapped to `OVSX_PAT`) |
+
+Both are read from the environment by the CLIs, never passed as process arguments. Verify them without publishing:
+
+```bash
+dotnet fallout VerifyVsixCredentials
+```
diff --git a/build/Build.CI.GitHubActions.cs b/build/Build.CI.GitHubActions.cs
new file mode 100644
index 0000000..c534577
--- /dev/null
+++ b/build/Build.CI.GitHubActions.cs
@@ -0,0 +1,38 @@
+using Fallout.Common.CI.GitHubActions;
+using Fallout.Vsce;
+
+// The PR gate is GENERATED from the attribute below — edit here and regenerate
+// (`./build.ps1`), never hand-edit `.github/workflows/build.yml`.
+//
+// Node is not installed by the generated workflow: the [GitHubActions] generator emits
+// checkout / cache / setup-dotnet and nothing else, with no hook for extra steps. The
+// gate therefore runs on the Node preinstalled on ubuntu-latest, which is current enough
+// for `npm ci` + `tsc` + `vsce`. That is fine for a gate and not fine for a release,
+// which is the first of two reasons publish.yml is hand-written.
+//
+// The second is shape: publish.yml fans out into per-channel jobs bound to GitHub
+// Environments with approval gates, passing one artifact between them. The attribute
+// generator emits a single job per image and has no notion of any of that.
+//
+// This mirrors how the framework repo splits it — Fallout generates build.yml /
+// build-cross-platform.yml and hand-writes publish-packages-preview.yml /
+// publish-packages-release.yml, for the same category of reason (see
+// Fallout's build/Build.CI.GitHubActions.cs).
+//
+// What matters either way: the *build* is defined in C#. Both workflows only provision
+// toolchains and route channels — every step that does something is a Fallout target.
+[GitHubActions(
+    "build",
+    GitHubActionsImage.UbuntuLatest,
+    FetchDepth = 0,                                    // Nerdbank.GitVersioning needs full history
+    ConcurrencyGroup = "${{ github.workflow }}-${{ github.ref }}",
+    ConcurrencyCancelInProgress = true,
+    CheckoutRef = "${{ github.head_ref }}",
+    OnPullRequestBranches = [MainBranch],
+    OnPullRequestExcludePaths = ["**/*.md", ".github/**", "!.github/workflows/**"],
+    InvokedTargets = [nameof(IPackVsix.PackVsix)],
+    PublishArtifacts = false)]
+partial class Build
+{
+    const string MainBranch = "main";
+}
diff --git a/build/Build.cs b/build/Build.cs
index 2614f78..53aa2de 100644
--- a/build/Build.cs
+++ b/build/Build.cs
@@ -1,83 +1,87 @@
-using System.Linq;
+using System.Collections.Generic;
 using System.Reflection;
 using Fallout.Common;
-using Fallout.Common.IO;
-using static Fallout.Common.Tools.Npm.NpmTasks;
+using Fallout.Common.Tools.NerdbankGitVersioning;
+using Fallout.Vsce;
 
-// Dogfood: the extension's own build/publish pipeline is a Fallout build. It drives the
-// Node toolchain (npm scripts wrapping tsc / vsce / ovsx) rather than reimplementing it —
-// Fallout as a general orchestrator, not just a .NET build tool.
+// Dogfood: the extension's own build/publish pipeline is a Fallout build, and the vsce/ovsx
+// toolchain it drives is a Fallout plugin (plugins/Fallout.Vsce) rather than anything baked
+// into the framework. Fallout as a general orchestrator, not just a .NET build tool.
 //
-//   dotnet fallout Pack       -> produces fallout.vsix
-//   dotnet fallout Publish    -> publishes to VS Marketplace + Open VSX
+//   dotnet fallout PackVsix                  -> produces fallout.vsix
+//   dotnet fallout VerifyVsixCredentials     -> proves the tokens work, publishes nothing
+//   dotnet fallout PublishVsix               -> publishes to every configured registry
+//   dotnet fallout PublishVsix --publish-vsix-to open-vsx   -> just that one
 //
-// Marketplace tokens are read from the environment by vsce (VSCE_PAT) and ovsx (OVSX_PAT);
-// this build never handles them directly.
-class Build : FalloutBuild
+// Registry tokens are read from the environment by the CLIs themselves (VSCE_PAT / OVSX_PAT);
+// this build never handles them, so they stay out of process argument lists and logs.
+partial class Build : FalloutBuild, IPublishVsix
 {
-    public static int Main() => Execute<Build>(x => x.Pack);
+    public static int Main() => Execute<Build>(x => ((IPackVsix)x).PackVsix);
 
-    Target Restore => _ => _
-        .Executes(() =>
-        {
-            Npm("ci", workingDirectory: RootDirectory);
-        });
+    /// <summary>Publisher on the VS Marketplace and namespace on Open VSX.</summary>
+    const string Publisher = "fallout";
 
-    Target Compile => _ => _
-        .DependsOn(Restore)
-        .Executes(() =>
-        {
-            Npm("run compile", workingDirectory: RootDirectory);
-        });
+    /// <summary>
+    /// Marks this build's package as a marketplace pre-release. Kept independent of the
+    /// version because a marketplace version cannot express prerelease-ness: a release
+    /// candidate is a plain triple plus a manifest bit. Set by the rc path in CI.
+    /// </summary>
+    [Parameter("Mark the packaged extension as a marketplace pre-release")]
+    readonly bool PreRelease;
 
-    Target Pack => _ => _
-        .DependsOn(Compile)
-        .Executes(() =>
-        {
-            var (version, preRelease) = FrameworkVersion();
-            Serilog.Log.Information("Packaging extension as {Version} (pre-release: {PreRelease})", version, preRelease);
-            Npm(
-                $"run package -- {version} --no-update-package-json --no-git-tag-version"
-                + (preRelease ? " --pre-release" : ""),
-                workingDirectory: RootDirectory);
-        });
+    // Versioning matches the framework's own: Nerdbank.GitVersioning over version.json.
+    [NerdbankGitVersioning] readonly NerdbankGitVersioning Versioning;
 
-    Target PublishMarketplace => _ => _
-        .DependsOn(Pack)
-        .Executes(() =>
-        {
-            Npm("run publish:vsce", workingDirectory: RootDirectory);
-        });
+    bool IPackVsix.VsixPreRelease => PreRelease;
 
-    Target PublishOpenVsx => _ => _
-        .DependsOn(Pack)
-        .Executes(() =>
+    string IPackVsix.VsixVersion
+    {
+        get
         {
-            Npm("run publish:ovsx", workingDirectory: RootDirectory);
-        });
+            var (version, _) = MarketplaceVersion.FromNerdbankGitVersioning(Versioning, PreRelease);
+            AssertFrameworkLineMatches(version);
+            return version;
+        }
+    }
 
-    Target Publish => _ => _
-        .DependsOn(PublishMarketplace, PublishOpenVsx);
+    IEnumerable<VsixPublishTarget> IPublishVsix.VsixPublishTargets =>
+    [
+        new VsixPublishTarget
+        {
+            Name = "vs-marketplace",
+            Registry = VsixRegistry.VisualStudioMarketplace,
+            Publisher = Publisher
+        },
+        new VsixPublishTarget
+        {
+            Name = "open-vsx",
+            Registry = VsixRegistry.OpenVsx,
+            Publisher = Publisher
+        }
+    ];
 
-    // The extension version tracks the Fallout framework it was built against — the pinned
-    // Fallout.Common package, read back from the loaded assembly. Marketplaces accept only
-    // three integers, so a preview (X.Y.Z-preview.N) maps to X.Y.N and is marked pre-release;
-    // a stable release (X.Y.Z) is used verbatim.
-    static (string Version, bool PreRelease) FrameworkVersion()
+    /// <summary>
+    /// The extension's major.minor are a promise about which Fallout release line it targets —
+    /// README documents it, and model.ts warns the user at runtime when the workspace's
+    /// framework drifts from it. version.json states that line; the pinned Fallout.Common
+    /// package is what the extension was actually built against. Nothing keeps the two in step
+    /// automatically, so bumping one and forgetting the other would ship a version that lies.
+    /// </summary>
+    void AssertFrameworkLineMatches(string version)
     {
         var info = typeof(FalloutBuild).Assembly
             .GetCustomAttribute<AssemblyInformationalVersionAttribute>()
             ?.InformationalVersion ?? "0.0.0";
 
-        var core = info.Split('+')[0];
-        var dash = core.IndexOf('-');
-        if (dash < 0)
-            return (core, false);
+        var framework = MarketplaceVersion.Normalize(info);
+
+        var declared = version.Split('.');
+        var actual = framework.Split('.');
 
-        var parts = core[..dash].Split('.');
-        var major = parts.ElementAtOrDefault(0) ?? "0";
-        var minor = parts.ElementAtOrDefault(1) ?? "0";
-        var height = core[(dash + 1)..].Split('.').FirstOrDefault(p => int.TryParse(p, out _)) ?? "0";
-        return ($"{major}.{minor}.{height}", true);
+        Assert.True(declared[0] == actual[0] && declared[1] == actual[1],
+            $"Version line mismatch: version.json declares {declared[0]}.{declared[1]}.x but the build "
+            + $"references Fallout {framework}. Update version.json's \"version\" and the pinned "
+            + "Fallout.Common together, or the published extension misstates which framework it targets.");
     }
 }
diff --git a/build/_build.csproj b/build/_build.csproj
index 91152fc..4c0ac71 100644
--- a/build/_build.csproj
+++ b/build/_build.csproj
@@ -13,7 +13,16 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Fallout.Common" Version="2026.1.0-preview.104.g6583d78d2c" />
+    <PackageReference Include="Fallout.Common" Version="10.4.0" />
+    <!-- Versioning tool, resolved out of the package folder by [NuGetTool]. Downloaded rather
+         than referenced: it is a CLI the build shells out to, not a library it compiles against. -->
+    <PackageDownload Include="nbgv" Version="[3.10.91]" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <!-- The vsce/ovsx toolchain, as a Fallout plugin. ProjectReference while the surface
+         settles; swap for a PackageReference once it is published to a feed. -->
+    <ProjectReference Include="../plugins/Fallout.Vsce/Fallout.Vsce.csproj" />
   </ItemGroup>
 
 </Project>
diff --git a/nuget.config b/nuget.config
index 17e11e2..e80b5a2 100644
--- a/nuget.config
+++ b/nuget.config
@@ -1,25 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <configuration>
   <packageSources>
+    <!-- Cleared so a machine-level feed can't shadow the pinned Fallout packages.
+         Fallout 10.4.0 (framework + CLI) ships on nuget.org, so that is the only
+         source needed — the private GitHub Packages feed the -preview dogfood
+         builds required is gone, along with its token. -->
     <clear />
     <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
-    <!-- Dogfood: consume the current Fallout -preview packages, not a stale nuget.org release. -->
-    <add key="github" value="https://nuget.pkg.github.com/Fallout-build/index.json" protocolVersion="3" />
   </packageSources>
-  <packageSourceCredentials>
-    <github>
-      <add key="Username" value="fallout-build" />
-      <add key="ClearTextPassword" value="%FALLOUT_PACKAGES_TOKEN%" />
-    </github>
-  </packageSourceCredentials>
-  <packageSourceMapping>
-    <clear />
-    <packageSource key="nuget.org">
-      <package pattern="*" />
-    </packageSource>
-    <packageSource key="github">
-      <package pattern="Fallout.*" />
-      <package pattern="Nuke.*" />
-    </packageSource>
-  </packageSourceMapping>
 </configuration>
diff --git a/package.json b/package.json
index a27ed56..39f5f4f 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
     "name": "fallout",
     "displayName": "Fallout",
     "description": "Explore, run, and visualize your Fallout (NUKE successor) build targets from VS Code.",
-    "version": "2026.1.0",
+    "version": "0.0.0",
     "publisher": "fallout",
     "license": "MIT",
     "icon": "media/icon.png",
@@ -22,10 +22,10 @@
     ],
     "repository": {
         "type": "git",
-        "url": "https://github.com/Fallout-build/fallout-vscode.git"
+        "url": "https://github.com/Fallout-build/Fallout.Extensions.VSCode.git"
     },
     "bugs": {
-        "url": "https://github.com/Fallout-build/fallout-vscode/issues"
+        "url": "https://github.com/Fallout-build/Fallout.Extensions.VSCode/issues"
     },
     "homepage": "https://fallout.build",
     "main": "./out/extension.js",
@@ -132,10 +132,7 @@
     "scripts": {
         "vscode:prepublish": "npm run compile",
         "compile": "tsc -p ./",
-        "watch": "tsc -watch -p ./",
-        "package": "vsce package --out fallout.vsix",
-        "publish:vsce": "vsce publish --packagePath fallout.vsix",
-        "publish:ovsx": "ovsx publish fallout.vsix"
+        "watch": "tsc -watch -p ./"
     },
     "dependencies": {
         "mermaid": "^11.4.1"
diff --git a/plugins/Fallout.Vsce/Fallout.Vsce.csproj b/plugins/Fallout.Vsce/Fallout.Vsce.csproj
new file mode 100644
index 0000000..62e59b2
--- /dev/null
+++ b/plugins/Fallout.Vsce/Fallout.Vsce.csproj
@@ -0,0 +1,38 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <!--
+    First-party Fallout plugin: the VS Code extension toolchain (vsce + ovsx).
+
+    Deliberately NOT in the Fallout repo. This is the pilot for shipping provider
+    integrations as plugins on top of the framework rather than in-tree components
+    (ADR-0001 calls Octopus the first such plugin; this is the smaller sibling that
+    proves the shape first). Referenced from build/_build.csproj as a ProjectReference
+    while the surface settles; packable so it can be extracted to its own feed
+    without a rewrite.
+  -->
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>latest</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>false</ImplicitUsings>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+    <UseArtifactsOutput>false</UseArtifactsOutput>
+    <!-- CS0649: settings properties are assigned through the options builder, not directly. -->
+    <NoWarn>CS0649;CA1050;CA1822</NoWarn>
+
+    <PackageId>Fallout.Vsce</PackageId>
+    <Description>Fallout build components and tool wrappers for the VS Code extension toolchain (vsce, ovsx).</Description>
+    <Authors>Fallout.build</Authors>
+    <PackageLicenseExpression>MIT</PackageLicenseExpression>
+    <PackageProjectUrl>https://github.com/Fallout-build/Fallout.Extensions.VSCode</PackageProjectUrl>
+    <IsPackable>true</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Fallout.Common only: the components here mirror Fallout.Components' shape but do not
+         depend on it, so a consumer can take this plugin without pulling that package in. -->
+    <PackageReference Include="Fallout.Common" Version="10.4.0" />
+  </ItemGroup>
+
+</Project>
diff --git a/plugins/Fallout.Vsce/IPackVsix.cs b/plugins/Fallout.Vsce/IPackVsix.cs
new file mode 100644
index 0000000..d863626
--- /dev/null
+++ b/plugins/Fallout.Vsce/IPackVsix.cs
@@ -0,0 +1,98 @@
+using Fallout.Common;
+using Fallout.Common.IO;
+using Fallout.Common.Tooling;
+using Fallout.Common.Utilities;
+using static Fallout.Common.Tools.Npm.NpmTasks;
+
+namespace Fallout.Vsce;
+
+/// <summary>
+/// Locates the VS Code extension in the repository and the toolchain that builds it.
+/// <para/>
+/// <c>vsce</c> and <c>ovsx</c> are conventionally dev dependencies rather than global
+/// installs, so the default tool paths point at <c>node_modules/.bin</c> and only fall back
+/// to <c>PATH</c> when the local binary is absent.
+/// </summary>
+public interface IHasVsix : IFalloutBuild
+{
+    /// <summary>Directory holding <c>package.json</c>. Defaults to the repository root.</summary>
+    AbsolutePath VsixDirectory => RootDirectory;
+
+    /// <summary>Path of the packaged <c>.vsix</c>.</summary>
+    AbsolutePath VsixFile => VsixDirectory / "fallout.vsix";
+
+    /// <summary>Locally-installed CLI directory.</summary>
+    AbsolutePath NodeModulesBinDirectory => VsixDirectory / "node_modules" / ".bin";
+
+    /// <summary>Resolves a locally-installed npm CLI, falling back to <c>PATH</c>.</summary>
+    sealed string ResolveNodeTool(string name)
+    {
+        // npm writes a .cmd shim next to the extensionless shell script on Windows; invoking
+        // the extensionless one there starts a shell, not the tool.
+        var local = NodeModulesBinDirectory / (EnvironmentInfo.IsWin ? $"{name}.cmd" : name);
+        return local.FileExists() ? local.ToString() : name;
+    }
+
+    /// <summary>Path to the <c>vsce</c> CLI.</summary>
+    string VsceToolPath => ResolveNodeTool(VsceTasks.PathExecutable);
+
+    /// <summary>Path to the <c>ovsx</c> CLI.</summary>
+    string OvsxToolPath => ResolveNodeTool(OvsxTasks.PathExecutable);
+}
+
+/// <summary>
+/// Restores, compiles, and packages a VS Code extension into a <c>.vsix</c>.
+/// <para/>
+/// Compilation is delegated to the project's own npm scripts rather than reimplemented — the
+/// TypeScript toolchain is already described in <c>package.json</c>, and duplicating it in C#
+/// would create a second source of truth that drifts.
+/// </summary>
+public interface IPackVsix : IHasVsix
+{
+    /// <summary>Version stamped into the package. Must be three integers — see <see cref="MarketplaceVersion"/>.</summary>
+    string VsixVersion { get; }
+
+    /// <summary>
+    /// Marks the package as a marketplace pre-release. Independent of <see cref="VsixVersion"/>,
+    /// because a marketplace version cannot itself express prerelease-ness.
+    /// </summary>
+    bool VsixPreRelease => false;
+
+    /// <summary>npm script that compiles the extension.</summary>
+    string CompileScript => "compile";
+
+    /// <summary>Installs the Node toolchain from the lockfile.</summary>
+    Target RestoreVsix => _ => _
+        .Executes(() => Npm("ci", workingDirectory: VsixDirectory));
+
+    /// <summary>Compiles the extension via its own npm script.</summary>
+    Target CompileVsix => _ => _
+        .DependsOn(RestoreVsix)
+        .Executes(() => Npm($"run {CompileScript}", workingDirectory: VsixDirectory));
+
+    /// <summary>Packages the compiled extension into a <c>.vsix</c>.</summary>
+    Target PackVsix => _ => _
+        .DependsOn(CompileVsix)
+        .Executes(() =>
+        {
+            // Not .Requires(): that is for injected parameters, and VsixVersion is computed by
+            // the consuming build (from Nerdbank.GitVersioning, a constant, whatever it likes).
+            Assert.True(!VsixVersion.IsNullOrWhiteSpace(),
+                "IPackVsix.VsixVersion resolved to nothing — the consuming build must supply a version.");
+
+            var version = MarketplaceVersion.Normalize(VsixVersion);
+            Serilog.Log.Information(
+                "Packaging {File} as {Version} (pre-release: {PreRelease})", VsixFile.Name, version, VsixPreRelease);
+
+            VsceTasks.VscePackage(_ => _
+                .SetProcessToolPath(VsceToolPath)
+                .SetProcessWorkingDirectory(VsixDirectory)
+                .SetVersion(version)
+                .SetOutput(VsixFile)
+                // package.json stays the source of truth for everything but the version, which
+                // the build computes; writing it back would dirty the tree on every CI run.
+                .EnableNoUpdatePackageJson()
+                .EnableNoGitTagVersion()
+                .SetPreRelease(VsixPreRelease ? true : (bool?)null));
+        });
+}
diff --git a/plugins/Fallout.Vsce/IPublishVsix.cs b/plugins/Fallout.Vsce/IPublishVsix.cs
new file mode 100644
index 0000000..3d70e6e
--- /dev/null
+++ b/plugins/Fallout.Vsce/IPublishVsix.cs
@@ -0,0 +1,130 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Fallout.Common;
+using Fallout.Common.Tooling;
+using Fallout.Common.Utilities;
+using Fallout.Common.Utilities.Collections;
+
+namespace Fallout.Vsce;
+
+/// <summary>
+/// Fans one packaged <c>.vsix</c> out across extension registries.
+/// <para/>
+/// Mirrors <c>Fallout.Components.IPublish</c>: destinations are declared as data
+/// (<see cref="VsixPublishTargets"/>), a CLI selector narrows them for a given run
+/// (<see cref="PublishVsixTo"/>), and every selected target is validated before anything is
+/// pushed — a missing credential is a configuration error knowable up front, not something to
+/// discover after half the registries have already accepted the release.
+/// </summary>
+public interface IPublishVsix : IPackVsix
+{
+    /// <summary>Registries this build publishes to. Override to add or re-route destinations.</summary>
+    IEnumerable<VsixPublishTarget> VsixPublishTargets => Array.Empty<VsixPublishTarget>();
+
+    /// <summary>
+    /// Names of the configured <see cref="VsixPublishTargets"/> to push to this run; empty
+    /// selects all. Wire from the CLI as <c>--publish-vsix-to vs-marketplace</c>.
+    /// </summary>
+    [Parameter("Publish only to these named registries (default: all configured VsixPublishTargets).")]
+    string[] PublishVsixTo => TryGetValue(() => PublishVsixTo) ?? Array.Empty<string>();
+
+    /// <summary>Resolves the selector against the configured targets, asserting the result is usable.</summary>
+    sealed IReadOnlyList<VsixPublishTarget> SelectedVsixPublishTargets()
+    {
+        var configured = VsixPublishTargets.ToList();
+        var selection = PublishVsixTo;
+
+        var targets = selection.Length == 0
+            ? configured
+            : configured.Where(x => selection.Contains(x.Name, StringComparer.OrdinalIgnoreCase)).ToList();
+
+        Assert.True(targets.Count > 0,
+            selection.Length == 0
+                ? "No publish targets are configured — override IPublishVsix.VsixPublishTargets."
+                : $"--publish-vsix-to [{selection.JoinComma()}] matched none of the configured targets [{configured.Select(x => x.Name).JoinComma()}].");
+
+        return targets;
+    }
+
+    /// <summary>
+    /// Proves each selected registry would accept a publish, without publishing. Worth running
+    /// before a tag: a token that expired since the last release otherwise surfaces halfway
+    /// through the real release, with some registries already updated.
+    /// </summary>
+    Target VerifyVsixCredentials => _ => _
+        .Executes(() =>
+        {
+            foreach (var target in SelectedVsixPublishTargets())
+            {
+                Assert.True(!target.Publisher.IsNullOrWhiteSpace(),
+                    $"Publish target '{target.Name}' has no Publisher — required to verify credentials.");
+
+                Serilog.Log.Information("Verifying credentials for {Target} ({Publisher}).", target.Name, target.Publisher);
+
+                switch (target.Registry)
+                {
+                    case VsixRegistry.VisualStudioMarketplace:
+                        VsceTasks.VsceVerifyPat(_ => _
+                            .SetProcessToolPath(VsceToolPath)
+                            .SetProcessWorkingDirectory(VsixDirectory)
+                            .SetPublisher(target.Publisher!)
+                            .When(target.Pat is not null, _ => _.SetPat(target.Pat!)));
+                        break;
+
+                    case VsixRegistry.OpenVsx:
+                        OvsxTasks.OvsxVerifyPat(_ => _
+                            .SetProcessToolPath(OvsxToolPath)
+                            .SetProcessWorkingDirectory(VsixDirectory)
+                            .SetNamespace(target.Publisher!)
+                            .When(target.Pat is not null, _ => _.SetPat(target.Pat!)));
+                        break;
+
+                    default:
+                        throw new NotSupportedException($"Unknown registry '{target.Registry}'.");
+                }
+            }
+        });
+
+    /// <summary>Publishes the packaged <c>.vsix</c> to every selected registry.</summary>
+    Target PublishVsix => _ => _
+        .DependsOn(PackVsix)
+        .Executes(() =>
+        {
+            var targets = SelectedVsixPublishTargets();
+            Assert.FileExists(VsixFile);
+
+            foreach (var target in targets)
+            {
+                Serilog.Log.Information("Publish target {Target}: pushing {File} → {Registry}.",
+                    target.Name, VsixFile.Name, target.Registry);
+
+                switch (target.Registry)
+                {
+                    case VsixRegistry.VisualStudioMarketplace:
+                        VsceTasks.VscePublish(_ => _
+                            .SetProcessToolPath(VsceToolPath)
+                            .SetProcessWorkingDirectory(VsixDirectory)
+                            .SetPackagePath(VsixFile)
+                            .When(target.Pat is not null, _ => _.SetPat(target.Pat!))
+                            .When(target.SkipDuplicate, _ => _.SetSkipDuplicate(true))
+                            // Only an assertion against the manifest on a --packagePath publish;
+                            // the bit baked in at package time is what actually decides.
+                            .SetPreRelease(VsixPreRelease ? true : (bool?)null));
+                        break;
+
+                    case VsixRegistry.OpenVsx:
+                        OvsxTasks.OvsxPublish(_ => _
+                            .SetProcessToolPath(OvsxToolPath)
+                            .SetProcessWorkingDirectory(VsixDirectory)
+                            .SetExtensionFile(VsixFile)
+                            .When(target.Pat is not null, _ => _.SetPat(target.Pat!))
+                            .When(target.SkipDuplicate, _ => _.SetSkipDuplicate(true)));
+                        break;
+
+                    default:
+                        throw new NotSupportedException($"Unknown registry '{target.Registry}'.");
+                }
+            }
+        });
+}
diff --git a/plugins/Fallout.Vsce/MarketplaceVersion.cs b/plugins/Fallout.Vsce/MarketplaceVersion.cs
new file mode 100644
index 0000000..2a12ea0
--- /dev/null
+++ b/plugins/Fallout.Vsce/MarketplaceVersion.cs
@@ -0,0 +1,73 @@
+using System;
+using System.Linq;
+using Fallout.Common.Tools.NerdbankGitVersioning;
+
+namespace Fallout.Vsce;
+
+/// <summary>
+/// Maps a semantic version onto what the extension marketplaces actually accept.
+/// <para/>
+/// Both registries take <b>exactly three integers</b> and nothing else. vsce refuses a
+/// semver prerelease outright — <c>semver.prerelease(manifest.version)</c> throws
+/// <i>"The VS Marketplace doesn't support prerelease versions"</i> — so <c>10.4.16-rc.1</c>
+/// can never be published. A release candidate is therefore an ordinary triple carrying a
+/// pre-release bit in the VSIX manifest, and the <c>-rc.N</c> suffix lives only on the git
+/// tag and the GitHub release.
+/// <para/>
+/// The consequence worth knowing before you publish: a given version is pre-release
+/// <i>or</i> stable and can never be both. Publishing <c>10.4.16</c> as a pre-release burns
+/// that number — the stable release then has to be <c>10.4.17</c>. This is why the release
+/// pipeline keeps release candidates on GitHub and off the marketplaces entirely.
+/// </summary>
+public static class MarketplaceVersion
+{
+    /// <summary>
+    /// Derives the marketplace version from Nerdbank.GitVersioning, matching how the Fallout
+    /// framework itself versions. <paramref name="preRelease"/> forces the pre-release bit on
+    /// independently of the computed version — an extension RC is a decision about this
+    /// release, not a property of the version string, precisely because the version string
+    /// cannot carry it.
+    /// </summary>
+    public static (string Version, bool PreRelease) FromNerdbankGitVersioning(
+        NerdbankGitVersioning versioning,
+        bool preRelease = false)
+    {
+        if (versioning is null)
+            throw new ArgumentNullException(nameof(versioning));
+
+        var source = !string.IsNullOrWhiteSpace(versioning.SimpleVersion)
+            ? versioning.SimpleVersion
+            : versioning.Version;
+
+        return (Normalize(source),
+            preRelease || !string.IsNullOrEmpty(versioning.PrereleaseVersion));
+    }
+
+    /// <summary>
+    /// Reduces any version string to the three-integer form the marketplaces accept.
+    /// <para/>
+    /// Nerdbank.GitVersioning stamps stable builds with four components
+    /// (<c>10.4.0.15</c>), which is not valid semver and fails marketplace validation, so the
+    /// fourth is dropped. Prerelease and build-metadata suffixes are stripped for the same
+    /// reason. Missing components are zero-filled: <c>10.4</c> becomes <c>10.4.0</c>.
+    /// </summary>
+    public static string Normalize(string version)
+    {
+        if (string.IsNullOrWhiteSpace(version))
+            throw new ArgumentException("Version must not be empty.", nameof(version));
+
+        // Strip build metadata (+g<sha>) then any prerelease tag (-rc.1).
+        var core = version.Split('+')[0].Split('-')[0];
+
+        var parts = core
+            .Split('.')
+            .TakeWhile(x => int.TryParse(x, out _))
+            .Take(3)
+            .ToArray();
+
+        if (parts.Length == 0)
+            throw new ArgumentException($"Cannot derive a marketplace version from '{version}'.", nameof(version));
+
+        return string.Join(".", Enumerable.Range(0, 3).Select(i => parts.ElementAtOrDefault(i) ?? "0"));
+    }
+}
diff --git a/plugins/Fallout.Vsce/OvsxTasks.cs b/plugins/Fallout.Vsce/OvsxTasks.cs
new file mode 100644
index 0000000..2feadd0
--- /dev/null
+++ b/plugins/Fallout.Vsce/OvsxTasks.cs
@@ -0,0 +1,134 @@
+// See VsceTasks.cs for why this wrapper is hand-written rather than generated.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.CodeAnalysis;
+using Fallout.Common;
+using Fallout.Common.Tooling;
+
+namespace Fallout.Vsce;
+
+/// <summary>
+/// <p><a href="https://github.com/eclipse/openvsx">ovsx</a> — the Open VSX registry CLI, the
+/// vendor-neutral marketplace used by VS Code forks (VSCodium, Gitpod, Cursor).</p>
+/// <p>Publishing a prepackaged <c>.vsix</c> reads the pre-release bit from the VSIX manifest;
+/// <c>--pre-release</c> is ignored in that mode, so package it correctly rather than relying
+/// on the publish flag.</p>
+/// </summary>
+[ExcludeFromCodeCoverage]
+[PathTool(Executable = PathExecutable)]
+public partial class OvsxTasks : ToolTasks
+{
+    /// <summary>Executable name looked up on <c>PATH</c> when no explicit tool path is set.</summary>
+    public const string PathExecutable = "ovsx";
+
+    /// <summary>Resolved path to the <c>ovsx</c> executable.</summary>
+    public static string OvsxPath
+    {
+        get => new OvsxTasks().GetToolPathInternal();
+        set => new OvsxTasks().SetToolPath(value);
+    }
+
+    /// <summary>Invokes <c>ovsx</c> with raw arguments.</summary>
+    public static IReadOnlyCollection<Output> Ovsx(
+        ArgumentStringHandler arguments,
+        string? workingDirectory = null,
+        IReadOnlyDictionary<string, string>? environmentVariables = null,
+        int? timeout = null,
+        bool? logOutput = null,
+        bool? logInvocation = null,
+        Action<OutputType, string>? logger = null,
+        Func<IProcess, object>? exitHandler = null)
+        => new OvsxTasks().Run(arguments, workingDirectory, environmentVariables, timeout, logOutput, logInvocation, logger, exitHandler);
+
+    /// <summary>Publishes a packaged <c>.vsix</c> to Open VSX.</summary>
+    public static IReadOnlyCollection<Output> OvsxPublish(OvsxPublishSettings? options = null)
+        => new OvsxTasks().Run<OvsxPublishSettings>(options ?? new OvsxPublishSettings());
+
+    /// <inheritdoc cref="OvsxPublish(OvsxPublishSettings)"/>
+    public static IReadOnlyCollection<Output> OvsxPublish(Configure<OvsxPublishSettings> configurator)
+        => new OvsxTasks().Run<OvsxPublishSettings>(configurator.Invoke(new OvsxPublishSettings()));
+
+    /// <summary>Verifies a PAT against a namespace, without publishing.</summary>
+    public static IReadOnlyCollection<Output> OvsxVerifyPat(OvsxVerifyPatSettings? options = null)
+        => new OvsxTasks().Run<OvsxVerifyPatSettings>(options ?? new OvsxVerifyPatSettings());
+
+    /// <inheritdoc cref="OvsxVerifyPat(OvsxVerifyPatSettings)"/>
+    public static IReadOnlyCollection<Output> OvsxVerifyPat(Configure<OvsxVerifyPatSettings> configurator)
+        => new OvsxTasks().Run<OvsxVerifyPatSettings>(configurator.Invoke(new OvsxVerifyPatSettings()));
+}
+
+#region OvsxPublishSettings
+
+/// <inheritdoc cref="OvsxTasks.OvsxPublish(OvsxPublishSettings)"/>
+[ExcludeFromCodeCoverage]
+[Command(Type = typeof(OvsxTasks), Command = nameof(OvsxTasks.OvsxPublish), Arguments = "publish")]
+public partial class OvsxPublishSettings : ToolOptions
+{
+    /// <summary>Path to the <c>.vsix</c> to publish (positional).</summary>
+    [Argument(Format = "{value}", Position = 1)] public string? ExtensionFile => Get<string>(() => ExtensionFile);
+
+    /// <summary>Open VSX access token. Also readable from <c>OVSX_PAT</c>.</summary>
+    [Argument(Format = "--pat {value}", Secret = true)] public string? Pat => Get<string>(() => Pat);
+
+    /// <summary>Succeeds instead of failing when the version is already published.</summary>
+    [Argument(Format = "--skip-duplicate")] public bool? SkipDuplicate => Get<bool?>(() => SkipDuplicate);
+
+    /// <summary>Registry URL, for self-hosted Open VSX instances.</summary>
+    [Argument(Format = "--registryUrl {value}")] public string? RegistryUrl => Get<string>(() => RegistryUrl);
+
+    /// <summary>Target platform for a platform-specific publish.</summary>
+    [Argument(Format = "--target {value}")] public string? Target => Get<string>(() => Target);
+}
+
+/// <inheritdoc cref="OvsxPublishSettings"/>
+[ExcludeFromCodeCoverage]
+public static class OvsxPublishSettingsExtensions
+{
+    /// <inheritdoc cref="OvsxPublishSettings.ExtensionFile"/>
+    [Builder(Type = typeof(OvsxPublishSettings), Property = nameof(OvsxPublishSettings.ExtensionFile))]
+    public static T SetExtensionFile<T>(this T o, string v) where T : OvsxPublishSettings => o.Modify(b => b.Set(() => o.ExtensionFile, v));
+
+    /// <inheritdoc cref="OvsxPublishSettings.Pat"/>
+    [Builder(Type = typeof(OvsxPublishSettings), Property = nameof(OvsxPublishSettings.Pat))]
+    public static T SetPat<T>(this T o, string v) where T : OvsxPublishSettings => o.Modify(b => b.Set(() => o.Pat, v));
+
+    /// <inheritdoc cref="OvsxPublishSettings.SkipDuplicate"/>
+    [Builder(Type = typeof(OvsxPublishSettings), Property = nameof(OvsxPublishSettings.SkipDuplicate))]
+    public static T SetSkipDuplicate<T>(this T o, bool? v) where T : OvsxPublishSettings => o.Modify(b => b.Set(() => o.SkipDuplicate, v));
+
+    /// <inheritdoc cref="OvsxPublishSettings.RegistryUrl"/>
+    [Builder(Type = typeof(OvsxPublishSettings), Property = nameof(OvsxPublishSettings.RegistryUrl))]
+    public static T SetRegistryUrl<T>(this T o, string v) where T : OvsxPublishSettings => o.Modify(b => b.Set(() => o.RegistryUrl, v));
+}
+
+#endregion
+
+#region OvsxVerifyPatSettings
+
+/// <inheritdoc cref="OvsxTasks.OvsxVerifyPat(OvsxVerifyPatSettings)"/>
+[ExcludeFromCodeCoverage]
+[Command(Type = typeof(OvsxTasks), Command = nameof(OvsxTasks.OvsxVerifyPat), Arguments = "verify-pat")]
+public partial class OvsxVerifyPatSettings : ToolOptions
+{
+    /// <summary>Namespace the token is checked against.</summary>
+    [Argument(Format = "{value}", Position = 1)] public string? Namespace => Get<string>(() => Namespace);
+
+    /// <summary>Open VSX access token. Also readable from <c>OVSX_PAT</c>.</summary>
+    [Argument(Format = "--pat {value}", Secret = true)] public string? Pat => Get<string>(() => Pat);
+}
+
+/// <inheritdoc cref="OvsxVerifyPatSettings"/>
+[ExcludeFromCodeCoverage]
+public static class OvsxVerifyPatSettingsExtensions
+{
+    /// <inheritdoc cref="OvsxVerifyPatSettings.Namespace"/>
+    [Builder(Type = typeof(OvsxVerifyPatSettings), Property = nameof(OvsxVerifyPatSettings.Namespace))]
+    public static T SetNamespace<T>(this T o, string v) where T : OvsxVerifyPatSettings => o.Modify(b => b.Set(() => o.Namespace, v));
+
+    /// <inheritdoc cref="OvsxVerifyPatSettings.Pat"/>
+    [Builder(Type = typeof(OvsxVerifyPatSettings), Property = nameof(OvsxVerifyPatSettings.Pat))]
+    public static T SetPat<T>(this T o, string v) where T : OvsxVerifyPatSettings => o.Modify(b => b.Set(() => o.Pat, v));
+}
+
+#endregion
diff --git a/plugins/Fallout.Vsce/README.md b/plugins/Fallout.Vsce/README.md
new file mode 100644
index 0000000..76ac697
--- /dev/null
+++ b/plugins/Fallout.Vsce/README.md
@@ -0,0 +1,52 @@
+# Fallout.Vsce
+
+A [Fallout](https://github.com/Fallout-build/Fallout) plugin for the VS Code extension toolchain: `vsce` (Visual Studio Marketplace) and `ovsx` (Open VSX).
+
+Deliberately **not** in the Fallout repo. [ADR-0001](https://github.com/Fallout-build/Fallout/blob/main/docs/adr/0001-cd-primitives-attributes-vs-tasks.md) proposes shipping provider integrations as plugins on the framework rather than in-tree components, with Octopus as the first candidate; this is the smaller sibling that proves the shape first. Nothing here needed an escape hatch into framework internals — the same public primitives that in-tree components use were enough.
+
+## What's in it
+
+**Tool wrappers** — `VsceTasks`, `OvsxTasks`. The framework's in-tree tools are emitted by `Fallout.Tooling.Generator` from a `<Tool>.json` spec, which is a repo-internal build step; a plugin writes the same shape by hand. `ToolTasks` subclass, `[Command]`-annotated `ToolOptions` per subcommand, `[Argument]` properties, fluent `[Builder]` setters — indistinguishable at the call site:
+
+```csharp
+VsceTasks.VscePackage(_ => _
+    .SetVersion("10.4.16")
+    .SetOutput(VsixFile)
+    .EnablePreRelease());
+```
+
+**Components** — `IHasVsix`, `IPackVsix`, `IPublishVsix`, mirroring `Fallout.Components`' `IRestore` / `IPack` / `IPublish`. Registries are declared as data and narrowed per run, exactly as `IPublish` does for NuGet feeds:
+
+```csharp
+class Build : FalloutBuild, IPublishVsix
+{
+    string IPackVsix.VsixVersion => /* however you version */;
+
+    IEnumerable<VsixPublishTarget> IPublishVsix.VsixPublishTargets =>
+    [
+        new() { Name = "vs-marketplace", Registry = VsixRegistry.VisualStudioMarketplace, Publisher = "you" },
+        new() { Name = "open-vsx",       Registry = VsixRegistry.OpenVsx,                 Publisher = "you" }
+    ];
+}
+```
+
+```bash
+dotnet fallout PackVsix
+dotnet fallout VerifyVsixCredentials              # proves the tokens, publishes nothing
+dotnet fallout PublishVsix
+dotnet fallout PublishVsix --publish-vsix-to open-vsx
+```
+
+**`MarketplaceVersion`** — the one rule neither the versioning tool nor the registries will enforce for you: three integers, no prerelease. `vsce` throws on `10.4.16-rc.1`, and Nerdbank.GitVersioning stamps stable builds with four components, so both cases get normalised here.
+
+## Things worth knowing
+
+- **A version is pre-release or stable, never both.** The bit lives in the VSIX manifest (`Microsoft.VisualStudio.Code.PreRelease`) and is set at *package* time. Publishing `1.2.3` as a pre-release burns that number for good.
+- **`ovsx` ignores `--pre-release` for a prepackaged `.vsix`** — it reads the manifest. Package it correctly; don't rely on the publish flag.
+- **`vsce publish --pre-release` on a `--packagePath` is only an assertion** against the package, not what sets the status.
+- **Tool resolution** prefers `node_modules/.bin` over `PATH`, since both CLIs are conventionally dev dependencies. Override via `IHasVsix.VsceToolPath` / `OvsxToolPath`.
+- **Tokens** are left to the CLIs' own environment variables (`VSCE_PAT`, `OVSX_PAT`) unless you set `VsixPublishTarget.Pat`, so they stay out of process argument lists.
+
+## Status
+
+Consumed as a `ProjectReference` while the surface settles; packable, so extracting it to its own repo and feed is a build-file change rather than a rewrite.
diff --git a/plugins/Fallout.Vsce/VsceTasks.cs b/plugins/Fallout.Vsce/VsceTasks.cs
new file mode 100644
index 0000000..05ee828
--- /dev/null
+++ b/plugins/Fallout.Vsce/VsceTasks.cs
@@ -0,0 +1,231 @@
+// Hand-written tool wrapper. The in-tree Fallout tools are emitted by
+// Fallout.Tooling.Generator from a <Tool>.json spec; that generator is a repo-internal
+// build step, so a plugin outside the repo writes the same shape by hand. The shape is
+// deliberately identical to Npm.Generated.cs: a ToolTasks subclass, [Command]-annotated
+// ToolOptions per subcommand, [Argument]-annotated properties, and fluent [Builder]
+// setters — so a consumer cannot tell the difference at the call site.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.CodeAnalysis;
+using Fallout.Common;
+using Fallout.Common.Tooling;
+
+namespace Fallout.Vsce;
+
+/// <summary>
+/// <p><a href="https://github.com/microsoft/vscode-vsce">vsce</a> — the VS Code Extension
+/// manager. Packages an extension into a <c>.vsix</c> and publishes it to the Visual Studio
+/// Marketplace.</p>
+/// <p>Normally installed as a dev dependency rather than globally, so callers usually set
+/// <see cref="ToolOptions.ProcessToolPath"/> to the local <c>node_modules/.bin</c> binary —
+/// see <see cref="IHasVsix.VsceToolPath"/>.</p>
+/// </summary>
+[ExcludeFromCodeCoverage]
+[PathTool(Executable = PathExecutable)]
+public partial class VsceTasks : ToolTasks
+{
+    /// <summary>Executable name looked up on <c>PATH</c> when no explicit tool path is set.</summary>
+    public const string PathExecutable = "vsce";
+
+    /// <summary>Resolved path to the <c>vsce</c> executable.</summary>
+    public static string VscePath
+    {
+        get => new VsceTasks().GetToolPathInternal();
+        set => new VsceTasks().SetToolPath(value);
+    }
+
+    /// <summary>Invokes <c>vsce</c> with raw arguments.</summary>
+    public static IReadOnlyCollection<Output> Vsce(
+        ArgumentStringHandler arguments,
+        string? workingDirectory = null,
+        IReadOnlyDictionary<string, string>? environmentVariables = null,
+        int? timeout = null,
+        bool? logOutput = null,
+        bool? logInvocation = null,
+        Action<OutputType, string>? logger = null,
+        Func<IProcess, object>? exitHandler = null)
+        => new VsceTasks().Run(arguments, workingDirectory, environmentVariables, timeout, logOutput, logInvocation, logger, exitHandler);
+
+    /// <summary>Packages the extension into a <c>.vsix</c>.</summary>
+    public static IReadOnlyCollection<Output> VscePackage(VscePackageSettings? options = null)
+        => new VsceTasks().Run<VscePackageSettings>(options ?? new VscePackageSettings());
+
+    /// <inheritdoc cref="VscePackage(VscePackageSettings)"/>
+    public static IReadOnlyCollection<Output> VscePackage(Configure<VscePackageSettings> configurator)
+        => new VsceTasks().Run<VscePackageSettings>(configurator.Invoke(new VscePackageSettings()));
+
+    /// <summary>Publishes a packaged <c>.vsix</c> to the Visual Studio Marketplace.</summary>
+    public static IReadOnlyCollection<Output> VscePublish(VscePublishSettings? options = null)
+        => new VsceTasks().Run<VscePublishSettings>(options ?? new VscePublishSettings());
+
+    /// <inheritdoc cref="VscePublish(VscePublishSettings)"/>
+    public static IReadOnlyCollection<Output> VscePublish(Configure<VscePublishSettings> configurator)
+        => new VsceTasks().Run<VscePublishSettings>(configurator.Invoke(new VscePublishSettings()));
+
+    /// <summary>Verifies that a PAT can publish for the given publisher, without publishing.</summary>
+    public static IReadOnlyCollection<Output> VsceVerifyPat(VsceVerifyPatSettings? options = null)
+        => new VsceTasks().Run<VsceVerifyPatSettings>(options ?? new VsceVerifyPatSettings());
+
+    /// <inheritdoc cref="VsceVerifyPat(VsceVerifyPatSettings)"/>
+    public static IReadOnlyCollection<Output> VsceVerifyPat(Configure<VsceVerifyPatSettings> configurator)
+        => new VsceTasks().Run<VsceVerifyPatSettings>(configurator.Invoke(new VsceVerifyPatSettings()));
+}
+
+#region VscePackageSettings
+
+/// <inheritdoc cref="VsceTasks.VscePackage(VscePackageSettings)"/>
+[ExcludeFromCodeCoverage]
+[Command(Type = typeof(VsceTasks), Command = nameof(VsceTasks.VscePackage), Arguments = "package")]
+public partial class VscePackageSettings : ToolOptions
+{
+    /// <summary>
+    /// Version to stamp into the package. Must be three integers — the Marketplace rejects
+    /// semver prerelease versions outright, so <c>1.2.3-rc.1</c> is not packageable. Mark a
+    /// release candidate with <see cref="PreRelease"/> instead.
+    /// </summary>
+    [Argument(Format = "{value}", Position = 1)] public string? Version => Get<string>(() => Version);
+
+    /// <summary>Target path for the produced <c>.vsix</c>.</summary>
+    [Argument(Format = "--out {value}")] public string? Output => Get<string>(() => Output);
+
+    /// <summary>
+    /// Marks the package as a pre-release, written into the VSIX manifest as
+    /// <c>Microsoft.VisualStudio.Code.PreRelease</c>. This is the only way to express an RC;
+    /// a version is pre-release or stable and can never be both.
+    /// </summary>
+    [Argument(Format = "--pre-release")] public bool? PreRelease => Get<bool?>(() => PreRelease);
+
+    /// <summary>Leaves <c>package.json</c>'s <c>version</c> untouched when a version is supplied.</summary>
+    [Argument(Format = "--no-update-package-json")] public bool? NoUpdatePackageJson => Get<bool?>(() => NoUpdatePackageJson);
+
+    /// <summary>Suppresses the git tag npm would otherwise create for the version bump.</summary>
+    [Argument(Format = "--no-git-tag-version")] public bool? NoGitTagVersion => Get<bool?>(() => NoGitTagVersion);
+
+    /// <summary>Skips the dependency detection step.</summary>
+    [Argument(Format = "--no-dependencies")] public bool? NoDependencies => Get<bool?>(() => NoDependencies);
+
+    /// <summary>Skips the prepublish script.</summary>
+    [Argument(Format = "--no-prepublish")] public bool? NoPrePublish => Get<bool?>(() => NoPrePublish);
+
+    /// <summary>Target platform for a platform-specific package (e.g. <c>win32-x64</c>).</summary>
+    [Argument(Format = "--target {value}")] public string? Target => Get<string>(() => Target);
+}
+
+/// <inheritdoc cref="VscePackageSettings"/>
+[ExcludeFromCodeCoverage]
+public static class VscePackageSettingsExtensions
+{
+    /// <inheritdoc cref="VscePackageSettings.Version"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.Version))]
+    public static T SetVersion<T>(this T o, string v) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.Version, v));
+
+    /// <inheritdoc cref="VscePackageSettings.Output"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.Output))]
+    public static T SetOutput<T>(this T o, string v) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.Output, v));
+
+    /// <inheritdoc cref="VscePackageSettings.PreRelease"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.PreRelease))]
+    public static T SetPreRelease<T>(this T o, bool? v) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.PreRelease, v));
+
+    /// <inheritdoc cref="VscePackageSettings.PreRelease"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.PreRelease))]
+    public static T EnablePreRelease<T>(this T o) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.PreRelease, true));
+
+    /// <inheritdoc cref="VscePackageSettings.NoUpdatePackageJson"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.NoUpdatePackageJson))]
+    public static T EnableNoUpdatePackageJson<T>(this T o) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.NoUpdatePackageJson, true));
+
+    /// <inheritdoc cref="VscePackageSettings.NoGitTagVersion"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.NoGitTagVersion))]
+    public static T EnableNoGitTagVersion<T>(this T o) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.NoGitTagVersion, true));
+
+    /// <inheritdoc cref="VscePackageSettings.NoDependencies"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.NoDependencies))]
+    public static T EnableNoDependencies<T>(this T o) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.NoDependencies, true));
+
+    /// <inheritdoc cref="VscePackageSettings.Target"/>
+    [Builder(Type = typeof(VscePackageSettings), Property = nameof(VscePackageSettings.Target))]
+    public static T SetTarget<T>(this T o, string v) where T : VscePackageSettings => o.Modify(b => b.Set(() => o.Target, v));
+}
+
+#endregion
+
+#region VscePublishSettings
+
+/// <inheritdoc cref="VsceTasks.VscePublish(VscePublishSettings)"/>
+[ExcludeFromCodeCoverage]
+[Command(Type = typeof(VsceTasks), Command = nameof(VsceTasks.VscePublish), Arguments = "publish")]
+public partial class VscePublishSettings : ToolOptions
+{
+    /// <summary>Path to an already-packaged <c>.vsix</c> to publish.</summary>
+    [Argument(Format = "--packagePath {value}")] public string? PackagePath => Get<string>(() => PackagePath);
+
+    /// <summary>Azure DevOps PAT with Marketplace &gt; Manage scope. Also readable from <c>VSCE_PAT</c>.</summary>
+    [Argument(Format = "--pat {value}", Secret = true)] public string? Pat => Get<string>(() => Pat);
+
+    /// <summary>
+    /// Asserts the package was built as a pre-release. On a <see cref="PackagePath"/> publish this
+    /// only validates against the VSIX manifest — the manifest bit set at package time is what
+    /// actually determines pre-release status.
+    /// </summary>
+    [Argument(Format = "--pre-release")] public bool? PreRelease => Get<bool?>(() => PreRelease);
+
+    /// <summary>Succeeds instead of failing when the version is already published.</summary>
+    [Argument(Format = "--skip-duplicate")] public bool? SkipDuplicate => Get<bool?>(() => SkipDuplicate);
+
+    /// <summary>Target platform for a platform-specific publish.</summary>
+    [Argument(Format = "--target {value}")] public string? Target => Get<string>(() => Target);
+}
+
+/// <inheritdoc cref="VscePublishSettings"/>
+[ExcludeFromCodeCoverage]
+public static class VscePublishSettingsExtensions
+{
+    /// <inheritdoc cref="VscePublishSettings.PackagePath"/>
+    [Builder(Type = typeof(VscePublishSettings), Property = nameof(VscePublishSettings.PackagePath))]
+    public static T SetPackagePath<T>(this T o, string v) where T : VscePublishSettings => o.Modify(b => b.Set(() => o.PackagePath, v));
+
+    /// <inheritdoc cref="VscePublishSettings.Pat"/>
+    [Builder(Type = typeof(VscePublishSettings), Property = nameof(VscePublishSettings.Pat))]
+    public static T SetPat<T>(this T o, string v) where T : VscePublishSettings => o.Modify(b => b.Set(() => o.Pat, v));
+
+    /// <inheritdoc cref="VscePublishSettings.PreRelease"/>
+    [Builder(Type = typeof(VscePublishSettings), Property = nameof(VscePublishSettings.PreRelease))]
+    public static T SetPreRelease<T>(this T o, bool? v) where T : VscePublishSettings => o.Modify(b => b.Set(() => o.PreRelease, v));
+
+    /// <inheritdoc cref="VscePublishSettings.SkipDuplicate"/>
+    [Builder(Type = typeof(VscePublishSettings), Property = nameof(VscePublishSettings.SkipDuplicate))]
+    public static T SetSkipDuplicate<T>(this T o, bool? v) where T : VscePublishSettings => o.Modify(b => b.Set(() => o.SkipDuplicate, v));
+}
+
+#endregion
+
+#region VsceVerifyPatSettings
+
+/// <inheritdoc cref="VsceTasks.VsceVerifyPat(VsceVerifyPatSettings)"/>
+[ExcludeFromCodeCoverage]
+[Command(Type = typeof(VsceTasks), Command = nameof(VsceTasks.VsceVerifyPat), Arguments = "verify-pat")]
+public partial class VsceVerifyPatSettings : ToolOptions
+{
+    /// <summary>Publisher the PAT is checked against.</summary>
+    [Argument(Format = "{value}", Position = 1)] public string? Publisher => Get<string>(() => Publisher);
+
+    /// <summary>Azure DevOps PAT. Also readable from <c>VSCE_PAT</c>.</summary>
+    [Argument(Format = "--pat {value}", Secret = true)] public string? Pat => Get<string>(() => Pat);
+}
+
+/// <inheritdoc cref="VsceVerifyPatSettings"/>
+[ExcludeFromCodeCoverage]
+public static class VsceVerifyPatSettingsExtensions
+{
+    /// <inheritdoc cref="VsceVerifyPatSettings.Publisher"/>
+    [Builder(Type = typeof(VsceVerifyPatSettings), Property = nameof(VsceVerifyPatSettings.Publisher))]
+    public static T SetPublisher<T>(this T o, string v) where T : VsceVerifyPatSettings => o.Modify(b => b.Set(() => o.Publisher, v));
+
+    /// <inheritdoc cref="VsceVerifyPatSettings.Pat"/>
+    [Builder(Type = typeof(VsceVerifyPatSettings), Property = nameof(VsceVerifyPatSettings.Pat))]
+    public static T SetPat<T>(this T o, string v) where T : VsceVerifyPatSettings => o.Modify(b => b.Set(() => o.Pat, v));
+}
+
+#endregion
diff --git a/plugins/Fallout.Vsce/VsixPublishTarget.cs b/plugins/Fallout.Vsce/VsixPublishTarget.cs
new file mode 100644
index 0000000..320b9d8
--- /dev/null
+++ b/plugins/Fallout.Vsce/VsixPublishTarget.cs
@@ -0,0 +1,41 @@
+namespace Fallout.Vsce;
+
+/// <summary>Which CLI, and therefore which registry, a <see cref="VsixPublishTarget"/> publishes through.</summary>
+public enum VsixRegistry
+{
+    /// <summary>The Visual Studio Marketplace, via <c>vsce</c>.</summary>
+    VisualStudioMarketplace,
+
+    /// <summary>The Open VSX registry, via <c>ovsx</c>.</summary>
+    OpenVsx
+}
+
+/// <summary>
+/// A routable publish destination for a packaged <c>.vsix</c> — deliberately the same shape as
+/// <c>Fallout.Components.PublishTarget</c>, so fanning one <c>Pack</c> across several registries
+/// reads the same whether the artifact is a <c>.nupkg</c> or a <c>.vsix</c>.
+/// </summary>
+public sealed class VsixPublishTarget
+{
+    /// <summary>Logical name, used by the <c>--publish-vsix-to</c> selector (e.g. <c>vs-marketplace</c>).</summary>
+    public required string Name { get; init; }
+
+    /// <summary>Registry this target publishes to, which selects the CLI used.</summary>
+    public required VsixRegistry Registry { get; init; }
+
+    /// <summary>
+    /// Access token. Both CLIs also read one from the environment (<c>VSCE_PAT</c> / <c>OVSX_PAT</c>);
+    /// leaving this null falls back to that, which is what CI normally wants so the token never
+    /// passes through a process argument list.
+    /// </summary>
+    public string? Pat { get; init; }
+
+    /// <summary>
+    /// Publisher (VS Marketplace) or namespace (Open VSX) this target owns. Used by the
+    /// credential check; not needed for the publish itself.
+    /// </summary>
+    public string? Publisher { get; init; }
+
+    /// <summary>Pass <c>--skip-duplicate</c> so re-running a partially-failed publish is idempotent.</summary>
+    public bool SkipDuplicate { get; init; } = true;
+}
diff --git a/src/model.ts b/src/model.ts
index b65c907..3a33dff 100644
--- a/src/model.ts
+++ b/src/model.ts
@@ -39,8 +39,8 @@ const warned = new Set<string>();
 
 /**
  * Versioning contract: the extension's major.minor track the Fallout framework
- * (calendar versioning, major = year); the patch moves independently. The schema
- * `version` is the hard gate, the major.minor comparison a drift warning.
+ * release line (e.g. 10.4.x against Fallout 10.4); the patch moves independently.
+ * The schema `version` is the hard gate, the major.minor comparison a drift warning.
  */
 export function checkCompatibility(graph: BuildGraph, extensionVersion: string): void {
     let message: string | undefined;
diff --git a/version.json b/version.json
new file mode 100644
index 0000000..d599743
--- /dev/null
+++ b/version.json
@@ -0,0 +1,32 @@
+{
+  "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/main/src/NerdBank.GitVersioning/version.schema.json",
+
+  // major.minor track the Fallout framework release line this extension targets; the third
+  // component is the git height and moves on its own. The build asserts this stays in step
+  // with the pinned Fallout.Common — see Build.cs.
+  //
+  // Unlike the framework, prerelease-ness is NOT expressed here. Both marketplaces reject
+  // semver prerelease versions outright, so a release candidate is a plain triple carrying a
+  // pre-release bit in the VSIX manifest, requested per-build via --pre-release.
+  "version": "10.4",
+
+  // main produces the releasable version directly; there is no separate preview lane, because
+  // the pre-stage is a GitHub pre-release of the same artifact rather than a different feed.
+  "publicReleaseRefSpec": [
+    "^refs/heads/main$",
+    "^refs/heads/release/v\\d+\\.\\d+$"
+  ],
+
+  // The extension shipped its changelog entry as 10.4.15 before versioning moved to NB.GV.
+  // Height restarts from this file's introduction, so without an offset the next build would
+  // compute 10.4.1 and go backwards. Marketplace versions must increase monotonically.
+  "versionHeightOffset": 15,
+
+  "pathFilters": [
+    ":/src",
+    ":/build",
+    ":/plugins",
+    ":/package.json",
+    ":/version.json"
+  ]
+}