diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5745224e..86ba5409 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,6 +67,8 @@ jobs:
         run: bash tools/ci/identity-check.sh
       - name: no conflict markers in tracked files
         run: bash tools/ci/no-conflict-markers.sh
+      - name: every tracked path is valid on Windows (tools/ci/windows-paths-check.sh)
+        run: bash tools/ci/windows-paths-check.sh
       - name: PowerShell drive-reference check (a `$name:` inside a double-quoted string is a 5.1 parse error)
         run: bash tools/ci/ps-drive-ref-check.sh
       - name: copied sources are re-stamped before a build
diff --git a/docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-dark.jpg b/docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-dark.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-dark.jpg
rename to docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-dark.jpg
diff --git a/docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-light.jpg b/docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-light.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-light.jpg
rename to docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-light.jpg
diff --git a/docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-dark.jpg b/docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-dark.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-dark.jpg
rename to docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-dark.jpg
diff --git a/docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-light.jpg b/docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-light.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/after/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-light.jpg
rename to docs/plans/site-ui-3-shots/after/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-light.jpg
diff --git a/docs/plans/site-ui-3-shots/before-states/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-dark-fail.jpg b/docs/plans/site-ui-3-shots/before-states/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-dark-fail.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/before-states/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-dark-fail.jpg
rename to docs/plans/site-ui-3-shots/before-states/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-dark-fail.jpg
diff --git a/docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-dark.jpg b/docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-dark.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-dark.jpg
rename to docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-dark.jpg
diff --git a/docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-light.jpg b/docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-light.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-1440-light.jpg
rename to docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-1440-light.jpg
diff --git a/docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-dark.jpg b/docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-dark.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-dark.jpg
rename to docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-dark.jpg
diff --git a/docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-light.jpg b/docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-light.jpg
similarity index 100%
rename from docs/plans/site-ui-3-shots/before/address_igneumdev:qz9hw3xy72g4guwfddvpxs-390-light.jpg
rename to docs/plans/site-ui-3-shots/before/address_igneumdev-qz9hw3xy72g4guwfddvpxs-390-light.jpg
diff --git a/tools/ci/windows-paths-check.sh b/tools/ci/windows-paths-check.sh
new file mode 100755
index 00000000..e06c0692
--- /dev/null
+++ b/tools/ci/windows-paths-check.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Every tracked path must be one Windows can hold: no : * ? " < > | in a name, no name ending in a dot or a space.
+# 6 October 2026: docs/plans/site-ui-3-shots/after/address_igneumdev:qz9h....jpg (a colon from an address in a screenshot
+# name) made actions/checkout fail on windows-latest ("invalid path", git exit 128), and every Windows build of the tree
+# died at the checkout. Runs in CI (ubuntu, before any Windows job) and locally. Exit 1 with the paths listed.
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+bad="$(git ls-files -z | tr '\0' '\n' | grep -E '[:*?"<>|]|[. ]$|(^|/)[^/]*[. ]/' || true)"
+if [ -n "$bad" ]; then echo "windows-paths: these tracked paths cannot exist on Windows (rename them):"; printf '%s\n' "$bad" | sed 's/^/  /'; exit 1; fi
+echo "windows-paths: every tracked path is valid on Windows ($(git ls-files | wc -l | tr -d ' ') files)"