diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 991de39..d2bfdff 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -17,7 +17,7 @@
 
 
 ## Before / After
-<!--- Required when the PR changes anything under Sources/, Package.swift or Package@swift-*.swift: CI checks for at least two images here. -->
+<!--- Required when the PR changes anything under Sources/, Package.swift or Package@swift-*.swift: CI checks for at least two images or videos here: drag the files in, or embed images that are repository files pinned to a full 40-character commit SHA as ![](…); a plain link does not count, and a video must be dragged in. -->
 <!--- Show light and dark, and every state that changed. Dropping a file inserts a new <img> line: -->
 <!--- move it into its cell on the row's line, set width="260" and delete height, so the table keeps its shape. -->
 
diff --git a/.github/scripts/screenshots-check.py b/.github/scripts/screenshots-check.py
index 3565ef5..3ef03bf 100755
--- a/.github/scripts/screenshots-check.py
+++ b/.github/scripts/screenshots-check.py
@@ -5,15 +5,21 @@
 
   - a heading whose text mentions "Before / After", or mentions "Screenshots" and is not
     about tests (any heading level, any case), and under it,
-    up to the next heading of the same or a higher level, at least two different images; or
+    up to the next heading of the same or a higher level, at least two different images or
+    videos uploaded to GitHub (dragged into the description), or images that are repository
+    files pinned to a commit; or
   - the ticked task "No visual change".
 
 It reads the description as GitHub renders it (body_html), so comments, code blocks, list
 indentation and every other markdown rule are already applied: what counts is what a reader
 sees. A file renamed out of Sources/ counts as a UI change, and so does the package manifest
 (Package.swift, Package@swift-*.swift), whose platform floor decides which branches the
-components compile. Struck-out text and images do not count. Whether the images really show
-light and dark is left to the reviewer.
+components compile. Only those two kinds count, so badges, emoji, externally hosted images
+and files on a branch never pass as screenshots. A <picture> counts the images a light-mode
+and a dark-mode reader see (GitHub's light / dark pattern). An upload GitHub cannot resolve
+still counts; a reader sees it as a broken image.
+Struck-out text and images do not count. Whether the images really show light and dark is
+left to the reviewer.
 
 Usage:
   REPO=dashpay/DashUIKit PR_NUMBER=31 GH_TOKEN=… screenshots-check.py
@@ -22,42 +28,55 @@
 """
 import json
 import os
+import posixpath
 import re
 import secrets
 import subprocess
 import sys
 from html.parser import HTMLParser
-from urllib.parse import urlsplit
+from urllib.parse import parse_qs, unquote, urlsplit
 
 # "Before / After" anywhere in the heading, or "Screenshots" anywhere in a heading that is
 # not about tests ("Screenshot tests", "Screenshot_testing"; "testnet" and "TestFlight" are
 # fine).
-BEFORE_AFTER = re.compile(r"before\W*(and|vs\.?|to)?\W*after", re.I)
+# The gaps are bounded so that a long run of punctuation cannot make the match quadratic.
+BEFORE_AFTER = re.compile(r"before\W{0,20}(and|vs\.?|to)?\W{0,20}after", re.I)
 SCREENSHOTS = re.compile(r"screenshot", re.I)
 TESTS = re.compile(r"(?<![a-z])(tests?|testing)(?![a-z])", re.I)
 NO_VISUAL_CHANGE = re.compile(r"^\s*no visual change", re.I)
 # GitHub's files endpoint stops at 3000 entries, however it is paginated.
 FILES_CAP = 3000
-# Images that are not screenshots: emoji and badges.
-NOT_SCREENSHOT_HOSTS = ("github.githubassets.com", "img.shields.io", "badgen.net", "codecov.io", "app.codecov.io",
-                        "coveralls.io", "api.netlify.com")
-# Uploads whose query only signs or tweaks the URL; the same file can come back with another.
-UPLOAD_HOSTS = ("private-user-images.githubusercontent.com", "camo.githubusercontent.com",
-                "user-images.githubusercontent.com")
+# Files dragged into a PR description, images and videos alike, identified by their UUID,
+# since one upload can appear in several forms:
+#   github.com/user-attachments/assets/<uuid>                    (the markdown form)
+#   github.com/<owner>/<repo>/assets/<user>/<uuid>               (older markdown form)
+#   private-user-images.githubusercontent.com/<user>/<n>-<uuid>.<ext>?jwt=…  (rendered, signed
+#                                                                 per viewer)
+#   user-images.githubusercontent.com/<user>/<n>-<uuid>.<ext>    (older rendered form)
+#   cloud.githubusercontent.com/assets/<user>/<n>/<uuid>.<ext>   (oldest uploads)
+# Which form body_html holds depends on the viewer and on the markup (GitHub leaves a
+# <picture> alone), so every form counts.
+UUID = r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+RENDERED = re.compile(r"/\d+/\d+-(%s)(\.\w+)?" % UUID)
+UPLOADS = {
+    "github.com": re.compile(r"/user-attachments/assets/(%s)/?|/[^/]+/[^/]+/assets/\d+/(%s)/?" % (UUID, UUID)),
+    "private-user-images.githubusercontent.com": RENDERED,
+    "user-images.githubusercontent.com": RENDERED,
+    "cloud.githubusercontent.com": re.compile(r"/assets/\d+/\d+/(%s)(\.\w+)?" % UUID),
+}
+# A repository file pinned to a full commit SHA, the way an author without a browser
+# (gh pr create, an agent) shows screenshots, since attachments cannot be uploaded through
+# the API. A branch name is not pinned: the file can change or vanish, so it does not count.
+# Only images: GitHub strips a hand-written <video> whose file is not an upload.
+IMAGES = ("png", "jpg", "jpeg", "gif", "webp")
+PINNED = {
+    "raw.githubusercontent.com": re.compile(r"/[^/]+/[^/]+/()([0-9a-f]{40})/(.+)", re.I),
+    "github.com": re.compile(r"/[^/]+/[^/]+/(raw|blob)/([0-9a-f]{40})/(.+)", re.I),
+}
 # Files whose change alters what components render: the sources and the manifests, which
 # set the platform floor.
 UI_SOURCES = "Sources/"
 MANIFEST = re.compile(r"Package(@swift-[0-9.]+)?\.swift")
-# Badge images: a URL ending in "/badge" or "/badges" in any case, a lower-case "badge",
-# "badges" or "project_badges" segment anywhere in the path (goreportcard, Codacy, Read the
-# Docs, GitLab, SonarCloud), an SVG named after a badge ("badge.svg", "badge-flat.svg"), or
-# a host named "badge" or "badges" (badge.fury.io, badges.gitter.im). A PNG screenshot of
-# badge UI, or one in a folder named after the Badge component ("Badge/light.png"), still
-# counts. On GitHub's own hosts the path carries a branch name ("feat/badge"), so a "badge"
-# segment does not count there. A listed host also covers its subdomains (flat.badgen.net).
-BADGE_SEGMENTS = ("badge", "badges", "project_badges")
-BRANCH_HOSTS = ("github.com", "www.github.com", "raw.githubusercontent.com", "media.githubusercontent.com")
-BADGE_SVG = re.compile(r".*badge.*\.svg", re.I)
 
 
 class Description(HTMLParser):
@@ -73,6 +92,7 @@ def __init__(self):
         self.task_text = ""
         self.ticked = []
         self.struck = 0              # inside <del> / <s>: text a reader sees as crossed out
+        self.picture = None          # inside <picture>: its <source>s and <img>, resolved at its end
 
     def handle_starttag(self, tag, attrs):
         attrs = dict(attrs)
@@ -81,11 +101,26 @@ def handle_starttag(self, tag, attrs):
             if self.section_level and level <= self.section_level:
                 self.section_level = 0
             self.heading_level, self.heading_text = level, ""
-        elif tag in ("img", "video") and self.section_level and not self.struck:
-            src = attrs.get("data-canonical-src") or attrs.get("src") or ""
-            emoji = "emoji" in (attrs.get("class") or "").split()
-            if src.startswith(("https://", "http://")) and not emoji and not is_badge(src):
-                self.sections[-1].append(src)
+        elif tag in ("img", "video") and self.section_level:
+            # Camo keeps the original URL in data-canonical-src; either attribute may hold
+            # the upload. A <video> only survives GitHub's sanitizer with an uploaded file.
+            image = tag == "img"
+            key = None if self.struck else (
+                screenshot(attrs.get("data-canonical-src"), image) or screenshot(attrs.get("src"), image)
+                or (screenshot(first(attrs.get("srcset"))) if image else None))
+            if image and self.picture is not None and "img" not in self.picture:
+                # The <picture>'s own image, struck out or not: shown when none of its
+                # <source>s applies, and the end of the <source>s a browser considers.
+                self.picture["img"] = key
+            elif key:
+                self.sections[-1].append(key)
+        elif (tag == "source" and self.picture is not None and "img" not in self.picture
+              and self.section_level and not self.struck and attrs.get("srcset")):
+            # A browser skips a <source> without srcset, and one after the <img>.
+            media = re.sub(r"\s+", "", (attrs.get("media") or "").lower())
+            self.picture["sources"].append((media, screenshot(first(attrs.get("srcset")))))
+        elif tag == "picture":
+            self.picture = {"sources": []}
         elif tag in ("del", "s", "strike"):
             self.struck += 1
         elif tag == "input" and attrs.get("type") == "checkbox" and "checked" in attrs:
@@ -94,6 +129,10 @@ def handle_starttag(self, tag, attrs):
     def handle_endtag(self, tag):
         if tag in ("del", "s", "strike") and self.struck:
             self.struck -= 1
+        if tag == "picture" and self.picture is not None:
+            if self.section_level:
+                self.sections[-1].extend(seen(self.picture))
+            self.picture = None
         if self.heading_level and tag == "h%d" % self.heading_level:
             # A matching heading starts a section, unless it is nested in an open one,
             # which then simply goes on.
@@ -123,32 +162,56 @@ def split(src):
         return None
 
 
-def is_badge(src):
-    parts = split(src)
-    if parts is None:
-        return True
-    host, segments = parts.hostname or "", parts.path.split("/")
-    folders = [s for s in segments if s != "badge"] if host in BRANCH_HOSTS else segments
-    return (any(host == h or host.endswith("." + h) for h in NOT_SCREENSHOT_HOSTS)
-            or host.split(".")[0] in ("badge", "badges")
-            or any(s in BADGE_SEGMENTS for s in folders) or segments[-1].lower() in ("badge", "badges")
-            or bool(BADGE_SVG.fullmatch(segments[-1])))
-
-
-def distinct(sources):
-    """Different images: the same upload is often linked with different queries."""
-    seen = []
-    for src in sources:
-        parts = split(src)
-        if parts is None:
-            continue
-        parts = parts._replace(fragment="")
-        if parts.hostname in UPLOAD_HOSTS or (parts.hostname == "github.com" and parts.path.startswith("/user-attachments/")):
-            parts = parts._replace(query="")
-        key = parts.geturl()
-        if key not in seen:
-            seen.append(key)
-    return seen
+def first(srcset):
+    """srcset lists resolution variants of one image, of which a reader sees one: the first
+    stands for it."""
+    return ((srcset or "").split(",")[0].split() or [""])[0]
+
+
+def seen(picture):
+    """The images a <picture> shows to a light-mode and a dark-mode reader: the first <source>
+    whose media applies, else the <img>. Media with no query, "all" or "screen" applies to
+    every reader, a colour-scheme query to that scheme; any other query (a screen size) is
+    taken not to apply, so the image it would replace is the one counted. A type is taken as
+    supported: a format variant then simply stands for the image."""
+    shown = []
+    for scheme in ("light", "dark"):
+        if "img" not in picture:
+            return []  # a <picture> without an <img> shows nothing
+        key = picture["img"]
+        for media, source in picture["sources"]:
+            if media in ("", "all", "screen") or "prefers-color-scheme:%s" % scheme in media:
+                key = source
+                break
+        if key and key not in shown:
+            shown.append(key)
+    return shown
+
+
+def screenshot(src, pinned=True):
+    """A key for the file src shows when it is a GitHub upload or a commit-pinned repository
+    image, else None. Uploads are keyed by UUID, since one upload has several URL
+    forms, and the query of an upload only signs it. A pinned file is keyed by commit and
+    path, which is the same file whatever fork or URL form reaches it."""
+    parts = split((src or "").strip())
+    if parts is None or parts.scheme != "https":
+        return None
+    upload = UPLOADS.get(parts.hostname)
+    match = upload.fullmatch(parts.path.lower()) if upload else None
+    if match:
+        return match.group(1) or match.group(2)
+    pattern = PINNED.get(parts.hostname) if pinned else None
+    match = pattern.fullmatch(parts.path) if pattern else None
+    if not match:
+        return None
+    route, sha, path = match.groups()
+    # A blob page is an HTML page unless a raw= parameter (any value) asks for the file itself.
+    if route.lower() == "blob" and "raw" not in parse_qs(parts.query, keep_blank_values=True):
+        return None
+    path = posixpath.normpath("/" + unquote(path).lstrip("/"))
+    if path.rsplit(".", 1)[-1].lower() not in IMAGES:
+        return None
+    return sha.lower() + path
 
 
 def gh(path, accept=None, paginate=False):
@@ -212,21 +275,25 @@ def main():
     page.feed(pr.get("body_html") or "")
     page.close()
     # One section must hold the two images; images from separate sections do not add up.
-    images = max((distinct(section) for section in page.sections), key=len, default=[])
+    images = max((list(dict.fromkeys(section)) for section in page.sections), key=len, default=[])
     listed = "\n".join("  - " + shown(p) for p in ui[:10]) + ("\n  - and %d more" % (len(ui) - 10) if len(ui) > 10 else "")
 
     if len(images) >= 2:
-        summary("UI change with %d different screenshots under Before / After." % len(images))
+        summary("UI change with %d different screenshots or videos under Before / After." % len(images))
         return 0
     if any(NO_VISUAL_CHANGE.match(t) for t in page.ticked):
         summary("Author declared no visual change for:\n" + listed)
         return 0
 
     print("::error::This PR changes UI files but shows no Before / After screenshots "
-          "(found %d different image(s) under a Before / After or Screenshots heading)." % len(images))
+          "(found %d different uploaded images or videos, or commit-pinned images, under a Before / After or Screenshots heading)." % len(images))
     summary("UI change without Before / After screenshots. Changed UI files:\n" + listed)
-    summary('Add at least two images (before and after, light and dark where it differs) under the '
-            '"Before / After" heading of the description, or tick "No visual change" and say why. '
+    summary('Drag at least two images or videos (before and after, light and dark where it differs) into the '
+            '"Before / After" section of the description (or a Screenshots section), so GitHub uploads them, or '
+            "embed images that are repository files pinned to a full commit SHA "
+            "(`![](https://raw.githubusercontent.com/OWNER/REPO/SHA/...png)`); a plain link does not count, and a video "
+            "must be dragged in. "
+            'Images hosted elsewhere or on a branch do not count. Or tick "No visual change" and say why. '
             "Editing the description re-runs this check.")
     return 1
 
diff --git a/.github/scripts/tests/screenshots-test.py b/.github/scripts/tests/screenshots-test.py
index eabfaf0..0b4291d 100755
--- a/.github/scripts/tests/screenshots-test.py
+++ b/.github/scripts/tests/screenshots-test.py
@@ -12,8 +12,17 @@
 
 SCRIPT = os.path.join(os.getcwd(), ".github", "scripts", "screenshots-check.py")
 UI = [{"filename": "Sources/DashUIKit/Components/SearchBar.swift"}]
-IMG = '<a target="_blank" rel="noopener noreferrer" href="https://github.com/user-attachments/assets/%s"><img width="260" alt="x" src="https://github.com/user-attachments/assets/%s" style="max-width: 100%%;"></a>'
-A, B = IMG % ("1111", "1111"), IMG % ("2222", "2222")
+# Uploads in the form GitHub renders them in body_html: the markdown's
+# github.com/user-attachments/assets/<uuid> becomes a signed private-user-images URL, and a
+# dragged video becomes a <details> block around a <video>. The UUIDs are made up.
+U1, U2, U3, U4 = ("8c0d2014-13e9-49c0-bf2f-8a279af37a55", "20448a6e-2f3b-4c1d-9e8f-0a1b2c3d4e5f",
+                  "ca81c104-5d6e-4f70-8a9b-c0d1e2f3a4b5", "0f1e2d3c-4b5a-4697-8877-665544332211")
+PRIVATE = "https://private-user-images.githubusercontent.com/270373998/677853016-%s.png?jwt=%s"
+IMG = '<a target="_blank" rel="noopener noreferrer" href="%s"><img width="260" alt="x" src="%s" style="max-width: 100%%;"></a>'
+A, B = IMG % (PRIVATE % (U1, "a"), PRIVATE % (U1, "a")), IMG % (PRIVATE % (U2, "b"), PRIVATE % (U2, "b"))
+ATTACHMENT = "https://github.com/user-attachments/assets/%s"
+VIDEO = ('<details open="" class="details-reset border rounded-2"><summary class="px-3 py-2"><span class="m-1">x.mov</span>'
+         '</summary><video src="%s" data-canonical-src="%s" controls="controls" muted="muted" class="d-block rounded-bottom-2 border-top width-fit"></video></details>')
 
 
 def h(level, text):
@@ -34,30 +43,25 @@ def task(text, ticked):
     ("subheadings inside the section", "pass", UI, h(2, "Before / After") + h(3, "Light") + A + h(3, "Dark") + B),
     ("one image", "fail", UI, h(2, "Before / After") + A),
     ("the same image with two signed queries", "fail", UI, h(2, "Before / After")
-     + '<img src="https://private-user-images.githubusercontent.com/1/x.png?jwt=a"><img src="https://private-user-images.githubusercontent.com/1/x.png?jwt=b">'),
+     + '<img src="%s"><img src="%s">' % (PRIVATE % (U1, "a"), PRIVATE % (U1, "b"))),
     ("images under another heading", "fail", UI, h(2, "Before / After") + "<p>none</p>" + h(2, "How Has This Been Tested?") + A + B),
     ("images above the section", "fail", UI, A + B + h(2, "Before / After")),
     ("the empty template cells", "fail", UI, h(2, "Before / After") + '<img width="260" src=""><img width="260">'),
-    ("data-canonical-src counts", "pass", UI, h(2, "Before / After")
-     + '<img src="https://camo.githubusercontent.com/1" data-canonical-src="https://example.com/1.png"><img src="https://camo.githubusercontent.com/2" data-canonical-src="https://example.com/2.png">'),
     ("No visual change ticked", "pass", UI, h(2, "Before / After") + task('No visual change (refactor, tests, docs). Say why in "What was done?".', True)),
     ("No visual change unticked", "fail", UI, task("No visual change (refactor, tests, docs).", False)),
     ("another task ticked", "fail", UI, task("I have performed a self-review of my own code", True)),
     ("empty description", "fail", UI, None),
     ("Before & After heading", "pass", UI, h(2, "Before &amp; After") + A + B),
-    ("emoji and badges are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img class="emoji" src="https://github.githubassets.com/images/icons/emoji/shipit.png"><img src="https://img.shields.io/badge/a-b-c">'),
+    ("emoji do not count", "fail", UI, h(2, "Before / After") + A
+     + '<img class="emoji" src="https://github.githubassets.com/images/icons/emoji/shipit.png">'),
     ("two videos", "pass", UI, h(2, "Before / After")
-     + '<video src="https://github.com/user-attachments/assets/aaaa"></video><video src="https://github.com/user-attachments/assets/bbbb"></video>'),
-    ("query is the identity on other hosts", "pass", UI, h(2, "Before / After")
-     + '<img src="https://host.example/render?id=1"><img src="https://host.example/render?id=2">'),
+     + (VIDEO % (PRIVATE % (U3, "c"), PRIVATE % (U3, "c"))).replace(".png", ".mov")
+     + (VIDEO % (PRIVATE % (U4, "d"), PRIVATE % (U4, "d"))).replace(".png", ".mov")),
     ("a newline in a path stays inside the stop block", "fail", [{"filename": "Sources/a\n::error::forged.swift"}], ""),
     ("a Screenshot tests heading is not the section", "fail", UI, h(2, "Screenshot tests") + A + B),
     ("Screenshots with a parenthetical", "pass", UI, h(2, "📸 Screenshots (light and dark)") + A + B),
-    ("a workflow badge and codecov are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img src="https://github.com/dashpay/DashUIKit/actions/workflows/ci.yml/badge.svg"><img src="https://codecov.io/gh/x/y/graph/badge.svg">'),
     ("one upload with and without ?raw=true", "fail", UI, h(2, "Before / After")
-     + '<img src="https://github.com/user-attachments/assets/aaaa"><img src="https://github.com/user-attachments/assets/aaaa?raw=true">'),
+     + '<picture><img src="%s"></picture><picture><img src="%s?raw=true"></picture>' % (ATTACHMENT % U3, ATTACHMENT % U3)),
     ("a malformed URL does not crash the ticked box", "pass", UI, h(2, "Before / After")
      + '<img src="http://[bad/x.png">' + task("No visual change", True)),
     ("a struck-out tick does not count", "fail", UI, task("<del>No visual change</del>", True)),
@@ -82,49 +86,149 @@ def task(text, ticked):
     ("Screenshots (testnet)", "pass", UI, h(2, "Screenshots (testnet)") + A + B),
     ("Screenshots from TestFlight", "pass", UI, h(2, "Screenshots from TestFlight") + A + B),
     ("Screenshots (tested on iPhone 16)", "pass", UI, h(2, "Screenshots (tested on iPhone 16)") + A + B),
-    ("screenshots in a Badge folder count", "pass", UI, h(2, "Before / After")
-     + '<img src="https://example.com/docs/Badge/light.png"><img src="https://example.com/docs/Badge/dark.png">'),
-    ("a goreportcard badge is not a screenshot", "fail", UI, h(2, "Before / After") + A
-     + '<img src="https://goreportcard.com/badge/github.com/x/y">'),
-    ("a Codacy badge is not a screenshot", "fail", UI, h(2, "Before / After") + A
-     + '<img src="https://app.codacy.com/project/badge/Grade/abc">'),
-    ("a Read the Docs badge is not a screenshot", "fail", UI, h(2, "Before / After") + A
-     + '<img src="https://readthedocs.org/projects/x/badge/?version=latest">'),
-    ("a badge in a repo's badges/ folder is not a screenshot", "fail", UI, h(2, "Before / After") + A
-     + '<img src="https://raw.githubusercontent.com/o/r/main/.github/badges/jacoco.svg">'),
-    ("a badge on a subdomain of a badge host is not a screenshot", "fail", UI, h(2, "Before / After") + A
-     + '<img src="https://flat.badgen.net/npm/v/x">'),
-    ("LFS screenshots on a badge branch count", "pass", UI, h(2, "Before / After")
-     + '<img src="https://media.githubusercontent.com/media/o/r/feat/badge/docs/light.png">'
-     + '<img src="https://media.githubusercontent.com/media/o/r/feat/badge/docs/dark.png">'),
-    ("screenshots on a badge branch count", "pass", UI, h(2, "Before / After")
-     + '<img src="https://raw.githubusercontent.com/dashpay/DashUIKit/feat/badge/docs/light.png">'
-     + '<img src="https://raw.githubusercontent.com/dashpay/DashUIKit/feat/badge/docs/dark.png">'),
-    ("GitLab badges are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img src="https://gitlab.com/a/b/badges/main/pipeline.svg"><img src="https://gitlab.com/a/b/badges/main/coverage.svg">'),
-    ("a /badges leaf is not a screenshot", "fail", UI, h(2, "Before / After") + A
-     + '<img src="https://example.com/x/badges">'),
-    ("coveralls and netlify badges are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img src="https://coveralls.io/repos/github/x/y/badge.png"><img src="https://api.netlify.com/api/v1/badges/1/deploy-status">'),
-    ("badge SVG variants and badge hosts are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img src="https://x.io/a/badge-flat.svg"><img src="https://x.io/b/badge_small.svg">'
-     + '<img src="https://badge.fury.io/js/x.svg"><img src="https://badges.gitter.im/x/y.svg">'),
-    ("extensionless /badge leaves are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img src="https://www.codefactor.io/repository/github/x/y/badge"><img src="https://api.securityscorecards.dev/projects/github.com/x/y/badge">'),
-    ("a host that only starts with badge is not a badge", "pass", UI, h(2, "Before / After")
-     + '<img src="https://badger.example.com/light.png"><img src="https://badger.example.com/dark.png">'),
-    ("screenshots in a folder named after a badge count", "pass", UI, h(2, "Before / After")
-     + '<img src="https://raw.githubusercontent.com/o/r/b/docs/status-badge/light.png"><img src="https://raw.githubusercontent.com/o/r/b/docs/status-badge/dark.png">'),
     ("UI: Screenshots", "pass", UI, h(2, "UI: Screenshots") + A + B),
-    ("other badges are not screenshots", "fail", UI, h(2, "Before / After")
-     + '<img src="https://gitlab.com/a/b/badges/main/pipeline.svg"><img src="https://example.com/build-badge.svg">'
-     + '<img src="https://sonarcloud.io/api/project_badges/measure?k=x">'),
-    ("a screenshot of badge UI counts", "pass", UI, h(2, "Before / After")
-     + '<img src="https://example.com/coin-selector-badge-light.png"><img src="https://example.com/coin-selector-badge-dark.png">'),
     ("a version-specific manifest is a UI change", "fail", [{"filename": "Package@swift-6.2.swift"}], ""),
     ("a manifest backup is not a UI change", "pass", [{"filename": "Package.swift.orig"}], ""),
     ("a legacy ##[ marker in a path stays inside the stop block", "fail", [{"filename": "Sources/##[error]forged.swift"}], ""),
     ("renamed out of Sources/", "fail", [{"filename": "Legacy/Toast.swift", "previous_filename": "Sources/DashUIKit/Components/Toast.swift"}], ""),
+    ("a markdown-form upload and its rendered form are one upload", "fail", UI, h(2, "Before / After")
+     + '<picture><img src="%s"></picture>' % (ATTACHMENT % U1) + '<img src="%s">' % (PRIVATE % (U1, "z"))),
+    ("an older repo-assets upload in a picture", "pass", UI, h(2, "Before / After") + A
+     + '<picture><img src="https://github.com/dashpay/DashUIKit/assets/270373998/%s"></picture>' % U3),
+    ("the markdown form counts", "pass", UI, h(2, "Before / After") + A + '<img src="%s">' % (ATTACHMENT % U3)),
+    ("an upper-case UUID counts", "pass", UI, h(2, "Before / After") + A + '<img src="%s">' % (ATTACHMENT % U3.upper())),
+    ("a path after the upload id does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="%s/extra.png">' % (ATTACHMENT % U3)),
+    ("an older rendered upload counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://user-images.githubusercontent.com/1/123456-%s.PNG">' % U3),
+    ("a markdown-form canonical with a rendered src counts", "pass", UI, h(2, "Before / After")
+     + (VIDEO % (PRIVATE % (U3, "c"), ATTACHMENT % U3)).replace(".png", ".mov")
+     + (VIDEO % (PRIVATE % (U4, "d"), ATTACHMENT % U4)).replace(".png", ".mov")),
+    ("an upload in a picture counts", "pass", UI, h(2, "Before / After") + A
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="%s"><img src="%s"></picture>' % (ATTACHMENT % U4, ATTACHMENT % U3)),
+    ("an older user-images upload", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://user-images.githubusercontent.com/1/123456-%s.png">' % U3),
+    ("an upload linked through www.github.com does not count", "fail", UI, h(2, "Before / After") + A
+     + '<picture><img src="https://camo.githubusercontent.com/1" data-canonical-src="https://www.github.com/user-attachments/assets/%s"></picture>' % U3),
+    ("an http upload link does not count", "fail", UI, h(2, "Before / After") + A
+     + '<picture><img src="http://github.com/user-attachments/assets/%s"></picture>' % U3),
+    ("an upload id that is not a UUID does not count", "fail", UI, h(2, "Before / After") + A
+     + '<picture><img src="https://github.com/user-attachments/assets/1111"></picture>'),
+    ("a bare upload host does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://private-user-images.githubusercontent.com/">'),
+    ("a repo-assets URL with no id does not count", "fail", UI, h(2, "Before / After") + A
+     + '<picture><img src="https://github.com/o/r/assets/1/"></picture>'),
+    ("an attached file is not a screenshot", "fail", UI, h(2, "Before / After") + A
+     + '<picture><img src="https://github.com/user-attachments/files/123/log.zip"></picture>'),
+    ("a colour-scheme <source> in a picture is a second upload", "pass", UI, h(2, "Before / After") + A
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="%s"><img src=""></picture>' % (ATTACHMENT % U4)),
+    ("a screen-size <source> in a picture is the same image", "fail", UI, h(2, "Before / After")
+     + '<picture><source media="(min-width: 800px)" srcset="%s"><img src="%s"></picture>' % (ATTACHMENT % U4, ATTACHMENT % U3)),
+    ("a colour-scheme media query in any case counts", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(Prefers-Color-Scheme: dark)" srcset="%s"><img src="%s"></picture>' % (ATTACHMENT % U4, ATTACHMENT % U3)),
+    ("a plain link to a pinned file does not count", "fail", UI, h(2, "Before / After") + A
+     + '<a href="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/after.png">after</a>'),
+    ("the canonical src is read before a proxied src", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://camo.githubusercontent.com/1" data-canonical-src="%s">' % (PRIVATE % (U3, "c"))),
+    ("the canonical src wins over src", "pass", UI, h(2, "Before / After") + A
+     + '<img src="%s" data-canonical-src="%s">' % (PRIVATE % (U1, "a"), ATTACHMENT % U3)),
+    ("spaces around src are ignored", "pass", UI, h(2, "Before / After") + A
+     + '<img src=" %s ">' % (ATTACHMENT % U3)),
+    ("two uploads in the markdown form", "pass", UI, h(2, "Before / After")
+     + '<img src="%s"><img src="%s">' % (ATTACHMENT % U3, ATTACHMENT % U4)),
+    ("a non-UUID id next to a markdown-form upload does not count", "fail", UI, h(2, "Before / After")
+     + '<img src="%s"><img src="https://github.com/user-attachments/assets/1111">' % (ATTACHMENT % U3)),
+    ("external images do not count", "fail", UI, h(2, "Before / After")
+     + '<img src="https://example.com/light.png"><img src="https://example.com/dark.png">'),
+    ("an external image proxied through camo does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://camo.githubusercontent.com/1" data-canonical-src="https://example.com/1.png">'),
+    ("camo without a canonical src does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://camo.githubusercontent.com/1">'),
+    ("badges do not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://img.shields.io/badge/a-b-c"><img src="https://github.com/dashpay/DashUIKit/actions/workflows/ci.yml/badge.svg">'
+     + '<img src="https://codecov.io/gh/x/y/graph/badge.svg">'),
+    ("a light / dark picture of two uploads counts twice", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="%s 1x"><img src="%s"></picture>' % (ATTACHMENT % U4, ATTACHMENT % U3)),
+    ("a <source> outside a picture does not count", "fail", UI, h(2, "Before / After") + A
+     + '<video><source src="https://example.com/x.mp4" srcset="%s"></video>' % (ATTACHMENT % U3)),
+    ("an extensionless rendered upload counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://private-user-images.githubusercontent.com/1/2-%s?jwt=x">' % U3),
+    ("an oldest cloud upload counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://cloud.githubusercontent.com/assets/1/2/%s.png">' % U3),
+    ("commit-pinned raw files count", "pass", UI, h(2, "Before / After")
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/before-light.png">'
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/after-light.png">'),
+    ("a commit-pinned raw file through camo counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://camo.githubusercontent.com/1" data-canonical-src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png">'),
+    ("a commit-pinned github.com raw link counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://github.com/o/r/raw/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/a.jpg">'),
+    ("a commit-pinned blob with ?raw=true counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://github.com/o/r/blob/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/a.png?raw=true">'),
+    ("a commit-pinned blob page does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://github.com/o/r/blob/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/a.png">'),
+    ("a short SHA is not pinned", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c7986/a.png">'),
+    ("a pinned file that is not an image does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/badge.svg">'),
+    ("the same pinned file twice counts once", "fail", UI, h(2, "Before / After")
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"><img src="https://github.com/o/r/raw/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png">'),
+    ("a pinned raw link to a file under a blob/ folder counts", "pass", UI, h(2, "Before / After") + A
+     + '<img src="https://github.com/o/r/raw/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/blob/a.png">'),
+    ("a blob with any raw= value counts", "pass", UI, h(2, "Before / After")
+     + '<img src="https://github.com/o/r/blob/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png?raw=1"><img src="https://github.com/o/r/blob/d0c798679389e6ba06b9e1bf26942b99483f6dde/b.png?raw=">'),
+    ("a doubled slash is the same pinned file", "fail", UI, h(2, "Before / After")
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde//a.png">'),
+    ("a raw=true inside another parameter does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://github.com/o/r/blob/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png?xraw=true">'),
+    ("resolution variants of one <source> count once", "fail", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="%s 1x, %s 2x"><img src=""></picture>' % (ATTACHMENT % U3, ATTACHMENT % U4)),
+    ("one pinned file through a fork and a dot segment counts once", "fail", UI, h(2, "Before / After")
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"><img src="https://raw.githubusercontent.com/fork/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/x/../a.png">'
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/%61.png">'),
+    ("pinned files that differ only in case are two files", "pass", UI, h(2, "Before / After")
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/Before.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/docs/before.png">'),
+    ("a pinned video in an img does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/after.mov">'),
+    ("a pinned video does not count", "fail", UI, h(2, "Before / After") + A
+     + '<video src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/after.mov"></video>'),
+    ("a raw file from a branch does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://raw.githubusercontent.com/dashpay/DashUIKit/feat/x/docs/light.png">'),
+    ("a github.com raw link on a branch does not count", "fail", UI, h(2, "Before / After") + A
+     + '<img src="https://github.com/dashpay/DashUIKit/raw/master/docs/light.png">'),
+    ("a <source> with no media hides the img", "fail", UI, h(2, "Before / After")
+     + '<picture><source srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/b.png"></picture>'),
+    ("a format-variant <source> is the same image", "fail", UI, h(2, "Before / After")
+     + '<picture><source type="image/webp" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.webp"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"></picture>'),
+    ("a dark <source> after an unconditional one is never shown", "fail", UI, h(2, "Before / After")
+     + '<picture><source srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/b.png"><img alt="x"></picture>'),
+    ("explicit light and dark sources count twice", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"><source media="(prefers-color-scheme:dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/x.png"></picture>'),
+    ("a picture outside the section does not count", "fail", UI, '<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture>'
+     + h(2, "Before / After") + A),
+    ("a <source> after the img is never shown", "fail", UI, h(2, "Before / After")
+     + '<picture><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"></picture>'),
+    ("a typed dark <source> counts", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: dark)" type="image/png" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture>'),
+    ("a typed <source> with no media shadows the dark one", "fail", UI, h(2, "Before / After")
+     + '<picture><source type="image/webp" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.webp"><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture>'),
+    ("a second img in a picture is shown", "pass", UI, h(2, "Before / After")
+     + '<picture><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/b.png"></picture>'),
+    ("a picture img given by srcset counts", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png 2x"></picture>'),
+    ("a media=all <source> applies to every reader", "fail", UI, h(2, "Before / After")
+     + '<picture><source media="all" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/x.png"><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture>'),
+    ("a wrapped colour-scheme media query counts", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme:\n\tdark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture>'),
+    ("a pinned image in a video does not count", "fail", UI, h(2, "Before / After") + A
+     + '<video src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/a.png"></video>'),
+    ("a picture without an img shows nothing", "fail", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><source srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture>'),
+    ("a <source> without srcset is skipped", "pass", UI, h(2, "Before / After")
+     + '<picture><source src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/x.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></picture><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/z.png">'),
+    ("a struck-out picture img still ends its sources", "fail", UI, h(2, "Before / After")
+     + '<picture><del><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/l.png"></del><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/d.png"><img src="https://raw.githubusercontent.com/o/r/d0c798679389e6ba06b9e1bf26942b99483f6dde/m.png"></picture>'),
+    ("a light fallback <source> with no media query counts", "pass", UI, h(2, "Before / After")
+     + '<picture><source media="(prefers-color-scheme: dark)" srcset="%s"><source srcset="%s"><img alt="x"></picture>' % (ATTACHMENT % U3, ATTACHMENT % U4)),
 ]
 
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 1f5fa6d..d7ccbda 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -63,7 +63,8 @@ Sources/DashUIKit/
 - **Localization:** user-facing strings use `NSLocalizedString(_, bundle: .module, comment:)`.
 - **PR screenshots:** a PR that changes anything under `Sources/` or a package manifest
   (`Package.swift`, `Package@swift-*.swift`) shows Before / After screenshots (light and
-  dark) in its description, or ticks "No visual change" and says why.
+  dark) in its description, as files dragged in (uploaded to GitHub) or embedded repository
+  images pinned to a full commit SHA, or ticks "No visual change" and says why.
   CI (`Before / After screenshots`) enforces it.
 - Components are **stateless/value-driven** — state (`@Binding`) and callbacks live with the
   host. Don't add view models or persistence here.