diff --git a/assertions/route.php b/assertions/route.php
index 8a81ad889..94a686291 100644
--- a/assertions/route.php
+++ b/assertions/route.php
@@ -18,6 +18,29 @@
 // assertions/.htaccess routes here directly, bypassing tsugi.php
 LTIX::session_start();
 
+/**
+ * Assertion pages are public credentials. The bar is the site name,
+ * opening the app home in a new tab, and Close. No course or build menu.
+ */
+function assertion_nav() {
+    global $CFG, $OUTPUT;
+    $home = (isset($CFG->apphome) && is_string($CFG->apphome) && $CFG->apphome !== '')
+        ? $CFG->apphome
+        : (isset($CFG->wwwroot) && is_string($CFG->wwwroot) ? $CFG->wwwroot : '/');
+    $label = (isset($CFG->servicename) && is_string($CFG->servicename) && $CFG->servicename !== '')
+        ? $CFG->servicename
+        : 'Home';
+    $set = new \Tsugi\UI\MenuSet();
+    $set->setHome(
+        htmlspecialchars($label, ENT_QUOTES, 'UTF-8'),
+        htmlspecialchars($home, ENT_QUOTES, 'UTF-8'),
+        'target="_blank" rel="noopener noreferrer"'
+    );
+    $set->addRight(__('Close'), 'javascript:window_close();');
+    $OUTPUT->menuOverride = $set;
+    $OUTPUT->topNav();
+}
+
 // Parse the URL to extract encrypted ID and resource type
 $url = $_SERVER['REQUEST_URI'];
 $path = trim(parse_url($url, PHP_URL_PATH), '/');
@@ -34,7 +57,7 @@
     http_response_code(404);
     $OUTPUT->header();
     $OUTPUT->bodyStart();
-    $OUTPUT->topNav();
+    assertion_nav();
     echo("<h2>Page not found.</h2>\n");
     $OUTPUT->footer();
     return;
@@ -49,7 +72,7 @@
         http_response_code(400);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Bad Request</h2><p>Missing badge id.</p>\n");
         $OUTPUT->footer();
         return;
@@ -59,22 +82,22 @@
         http_response_code(403);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Forbidden</h2><p>You must be logged in to publish a badge.</p>\n");
         $OUTPUT->footer();
         return;
     }
-    if ( ! Manifest::hasCurrent() ) {
+    $PDOX = LTIX::getConnection();
+    $l = BadgeService::lessonsForAssertion($hex_id);
+    if ( ! $l ) {
         die_with_error_log('Cannot find lessons.json ($CFG->lessons) or an active course manifest');
     }
-    $PDOX = LTIX::getConnection();
-    $l = Manifest::requireCurrentLessons();
     $parsed = Badges::parseAssertionId($hex_id, $l);
     if ( is_string($parsed) ) {
         http_response_code(404);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Badge not found</h2><p>Invalid or expired badge id.</p>\n");
         $OUTPUT->footer();
         return;
@@ -87,7 +110,7 @@
         http_response_code(403);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Forbidden</h2><p>You can only publish your own badges.</p>\n");
         $OUTPUT->footer();
         return;
@@ -98,13 +121,13 @@
     $email = U::get($row, 'email', '');
     $context_title = U::get($row, 'title', '');
     $badge_title = isset($badge->title) ? $badge->title : '';
-    $accomplishments = BadgeService::captureAccomplishments($l, $badge, is_string($context_title) ? $context_title : '');
+    $accomplishments = BadgeService::captureAccomplishments($l, $badge, is_string($context_title) ? $context_title : '', $context_id);
     $guid = BadgeService::mintOrGet($current_user_id, $context_id, $code, $displayname, $email, $context_title, $badge_title, $accomplishments);
     if ($guid === false) {
         http_response_code(500);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Error</h2><p>Could not publish badge. Please try again later.</p>\n");
         $OUTPUT->footer();
         return;
@@ -122,7 +145,7 @@
         http_response_code(404);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Not found</h2><p>Badge not found.</p>\n");
         $OUTPUT->footer();
         return;
@@ -132,7 +155,7 @@
         http_response_code(404);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Not found</h2><p>LinkedIn sharing is not available for this badge.</p>\n");
         $OUTPUT->footer();
         return;
@@ -183,7 +206,7 @@
         // Find the badge by code
         $badge = null;
         foreach($l->lessons->badges as $b) {
-            if ($b->image == $code.'.png') {
+            if (isset($b->image) && \Tsugi\Services\Badges\CourseBadges::imageMatchesCode($b->image, $code)) {
                 $badge = $b;
                 break;
             }
@@ -193,7 +216,7 @@
             http_response_code(404);
             $OUTPUT->header();
             $OUTPUT->bodyStart();
-            $OUTPUT->topNav();
+            assertion_nav();
             echo("<h2>Badge not found.</h2>\n");
             $OUTPUT->footer();
             return;
@@ -275,7 +298,7 @@
         http_response_code(404);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Page not found.</h2>\n");
         $OUTPUT->footer();
         return;
@@ -284,13 +307,13 @@
     http_response_code(404);
     $OUTPUT->header();
     $OUTPUT->bodyStart();
-    $OUTPUT->topNav();
+    assertion_nav();
     echo("<h2>Page not found.</h2>\n");
     $OUTPUT->footer();
     return;
 }
 
-// A published badge is the row. An unpublished hex id still needs the current lessons.
+// A published badge is the row. An unpublished hex id names its own course.
 $PDOX = LTIX::getConnection();
 
 $row = null;
@@ -311,7 +334,11 @@
     $badge = $data['badge'];
     $frozen = $data['frozen'];
 } else {
-    $l = Manifest::requireCurrentLessons();
+    $l = BadgeService::lessonsForAssertion($encrypted);
+    if ( ! $l ) {
+        error_log("Assertion parse error: badge not found for id: " . substr($encrypted, 0, 50) . "...");
+        die_with_error_log('Badge not found');
+    }
     $x = Badges::parseAssertionId($encrypted, $l);
     if ( ! is_string($x) ) {
         $row = $x[0];
@@ -354,12 +381,13 @@
     }
     $badge_image = $live_image !== '' ? $live_image : $archive_image;
 } else {
-    $badge_image = $CFG->badge_url.'/'.$code.'.png';
+    $badge_image = Badges::liveImageUrl($badge, $code, (int) $pieces[2]);
     $evidence_home = isset($CFG->apphome) ? $CFG->apphome : '';
-    $evidence_assignments = BadgeService::getAssignmentsForEvidence($code, $l);
-    $claim_badge_url = $CFG->wwwroot . "/assertions/badge/" . urlencode($code) . ".json";
-    $claim_issuer_url = $CFG->wwwroot . "/assertions/issuer.json";
-    $claim_achievement_url = $CFG->wwwroot . "/assertions/badge/" . urlencode($code) . ".json?format=ob3";
+    $evidence_assignments = BadgeService::getAssignmentsForEvidence($code, $l, (int) $pieces[2]);
+    $guid_path = rtrim($CFG->wwwroot, '/') . '/assertions/' . urlencode($encrypted);
+    $claim_badge_url = $guid_path . '/badge.json';
+    $claim_issuer_url = $guid_path . '/issuer.json';
+    $claim_achievement_url = $guid_path . '/achievement.json';
     $issuer_name_plain = null;
 }
 
@@ -562,7 +590,7 @@
         );
         echo("\n");
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         ?>
         <style>
         .badge-share-links { list-style: none; display: inline; margin: 0; padding: 0; }
@@ -780,7 +808,7 @@ function copyBadgeUrlToClipboard(button) {
         http_response_code(404);
         $OUTPUT->header();
         $OUTPUT->bodyStart();
-        $OUTPUT->topNav();
+        assertion_nav();
         echo("<h2>Page not found.</h2>\n");
         $OUTPUT->footer();
         break;
diff --git a/badges/assert.php b/badges/assert.php
index 68eff5964..544c8ed62 100644
--- a/badges/assert.php
+++ b/badges/assert.php
@@ -14,12 +14,14 @@
 require_once "../config.php";
 require_once "badge-util.php";
 
-$l = Manifest::requireCurrentLessons();
-
 $PDOX = LTIX::getConnection();
 
 //echo("<pre>\n");
 $encrypted = $_GET['id'];
+$l = \Tsugi\Services\Badges\BadgeService::lessonsForAssertion($encrypted);
+if ( ! $l ) {
+    die_with_error_log('Cannot find lessons.json ($CFG->lessons) or an active course manifest');
+}
 $x = parse_badge_id($encrypted, $l);
 if ( is_string($x) ) {
     if ( strpos($x, '<h2>Badge Configuration Required</h2>') !== false ) {
diff --git a/badges/badge-util.php b/badges/badge-util.php
index 6b4f58b45..237251d3d 100644
--- a/badges/badge-util.php
+++ b/badges/badge-util.php
@@ -59,82 +59,19 @@ function check_badge_config() {
 }
 
 function parse_badge_id($encrypted, $lesson) {
-    global $CFG, $PDOX;
-
-    $config_error = check_badge_config();
-    if ( $config_error !== false ) {
-        return $config_error;
-    }
-
-    $decrypted = \Tsugi\Crypt\AesCtr::decrypt(hex2bin($encrypted), $CFG->badge_encrypt_password, 256);
-    $pieces = explode(':',$decrypted);
-
-    if ( count($pieces) != 3 || !is_numeric($pieces[0]) || !is_numeric($pieces[2])) {
-        return 'Decryption failed';
-    }
-    $pattern = '/[^a-zA-Z0-9_]/';
-    if ( preg_match($pattern, $pieces[1]) ) {
-        return 'File pattern fail';
-    }
-
-    $badge = null;
-    if ( is_object($lesson) && isset($lesson->lessons->badges) && is_iterable($lesson->lessons->badges) ) {
-        foreach ( $lesson->lessons->badges as $candidate ) {
-            if ( isset($candidate->image) && $candidate->image == $pieces[1].'.png' ) {
-                $badge = $candidate;
-                break;
-            }
-        }
-    }
-    $minted = \Tsugi\Services\Badges\BadgeService::mintedDisplayRow(
-        (int) $pieces[0],
-        (string) $pieces[1],
-        (int) $pieces[2]
-    );
-    if ( $badge === null && $minted !== null ) {
-        $badge = \Tsugi\Services\Badges\BadgeService::syntheticBadge(
-            (string) $pieces[1],
-            $minted['badge_title']
-        );
-    }
-    if ( $badge === null ) {
-        return 'Bad badge image';
-    }
-
-    // Load the badge
-    $file = $CFG->badge_path . '/' . $pieces[1] . '.png';
-    $png = file_get_contents($file);
-    if ( $png === false ) return 'File contents fail';
-
-    // Join the course even when it is soft-deleted. Published badges stay valid.
-    $row = $PDOX->rowDie(
-            "SELECT displayname, email, user_key, U.login_at, title FROM {$CFG->dbprefix}lti_user AS U
-            JOIN {$CFG->dbprefix}lti_membership AS M
-            ON U.user_id = M.user_id 
-            JOIN {$CFG->dbprefix}lti_context AS C
-            ON M.context_id = C.context_id 
-            WHERE U.user_id = :UID AND M.context_id = :CID",
-            array(":UID" => $pieces[0], ":CID" => $pieces[2])
-    );
-    if ( $row === false ) {
-        if ( $minted === null ) {
-            return 'Metadata failed';
-        }
-        $row = $minted;
-    }
-
-    return array($row, $png, $pieces, $badge);
+    return \Tsugi\Core\Badges::parseAssertionId($encrypted, $lesson);
 }
 
 function get_assertion($encrypted, $date, $code, $badge, $title, $email ) {
     global $CFG;
 
-    $config_error = check_badge_config();
+    $public = is_object($badge) && isset($badge->image) && \Tsugi\Services\Badges\CourseBadges::isPublicImage($badge->image);
+    $config_error = \Tsugi\Core\Badges::checkBadgeConfig( ! $public );
     if ( $config_error !== false ) {
         return $config_error;
     }
 
-    $image = $CFG->badge_url.'/'.$code.'.png';
+    $image = \Tsugi\Core\Badges::liveImageUrl($badge, $code, \Tsugi\Core\Badges::contextIdFromAssertion($encrypted));
     $recepient = 'sha256$' . hash('sha256', $email . $CFG->badge_assert_salt);
     $assert_id = $CFG->wwwroot . "/badges/assert.php?id=". $encrypted;
     $badge_url = $CFG->wwwroot . "/badges/badge-info.php?id=". $encrypted;
@@ -165,12 +102,13 @@ function get_assertion($encrypted, $date, $code, $badge, $title, $email ) {
 function get_badge($encrypted, $code, $badge, $title) {
     global $CFG;
 
-    $config_error = check_badge_config();
+    $public = is_object($badge) && isset($badge->image) && \Tsugi\Services\Badges\CourseBadges::isPublicImage($badge->image);
+    $config_error = \Tsugi\Core\Badges::checkBadgeConfig( ! $public );
     if ( $config_error !== false ) {
         return $config_error;
     }
 
-    $image = $CFG->badge_url.'/'.$code.'.png';
+    $image = \Tsugi\Core\Badges::liveImageUrl($badge, $code, \Tsugi\Core\Badges::contextIdFromAssertion($encrypted));
     // Use code-based URL instead of encrypted ID
     $badge_url = $CFG->wwwroot . "/badges/badge-info.php?code=". urlencode($code);
     $badge_issuer = $CFG->wwwroot . "/badges/badge-issuer.php";
@@ -193,7 +131,8 @@ function get_badge($encrypted, $code, $badge, $title) {
 function get_issuer($encrypted, $code, $badge, $title) {
     global $CFG;
 
-    $config_error = check_badge_config();
+    $public = is_object($badge) && isset($badge->image) && \Tsugi\Services\Badges\CourseBadges::isPublicImage($badge->image);
+    $config_error = \Tsugi\Core\Badges::checkBadgeConfig( ! $public );
     if ( $config_error !== false ) {
         return $config_error;
     }
diff --git a/badges/baker.php b/badges/baker.php
index 94ddf4b44..ba279d7b1 100644
--- a/badges/baker.php
+++ b/badges/baker.php
@@ -9,14 +9,17 @@
 require_once "../config.php";
 require_once "badge-util.php";
 
-$l = Manifest::requireCurrentLessons();
-
 $PDOX = LTIX::getConnection();
 
 $url = $_SERVER['REQUEST_URI'];
 $pieces = explode('/',$url);
 $encrypted = basename($pieces[count($pieces)-1],'.png');
 
+$l = \Tsugi\Services\Badges\BadgeService::lessonsForAssertion($encrypted);
+if ( ! $l ) {
+    die_with_error_log('Bad badge image');
+}
+
 $x = parse_badge_id($encrypted, $l);
 if ( is_string($x) ) {
     if ( strpos($x, '<h2>Badge Configuration Required</h2>') !== false ) {
diff --git a/lib/src/Controllers/Badges.php b/lib/src/Controllers/Badges.php
index c2274a741..f6d8e37b5 100644
--- a/lib/src/Controllers/Badges.php
+++ b/lib/src/Controllers/Badges.php
@@ -8,7 +8,9 @@
 use Tsugi\Core\LTIX;
 use Tsugi\Core\Manifest;
 use Tsugi\Grades\GradeUtil;
+use Tsugi\Core\Badges as BadgeJson;
 use Tsugi\Services\Badges\BadgeService;
+use Tsugi\Services\Badges\CourseBadges;
 use Tsugi\Services\Lessons\LessonsService;
 use Tsugi\Util\U;
 
@@ -108,15 +110,35 @@ public static function renderBadges(\Tsugi\Services\Lessons\LessonsService $less
 <div id="myTabContent" class="tab-content">
   <div class="tab-pane fade active in" id="home" role="tabpanel" aria-labelledby="home-tab">
 <?php
+        $defined = array();
+        if ( isset($lessons->lessons->badges) && is_iterable($lessons->lessons->badges) ) {
+            foreach ( $lessons->lessons->badges as $badge ) {
+                $defined[] = $badge;
+            }
+        }
+        if ( count($defined) < 1 ) {
+            echo('<p>'.htmlspecialchars(__('No badges are defined for this course.')).'</p>');
+            if ( Manifest::activeId() > 0 ) {
+                $author = new self();
+                if ( $author->isInstructor() ) {
+                    $authorUrl = self::determineToolHome('/settings') . '/badges';
+                    echo('<p><a href="'.htmlspecialchars($authorUrl).'">'.htmlspecialchars(__('Author badges')).'</a></p>');
+                }
+            }
+        }
         echo('<table class="table table-striped table-hover "><tbody>'."\n");
-        foreach($lessons->lessons->badges as $badge) {
-            $threshold = $badge->threshold;
+        foreach($defined as $badge) {
+            $threshold = (isset($badge->threshold) && is_numeric($badge->threshold)) ? $badge->threshold : 1.0;
+            $assignmentIds = (isset($badge->assignments) && is_iterable($badge->assignments)) ? $badge->assignments : array();
             $count = 0;
             $total = 0;
             $scores = array();
-            foreach($badge->assignments as $resource_link_id) {
-                $lti = $lessons->getLtiByRlid($resource_link_id);
-                $graded = LessonsService::ltiLaunchIsGraded($lti);
+            $places = array();
+            foreach($assignmentIds as $resource_link_id) {
+                $id = (string) $resource_link_id;
+                $place = CourseBadges::placement($lessons, $id);
+                $places[$id] = $place;
+                $graded = $place['graded'];
                 $score = 0;
                 if ( $graded && isset($allgrades[$resource_link_id]) ) {
                     $score = 100*$allgrades[$resource_link_id];
@@ -133,15 +155,15 @@ public static function renderBadges(\Tsugi\Services\Lessons\LessonsService $less
             if ( $progress < 5 ) $progress = 5;
             if ( $progress > 5 ) $kind = 'warning';
             if ( $progress > 50 ) $kind = 'info';
-            if ( $progress >= $threshold*100 ) {
+            if ( $progress >= (int) round($threshold * 100) ) {
                 $kind = 'success';
                 $awarded[] = $badge;
             }
             echo('<tr><td class="info">');
-            if ( ! isset($CFG->badge_url) ) {
+            $image = CourseBadges::displayUrl($badge, ReqScope::currentContextId());
+            if ( $image === '' ) {
                 echo('<i class="fa fa-certificate" aria-hidden="true" style="padding-right: 5px;"></i>');
             } else {
-                $image = $CFG->badge_url . '/' . $badge->image;
                 echo('<img src="'.htmlspecialchars($image).'" alt="'.htmlspecialchars($badge->title).'" style="width: 4rem;"/> ');
             }
             echo(htmlspecialchars($badge->title));
@@ -150,9 +172,10 @@ public static function renderBadges(\Tsugi\Services\Lessons\LessonsService $less
             echo('<div class="progress-bar progress-bar-'.$kind.'" style="width: '.$progress.'%"></div>');
             echo('</div>');
             echo("</td></tr>\n");
-            foreach($badge->assignments as $resource_link_id) {
-                $lti = $lessons->getLtiByRlid($resource_link_id);
-                $graded = LessonsService::ltiLaunchIsGraded($lti);
+            foreach($assignmentIds as $resource_link_id) {
+                $id = (string) $resource_link_id;
+                $place = isset($places[$id]) ? $places[$id] : CourseBadges::placement($lessons, $id);
+                $graded = $place['graded'];
                 $score = 0;
                 if ( $graded && isset($allgrades[$resource_link_id]) ) {
                     $score = 100*$allgrades[$resource_link_id];
@@ -163,15 +186,15 @@ public static function renderBadges(\Tsugi\Services\Lessons\LessonsService $less
                 if ( $progress > 5 ) $kind = 'warning';
                 if ( $progress > 50 ) $kind = 'info';
                 if ( $progress >= 100 ) $kind = 'success';
-                $module = $lessons->getModuleByRlid($resource_link_id);
 
                 echo('<tr><td>');
 
-                $href= "Missing ". $resource_link_id;
-                if ($module != null )  $href = $lessons->lessonsHome() . '/' . urlencode($module->anchor);
+                $href = $lessons->lessonsHome();
+                if ( ! empty($place['anchor']) ) {
+                    $href = $lessons->lessonsHome() . '/' . urlencode($place['anchor']);
+                }
 
-                $badge_title = "Missing ". $resource_link_id;
-                if ( $lti != null ) $badge_title = $lti->title;
+                $badge_title = $place['title'];
 
                 echo('<a href="'.htmlspecialchars($href).'">');
                 echo('<i class="fa fa-square-o text-info" aria-hidden="true" style="label label-success; padding-right: 5px;"></i>');
@@ -197,44 +220,17 @@ public static function renderBadges(\Tsugi\Services\Lessons\LessonsService $less
     } else if ( ! ReqScope::isLoggedIn() || ! ReqScope::currentContextId() ) {
         echo("<p>You must be logged in to see your badges.</p>\n");
     } else {
-        // Check badge configuration before attempting to encrypt
-        if ( !isset($CFG->badge_encrypt_password) || empty($CFG->badge_encrypt_password) || $CFG->badge_encrypt_password === false ||
-             !isset($CFG->badge_path) || empty($CFG->badge_path) ||
-             !isset($CFG->badge_url) || empty($CFG->badge_url) ||
-             !isset($CFG->badge_assert_salt) || empty($CFG->badge_assert_salt) || $CFG->badge_assert_salt === false ) {
-            echo("<div class=\"alert alert-warning\">\n");
-            echo("<h3>Badge Configuration Required</h3>\n");
-            echo("<p>The following badge configuration parameters are missing or not set in your <code>config.php</code>:</p>\n");
-            echo("<ul>\n");
-            if ( !isset($CFG->badge_encrypt_password) || empty($CFG->badge_encrypt_password) || $CFG->badge_encrypt_password === false ) {
-                echo("<li><code>\$CFG->badge_encrypt_password</code></li>\n");
+        $filesRequired = false;
+        foreach ( $awarded as $badge ) {
+            $badgeImage = (isset($badge->image) && is_string($badge->image)) ? $badge->image : '';
+            if ( ! CourseBadges::isPublicImage($badgeImage) ) {
+                $filesRequired = true;
+                break;
             }
-            if ( !isset($CFG->badge_assert_salt) || empty($CFG->badge_assert_salt) || $CFG->badge_assert_salt === false ) {
-                echo("<li><code>\$CFG->badge_assert_salt</code></li>\n");
-            }
-            if ( !isset($CFG->badge_path) || empty($CFG->badge_path) ) {
-                echo("<li><code>\$CFG->badge_path</code></li>\n");
-            }
-            if ( !isset($CFG->badge_url) || empty($CFG->badge_url) ) {
-                echo("<li><code>\$CFG->badge_url</code></li>\n");
-            }
-            echo("</ul>\n");
-            echo("<h4>How to Configure Badges</h4>\n");
-            echo("<p>To enable badge functionality, add the following to your <code>config.php</code> file:</p>\n");
-            echo("<pre>\n");
-            echo("// Badge generation settings - once you set these values to something\n");
-            echo("// other than false and start issuing badges - don't change these or\n");
-            echo("// existing badge images that have been downloaded from the system\n");
-            echo("// will be invalidated.\n");
-            echo("\$CFG->badge_encrypt_password = \"somethinglongwithhex387438758974987\";\n");
-            echo("\$CFG->badge_assert_salt = \"mediumlengthhexstring\";\n");
-            echo("\n");
-            echo("// This folder contains the badge images\n");
-            echo("\$CFG->badge_path = \$CFG->dirroot . '/../bimages';\n");
-            echo("\$CFG->badge_url = \$CFG->apphome . '/bimages';\n");
-            echo("</pre>\n");
-            echo("<p>For more information, see <code>config-dist.php</code> in your Tsugi installation.</p>\n");
-            echo("</div>\n");
+        }
+        $configError = BadgeJson::checkBadgeConfig($filesRequired);
+        if ( $configError !== false ) {
+            echo('<div class="alert alert-warning">'.$configError.'</div>');
         } else {
             echo("<ul style=\"list-style: none;\">\n");
             foreach($awarded as $badge) {
@@ -250,8 +246,14 @@ public static function renderBadges(\Tsugi\Services\Lessons\LessonsService $less
                 $assert_url = $published_guid !== null
                     ? $CFG->wwwroot . '/assertions/' . rawurlencode($published_guid) . '.html'
                     : $CFG->wwwroot . '/assertions/' . $encrypted . '.html';
+                $thumb = CourseBadges::isPublicImage($badge->image)
+                    ? CourseBadges::displayUrl($badge, ReqScope::currentContextId())
+                    : '';
+                if ( $thumb === '' ) {
+                    $thumb = $CFG->wwwroot.'/badges/images/'.$encrypted.'.png';
+                }
                 echo('<a href="'.htmlspecialchars($assert_url).'" target="_blank" rel="noopener noreferrer" aria-label="'.__('View badge assertion, opens in new window').'">');
-                echo('<img src="'.htmlspecialchars($CFG->wwwroot.'/badges/images/'.$encrypted.'.png').'" width="90" alt="'.htmlspecialchars($badge->title).'"></a>');
+                echo('<img src="'.htmlspecialchars($thumb).'" width="90" alt="'.htmlspecialchars($badge->title).'"></a>');
                 echo(htmlspecialchars($badge->title));
                 echo("</p></li>\n");
             }
diff --git a/lib/src/Controllers/Settings.php b/lib/src/Controllers/Settings.php
index 12e0616d6..295814460 100644
--- a/lib/src/Controllers/Settings.php
+++ b/lib/src/Controllers/Settings.php
@@ -23,7 +23,10 @@
 use Tsugi\Services\Cartridge\Package;
 use Tsugi\Services\Cartridge\Pending;
 use Tsugi\Services\Courses\CourseDelete;
+use Tsugi\LinkedIn\LinkedIn;
+use Tsugi\Services\Badges\CourseBadges;
 use Tsugi\Services\CourseNav\CourseNav;
+use Tsugi\Services\Lessons\LessonsService;
 use Tsugi\Services\Outbound\Lti11CourseTool;
 use Tsugi\Services\Outbound\PlatformDynamicRegistration;
 use Tsugi\Services\Outbound\ToolRegistrationService;
@@ -45,7 +48,7 @@
  * Site-wide (wwwroot/settings): keys, contexts, PII expiry. Login is required;
  * a course context is not. Do not call requireAuth() on those pages.
  *
- * Course-mounted (/courses/{id}/settings): theme, navigation, images,
+ * Course-mounted (/courses/{id}/settings): theme, navigation, images, badges,
  * add, edit, and delete an LTI 1.1 tool for this course, Common Cartridge import/export,
  * and delete course for the active manifest.
  * Instructor + manifest only. Nested dispatch from
@@ -78,6 +81,7 @@ public static function routes(Application $app, $prefix=self::ROUTE) {
         self::mapPage($app, $prefix.'/delete', 'deleteCourse', true);
         self::mapPage($app, $prefix.'/navigation', 'navigation', true);
         self::mapPage($app, $prefix.'/images', 'images', true);
+        self::mapPage($app, $prefix.'/badges', 'badges', true);
         self::mapPage($app, $prefix.'/tools/dynamic/status', 'toolsDynamicStatus', false);
         self::mapPage($app, $prefix.'/tools/dynamic/done', 'toolsDynamicDone', false);
         self::mapPage($app, $prefix.'/tools/dynamic', 'toolsDynamic', true);
@@ -2754,6 +2758,153 @@ private function imagesPost(Request $request)
         return new RedirectResponse($images_url);
     }
 
+    /**
+     * Course-mounted Settings: author the badges array on this manifest.
+     */
+    public function badges(Request $request)
+    {
+        if ( ! self::isCourseRoute() ) {
+            return new RedirectResponse($this->pageUrl());
+        }
+        if ( $request->isMethod('POST') ) {
+            return $this->badgesPost($request);
+        }
+
+        global $CFG, $OUTPUT, $PDOX;
+
+        $setup_url = U::addSession($this->toolHome(self::ROUTE));
+        $navigation_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'navigation'));
+        $export_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'export'));
+        $import_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'import'));
+        $images_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'images'));
+        $badges_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'badges'));
+        $delete_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'delete'));
+        $tools_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'tools'));
+        $files_public_url = U::addSession($this->toolHome('/files') . '?folder=' . rawurlencode('Public'));
+        $gate = $this->courseGate();
+        if ( $gate ) {
+            return $gate;
+        }
+
+        if ( $PDOX === null || $PDOX === false ) {
+            $PDOX = LTIX::getConnection();
+        }
+
+        $doc = Manifest::currentDocument();
+        $decoded = (is_array($doc) && isset($doc['json'])) ? json_decode($doc['json'], true) : null;
+        $badges = CourseBadges::listFromDocument(is_array($decoded) ? ($decoded['badges'] ?? array()) : array());
+        $lessons = Manifest::currentLessons();
+        $assignment_choices = ($lessons instanceof LessonsService)
+            ? CourseBadges::assignmentChoices($lessons)
+            : array();
+        $public_images = CourseBadges::publicPngs(ReqScope::currentContextId());
+        $linkedin_add = LinkedIn::fromConfig($CFG)->canAddToProfile();
+
+        $edit_index = null;
+        $edit = null;
+        $raw = $request->query->get('badge', '');
+        if ( is_scalar($raw) && ctype_digit((string) $raw) ) {
+            $idx = (int) $raw;
+            if ( isset($badges[$idx]) ) {
+                $edit_index = $idx;
+                $edit = $badges[$idx];
+            }
+        }
+        if ( $lessons instanceof LessonsService && is_array($edit) && isset($edit['assignments']) && is_array($edit['assignments']) ) {
+            foreach ( $edit['assignments'] as $saved_id ) {
+                $saved_id = (string) $saved_id;
+                if ( $saved_id === '' || isset($assignment_choices[$saved_id]) ) {
+                    continue;
+                }
+                $place = CourseBadges::placement($lessons, $saved_id);
+                if ( ! empty($place['known']) ) {
+                    $assignment_choices[$saved_id] = $place['title'];
+                }
+            }
+        }
+
+        $save_url = $badges_url;
+        $setup_tab = 'badges';
+
+        $OUTPUT->header();
+        $OUTPUT->bodyStart();
+        $OUTPUT->topNav();
+        $OUTPUT->flashMessages();
+        ?>
+        <main class="container" id="main-content">
+            <?php include __DIR__ . '/templates/Settings/tabs.inc.php'; ?>
+            <div style="margin-top:10px;">
+            <?php include __DIR__ . '/templates/Settings/badges.inc.php'; ?>
+            </div>
+        </main>
+        <?php
+        $OUTPUT->footer();
+        return '';
+    }
+
+    /**
+     * Save the badges array onto a new manifest version.
+     */
+    private function badgesPost(Request $request)
+    {
+        $badges_url = U::addSession(self::joinToolHome($this->toolHome(self::ROUTE), 'badges'));
+        $gate = $this->courseGate();
+        if ( $gate ) {
+            return $gate;
+        }
+        $csrf = self::requireCsrf($badges_url);
+        if ( $csrf ) {
+            return $csrf;
+        }
+
+        global $PDOX;
+        if ( $PDOX === null || $PDOX === false ) {
+            $PDOX = LTIX::getConnection();
+        }
+
+        $doc = Manifest::currentDocument();
+        if ( ! $doc ) {
+            U::flashError(__('Cannot load course manifest.'));
+            return new RedirectResponse($badges_url);
+        }
+        $decoded = json_decode($doc['json'], true);
+        if ( ! is_array($decoded) ) {
+            U::flashError(__('Invalid manifest JSON.'));
+            return new RedirectResponse($badges_url);
+        }
+
+        $lessons = Manifest::currentLessons();
+        if ( ! ($lessons instanceof LessonsService) ) {
+            U::flashError(__('Cannot load course manifest.'));
+            return new RedirectResponse($badges_url);
+        }
+
+        $context_id = ReqScope::currentContextId();
+        try {
+            $decoded['badges'] = CourseBadges::apply(
+                $decoded['badges'] ?? array(),
+                $_POST,
+                $lessons,
+                $context_id
+            );
+            Manifest::saveNewVersion(
+                $context_id,
+                $decoded,
+                ReqScope::loggedInUserId(),
+                'Update badges'
+            );
+        } catch ( \InvalidArgumentException $e ) {
+            U::flashError($e->getMessage());
+            return new RedirectResponse($badges_url);
+        } catch ( \Exception $e ) {
+            U::flashError(__('Failed to save badges.'));
+            return new RedirectResponse($badges_url);
+        }
+
+        U::flashSuccess(__('Badges saved.'));
+        return new RedirectResponse($badges_url);
+    }
+
     /**
      * Common Cartridge export form for the current manifest course.
      */
diff --git a/lib/src/Controllers/templates/Settings/badges.inc.php b/lib/src/Controllers/templates/Settings/badges.inc.php
new file mode 100644
index 000000000..32665586f
--- /dev/null
+++ b/lib/src/Controllers/templates/Settings/badges.inc.php
@@ -0,0 +1,184 @@
+<?php
+/**
+ * Course badge authoring.
+ *
+ * Expected: $badges (list of manifest badge arrays), $edit_index (int|null),
+ * $edit (badge array|null), $public_images, $assignment_choices,
+ * $save_url, $badges_url, $files_public_url, $linkedin_add (bool)
+ */
+use Tsugi\Core\ReqScope;
+use Tsugi\Services\Badges\CourseBadges;
+
+$editing = is_array($edit);
+$edit_title = $editing && isset($edit['title']) ? (string) $edit['title'] : '';
+$edit_image = $editing && isset($edit['image']) ? (string) $edit['image'] : '';
+$edit_threshold = $editing ? 100 : 80;
+if ( $editing && isset($edit['threshold']) && is_numeric($edit['threshold']) ) {
+    $edit_threshold = (int) round(((float) $edit['threshold']) * 100);
+}
+$edit_completion = $editing && ! empty($edit['completion']);
+$edit_assignments = array();
+if ( $editing && isset($edit['assignments']) && is_array($edit['assignments']) ) {
+    foreach ( $edit['assignments'] as $rlid ) {
+        $edit_assignments[] = (string) $rlid;
+    }
+}
+$edit_canonical = CourseBadges::canonicalPublicPath($edit_image);
+?>
+<p><?= __('Badge pictures live in Files → Public. The file name, without .png, is the badge code. Use letters, numbers, and underscores, like hello_world.png.') ?></p>
+<p><a href="<?= htmlspecialchars($files_public_url) ?>"><?= __('Open Public files') ?></a></p>
+<?php
+$unsafe_images = array();
+foreach ( $public_images as $png ) {
+    if ( empty($png['safe']) ) {
+        $unsafe_images[] = $png['path'];
+    }
+}
+?>
+<?php if ( count($public_images) < 1 ) { ?>
+<p class="alert alert-info"><?= __('Upload a PNG into Public before you add a badge.') ?></p>
+<?php } elseif ( count($unsafe_images) > 0 ) { ?>
+<p class="alert alert-info"><?= __('These Public PNGs are not listed because the file name must use only letters, numbers, and underscores:') ?> <?= htmlspecialchars(implode(', ', $unsafe_images)) ?></p>
+<?php } ?>
+
+<?php if ( count($badges) < 1 ) { ?>
+<p><?= __('No badges yet.') ?></p>
+<?php } else { ?>
+<table class="table table-striped">
+    <thead>
+        <tr>
+            <th><?= __('Badge') ?></th>
+            <th><?= __('Image') ?></th>
+            <th><?= __('Percent') ?></th>
+            <th><?= __('Assignments') ?></th>
+            <th></th>
+        </tr>
+    </thead>
+    <tbody>
+    <?php foreach ( $badges as $i => $badge ) {
+        $title = isset($badge['title']) ? (string) $badge['title'] : '';
+        $image = isset($badge['image']) ? (string) $badge['image'] : '';
+        $thumb = CourseBadges::displayUrl($image, ReqScope::currentContextId());
+        $percent = (isset($badge['threshold']) && is_numeric($badge['threshold']))
+            ? (int) round(((float) $badge['threshold']) * 100)
+            : 100;
+        $count = (isset($badge['assignments']) && is_array($badge['assignments'])) ? count($badge['assignments']) : 0;
+        $edit_url = $badges_url . (strpos($badges_url, '?') === false ? '?' : '&') . 'badge=' . (int) $i;
+        ?>
+        <tr>
+            <td><?= htmlspecialchars($title) ?></td>
+            <td>
+                <?php if ( $thumb !== '' ) { ?>
+                <img src="<?= htmlspecialchars($thumb) ?>" alt="" style="width: 3rem;">
+                <?php } ?>
+                <?= htmlspecialchars($image) ?>
+            </td>
+            <td><?= (int) $percent ?></td>
+            <td><?= (int) $count ?></td>
+            <td>
+                <a class="btn btn-default btn-sm" href="<?= htmlspecialchars($edit_url) ?>"><?= __('Edit') ?></a>
+                <?php if ( $i > 0 ) { ?>
+                <form method="post" action="<?= htmlspecialchars($save_url) ?>" style="display:inline;">
+                    <?= \Tsugi\Controllers\Settings::csrfField() ?>
+                    <input type="hidden" name="badge_action" value="move">
+                    <input type="hidden" name="move_dir" value="up">
+                    <input type="hidden" name="badge_index" value="<?= (int) $i ?>">
+                    <button type="submit" class="btn btn-default btn-sm"><?= __('Up') ?></button>
+                </form>
+                <?php } ?>
+                <?php if ( $i < count($badges) - 1 ) { ?>
+                <form method="post" action="<?= htmlspecialchars($save_url) ?>" style="display:inline;">
+                    <?= \Tsugi\Controllers\Settings::csrfField() ?>
+                    <input type="hidden" name="badge_action" value="move">
+                    <input type="hidden" name="move_dir" value="down">
+                    <input type="hidden" name="badge_index" value="<?= (int) $i ?>">
+                    <button type="submit" class="btn btn-default btn-sm"><?= __('Down') ?></button>
+                </form>
+                <?php } ?>
+                <form method="post" action="<?= htmlspecialchars($save_url) ?>" style="display:inline;" onsubmit="return confirm(<?= htmlspecialchars(json_encode(__('Delete this badge?')), ENT_QUOTES, 'UTF-8') ?>);">
+                    <?= \Tsugi\Controllers\Settings::csrfField() ?>
+                    <input type="hidden" name="badge_action" value="delete">
+                    <input type="hidden" name="badge_index" value="<?= (int) $i ?>">
+                    <button type="submit" class="btn btn-default btn-sm"><?= __('Delete') ?></button>
+                </form>
+            </td>
+        </tr>
+    <?php } ?>
+    </tbody>
+</table>
+<?php } ?>
+
+<h2><?= $editing ? __('Edit badge') : __('Add badge') ?></h2>
+<form method="post" action="<?= htmlspecialchars($save_url) ?>">
+    <?= \Tsugi\Controllers\Settings::csrfField() ?>
+    <input type="hidden" name="badge_action" value="save">
+    <input type="hidden" name="badge_index" value="<?= $editing ? (int) $edit_index : '' ?>">
+    <div class="form-group">
+        <label for="badge-title"><?= __('Title') ?></label>
+        <input type="text" class="form-control" id="badge-title" name="title" required value="<?= htmlspecialchars($edit_title, ENT_QUOTES, 'UTF-8') ?>">
+    </div>
+    <div class="form-group">
+        <label for="badge-image"><?= __('Image in Public') ?></label>
+        <select class="form-control" id="badge-image" name="image" required>
+            <option value=""><?= __('Choose a PNG') ?></option>
+            <?php
+            $saw_edit = false;
+            foreach ( $public_images as $png ) {
+                if ( ! $png['safe'] ) {
+                    continue;
+                }
+                if ( $edit_canonical !== null && $png['path'] === $edit_canonical ) {
+                    $saw_edit = true;
+                }
+                $selected = ($edit_canonical !== null && $png['path'] === $edit_canonical) ? ' selected' : '';
+                ?>
+            <option value="<?= htmlspecialchars($png['path'], ENT_QUOTES, 'UTF-8') ?>"<?= $selected ?>><?= htmlspecialchars($png['path']) ?></option>
+            <?php } ?>
+            <?php if ( $editing && $edit_canonical !== null && ! $saw_edit ) { ?>
+            <option value="<?= htmlspecialchars($edit_canonical, ENT_QUOTES, 'UTF-8') ?>" selected><?= htmlspecialchars($edit_canonical) ?> <?= __('(missing)') ?></option>
+            <?php } ?>
+        </select>
+    </div>
+    <div class="form-group">
+        <label for="badge-threshold"><?= __('Percent required') ?></label>
+        <input type="number" class="form-control" id="badge-threshold" name="threshold_percent" min="0" max="100" step="1" required value="<?= (int) $edit_threshold ?>" style="max-width: 8em;">
+        <p class="help-block"><?= __('With no assignments, the badge is awarded as soon as the learner opens Badges. Otherwise this is the percent of those assignments they need.') ?></p>
+    </div>
+    <div class="checkbox">
+        <label>
+            <input type="checkbox" name="completion" value="1"<?= $edit_completion ? ' checked' : '' ?>>
+            <?= __('Completion badge') ?>
+        </label>
+        <?php if ( ! empty($linkedin_add) ) { ?>
+        <p class="help-block"><?= __('Only completion badges have the option to add the credential to LinkedIn.') ?></p>
+        <?php } ?>
+    </div>
+    <fieldset class="form-group">
+        <legend style="font-size: 1em; font-weight: 700; border: 0; margin-bottom: 0.4em;"><?= __('Assignments that count') ?></legend>
+        <?php if ( count($assignment_choices) < 1 ) { ?>
+        <p class="help-block"><?= __('No published graded items yet. Publish a quiz or another graded item, then come back.') ?></p>
+        <?php } else { ?>
+        <?php
+        $assignment_n = 0;
+        foreach ( $assignment_choices as $rlid => $label ) {
+            $checked = in_array((string) $rlid, $edit_assignments, true) ? ' checked' : '';
+            $input_id = 'badge-assignment-' . $assignment_n;
+            $assignment_n++;
+            ?>
+        <div class="checkbox" style="margin-top: 0; margin-bottom: 0.2em;">
+            <label for="<?= htmlspecialchars($input_id, ENT_QUOTES, 'UTF-8') ?>">
+                <input type="checkbox" id="<?= htmlspecialchars($input_id, ENT_QUOTES, 'UTF-8') ?>" name="assignments[]" value="<?= htmlspecialchars((string) $rlid, ENT_QUOTES, 'UTF-8') ?>"<?= $checked ?>>
+                <?= htmlspecialchars($label) ?>
+            </label>
+        </div>
+        <?php } ?>
+        <p class="help-block"><?= __('These are the published items that record a grade, including quizzes. Leave them unchecked for a badge with no assignments.') ?></p>
+        <?php } ?>
+    </fieldset>
+    <p>
+        <button type="submit" class="btn btn-primary"><?= $editing ? __('Save badge') : __('Add badge') ?></button>
+        <?php if ( $editing ) { ?>
+        <a href="<?= htmlspecialchars($badges_url) ?>" class="btn btn-default"><?= __('Cancel') ?></a>
+        <?php } ?>
+    </p>
+</form>
diff --git a/lib/src/Controllers/templates/Settings/tabs.inc.php b/lib/src/Controllers/templates/Settings/tabs.inc.php
index f860ae1aa..f9eb9ea6c 100644
--- a/lib/src/Controllers/templates/Settings/tabs.inc.php
+++ b/lib/src/Controllers/templates/Settings/tabs.inc.php
@@ -1,11 +1,11 @@
 <?php
 /**
- * Course Settings tabs: Theme, Navigation, Images, External Tools, External Links,
- * Import, Export, Delete.
+ * Course Settings tabs: Theme, Navigation, Images, Badges, External Tools,
+ * External Links, Import, Export, Delete.
  *
- * Expected: $setup_url, $navigation_url, $images_url, $tools_url, $lesson_links_url,
- * $import_url, $export_url, $delete_url,
- * $setup_tab ('theme'|'navigation'|'images'|'tools'|'links'|'import'|'export'|'delete')
+ * Expected: $setup_url, $navigation_url, $images_url, $badges_url, $tools_url,
+ * $lesson_links_url, $import_url, $export_url, $delete_url,
+ * $setup_tab ('theme'|'navigation'|'images'|'badges'|'tools'|'links'|'import'|'export'|'delete')
  */
 if ( ! isset($setup_tab) ) {
     $setup_tab = 'theme';
@@ -16,6 +16,12 @@
 if ( ! isset($images_url) ) {
     $images_url = $setup_url;
 }
+if ( ! isset($badges_url) || ! is_string($badges_url) || $badges_url === '' ) {
+    $query = strpos($setup_url, '?');
+    $path = $query === false ? $setup_url : substr($setup_url, 0, $query);
+    $tail = $query === false ? '' : substr($setup_url, $query);
+    $badges_url = rtrim($path, '/') . '/badges' . $tail;
+}
 if ( ! isset($tools_url) ) {
     $tools_url = $setup_url;
 }
@@ -49,6 +55,9 @@
   <li class="<?= $setup_tab === 'images' ? 'active' : '' ?>">
     <a href="<?= htmlspecialchars($images_url) ?>"><?= __('Images') ?></a>
   </li>
+  <li class="<?= $setup_tab === 'badges' ? 'active' : '' ?>">
+    <a href="<?= htmlspecialchars($badges_url) ?>"><?= __('Badges') ?></a>
+  </li>
   <li class="<?= $setup_tab === 'tools' ? 'active' : '' ?>">
     <a href="<?= htmlspecialchars($tools_url) ?>"><?= __('External Tools') ?></a>
   </li>
diff --git a/lib/src/Core/Badges.php b/lib/src/Core/Badges.php
index 272007e11..aa2a48204 100644
--- a/lib/src/Core/Badges.php
+++ b/lib/src/Core/Badges.php
@@ -5,6 +5,7 @@
 use \Tsugi\Util\U;
 use \Tsugi\Util\Ob3DataIntegrity;
 use \Tsugi\Crypt\AesCtr;
+use \Tsugi\Services\Badges\CourseBadges;
 
 /**
  * Open Badges 2.0 and 3.0 JSON generation utilities
@@ -31,11 +32,41 @@ class Badges {
      * @param object $lesson The Lessons object
      * @return array|string Array of [row, png, pieces, badge] on success, error string on failure
      */
+    /**
+     * Course id stored in an unpublished assertion id, or 0.
+     *
+     * @param mixed $encrypted
+     */
+    public static function contextIdFromAssertion($encrypted): int {
+        global $CFG;
+
+        if ( ! is_string($encrypted) || $encrypted === '' || (strlen($encrypted) % 2) !== 0 || ! ctype_xdigit($encrypted) ) {
+            return 0;
+        }
+        if ( self::checkBadgeConfig(false) !== false ) {
+            return 0;
+        }
+        $bin = hex2bin($encrypted);
+        if ( ! is_string($bin) || $bin === '' ) {
+            return 0;
+        }
+        $plain = \Tsugi\Crypt\AesCtr::decrypt($bin, $CFG->badge_encrypt_password, 256);
+        if ( ! is_string($plain) ) {
+            return 0;
+        }
+        $pieces = explode(':', $plain);
+        if ( count($pieces) !== 3 || ! is_numeric($pieces[2]) ) {
+            return 0;
+        }
+        return (int) $pieces[2];
+    }
+
     public static function parseAssertionId($encrypted, $lesson) {
         global $CFG, $PDOX;
         
-        // Check badge configuration
-        $config_error = self::checkBadgeConfig();
+        // Encrypt password and salt. The site image folder is checked only
+        // when this badge is not a Files Public picture.
+        $config_error = self::checkBadgeConfig(false);
         if ( $config_error !== false ) {
             return $config_error;
         }
@@ -67,10 +98,17 @@ public static function parseAssertionId($encrypted, $lesson) {
             return 'Bad badge image';
         }
 
-        // Load the badge
-        $file = $CFG->badge_path . '/' . $pieces[1] . '.png';
-        $png = file_get_contents($file);
-        if ( $png === false ) return 'File contents fail';
+        $png = self::pngBytes($badge, $pieces[1], (int) $pieces[2]);
+        if ( ! is_string($png) ) {
+            $image = (is_object($badge) && isset($badge->image)) ? $badge->image : '';
+            if ( ! CourseBadges::isPublicImage($image) ) {
+                $file_config = self::checkBadgeConfig(true);
+                if ( $file_config !== false ) {
+                    return $file_config;
+                }
+            }
+            return 'File contents fail';
+        }
 
         // Join the course even when it is soft-deleted. Published badges stay valid.
         $row = $PDOX->rowDie(
@@ -104,20 +142,26 @@ private static function badgeFromLessons($lesson, $code) {
             return null;
         }
         foreach ( $lesson->lessons->badges as $badge ) {
-            if ( isset($badge->image) && $badge->image == $code.'.png' ) {
+            if ( isset($badge->image) && CourseBadges::imageMatchesCode($badge->image, $code) ) {
                 return $badge;
             }
         }
         return null;
     }
-    
+
     /**
-     * Check if badge configuration is properly set up
-     * Returns an error message string if configuration is missing, or false if OK
-     * 
+     * Check if badge configuration is properly set up.
+     *
+     * Identity (encrypt password and salt) is always required. The site badge
+     * folder is required for file-based badge images. Manifest badges that
+     * use Files Public do not need it.
+     *
+     * Returns an error message string if configuration is missing, or false if OK.
+     *
+     * @param bool $requireFiles When false, badge_path and badge_url are not required
      * @return string|false Error message string or false if OK
      */
-    public static function checkBadgeConfig() {
+    public static function checkBadgeConfig($requireFiles = true) {
         global $CFG;
         
         $missing = array();
@@ -130,12 +174,14 @@ public static function checkBadgeConfig() {
             $missing[] = '$CFG->badge_assert_salt';
         }
         
-        if ( !isset($CFG->badge_path) || empty($CFG->badge_path) ) {
-            $missing[] = '$CFG->badge_path';
-        }
-        
-        if ( !isset($CFG->badge_url) || empty($CFG->badge_url) ) {
-            $missing[] = '$CFG->badge_url';
+        if ( $requireFiles ) {
+            if ( !isset($CFG->badge_path) || empty($CFG->badge_path) ) {
+                $missing[] = '$CFG->badge_path';
+            }
+            
+            if ( !isset($CFG->badge_url) || empty($CFG->badge_url) ) {
+                $missing[] = '$CFG->badge_url';
+            }
         }
         
         if ( count($missing) > 0 ) {
@@ -155,10 +201,12 @@ public static function checkBadgeConfig() {
             $msg .= "// will be invalidated.\n";
             $msg .= "\$CFG->badge_encrypt_password = \"somethinglongwithhex387438758974987\";\n";
             $msg .= "\$CFG->badge_assert_salt = \"mediumlengthhexstring\";\n";
-            $msg .= "\n";
-            $msg .= "// This folder contains the badge images\n";
-            $msg .= "\$CFG->badge_path = \$CFG->dirroot . '/../bimages';\n";
-            $msg .= "\$CFG->badge_url = \$CFG->apphome . '/bimages';\n";
+            if ( $requireFiles ) {
+                $msg .= "\n";
+                $msg .= "// This folder contains the badge images\n";
+                $msg .= "\$CFG->badge_path = \$CFG->dirroot . '/../bimages';\n";
+                $msg .= "\$CFG->badge_url = \$CFG->apphome . '/bimages';\n";
+            }
             $msg .= "</pre>\n";
             $msg .= "<p>For more information, see <code>config-dist.php</code> in your Tsugi installation.</p>\n";
             return $msg;
@@ -166,6 +214,83 @@ public static function checkBadgeConfig() {
         
         return false;
     }
+
+    /**
+     * Live image URL for a badge that has not been published yet.
+     *
+     * A course Public image stays on that course's file. A missing Public
+     * file does not fall through to the site badge folder.
+     *
+     * @param object|null $badge
+     * @param string $code
+     */
+    public static function liveImageUrl($badge, $code, int $contextId = 0): string {
+        global $CFG;
+        if ( is_object($badge) ) {
+            $image = (isset($badge->image) && is_string($badge->image)) ? $badge->image : '';
+            if ( CourseBadges::isPublicImage($image) ) {
+                return CourseBadges::displayUrl($badge, $contextId);
+            }
+            $url = CourseBadges::displayUrl($badge, $contextId);
+            if ( $url !== '' ) {
+                return $url;
+            }
+        }
+        $code = is_string($code) ? $code : '';
+        if ( $code !== '' && isset($CFG->badge_url) && is_string($CFG->badge_url) && $CFG->badge_url !== '' ) {
+            return rtrim($CFG->badge_url, '/') . '/' . $code . '.png';
+        }
+        return '';
+    }
+
+    /**
+     * Site badge folder is required only for an unpublished file-based image.
+     *
+     * @param object|null $badge
+     * @param array<string,mixed>|null $frozen
+     */
+    private static function needsBadgeFiles($badge, $frozen): bool {
+        if ( self::useFrozen($frozen) ) {
+            return false;
+        }
+        if ( is_object($badge) && isset($badge->image) && CourseBadges::isPublicImage($badge->image) ) {
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * @param object|null $badge
+     * @param array<string,mixed>|null $frozen
+     */
+    private static function claimImage($badge, $code, $frozen, $encrypted = null): string {
+        $contextId = is_string($encrypted) ? self::contextIdFromAssertion($encrypted) : 0;
+        $live = self::liveImageUrl($badge, $code, $contextId);
+        if ( self::useFrozen($frozen) ) {
+            return self::frozenString($frozen, 'image_url', $live);
+        }
+        return $live;
+    }
+
+    /**
+     * PNG bytes for baking. Public files come from the course. Otherwise badge_path.
+     *
+     * @param object|null $badge
+     * @return string|null
+     */
+    private static function pngBytes($badge, string $code, int $contextId): ?string {
+        global $CFG;
+        $image = (is_object($badge) && isset($badge->image) && is_string($badge->image)) ? $badge->image : '';
+        if ( CourseBadges::isPublicImage($image) ) {
+            return CourseBadges::bytes($image, $contextId);
+        }
+        if ( $code === '' || ! isset($CFG->badge_path) || ! is_string($CFG->badge_path) || $CFG->badge_path === '' ) {
+            return null;
+        }
+        $file = rtrim($CFG->badge_path, '/') . '/' . $code . '.png';
+        $png = @file_get_contents($file);
+        return is_string($png) ? $png : null;
+    }
     
     /**
      * Get the issuer email from config or return default
@@ -286,6 +411,21 @@ private static function assertionResourceUrl($guid, $resource) {
         return rtrim($CFG->wwwroot, '/') . '/assertions/' . rawurlencode($guid) . '/' . $resource;
     }
 
+    /**
+     * Manifest badges are fetched from the assertion id, which names the course.
+     *
+     * @param object|null $badge
+     */
+    private static function courseScopedResource($encrypted, $badge, string $resource): ?string {
+        if ( ! is_string($encrypted) || $encrypted === '' ) {
+            return null;
+        }
+        if ( ! is_object($badge) || ! isset($badge->image) || ! CourseBadges::isPublicImage($badge->image) ) {
+            return null;
+        }
+        return self::assertionResourceUrl($encrypted, $resource);
+    }
+
     /**
      * Issuer profile fields. Frozen values win for a published badge.
      *
@@ -367,19 +507,17 @@ private static function normalizeDateToZ($date) {
     public static function getOb2Assertion($encrypted, $date, $code, $badge, $title, $email, $frozen = null) {
         global $CFG;
 
-        $config_error = self::checkBadgeConfig();
+        $config_error = self::checkBadgeConfig(self::needsBadgeFiles($badge, $frozen));
         if ( $config_error !== false ) {
             return $config_error;
         }
 
-        $image = self::useFrozen($frozen)
-            ? self::frozenString($frozen, 'image_url', $CFG->badge_url.'/'.$code.'.png')
-            : $CFG->badge_url.'/'.$code.'.png';
+        $image = self::claimImage($badge, $code, $frozen, $encrypted);
         $recipient = 'sha256$' . hash('sha256', $email . $CFG->badge_assert_salt);
         $assert_id = self::buildAssertionUrl($encrypted);
         $badge_url = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'badge.json')
-            : self::buildBadgeUrl($code);
+            : (self::courseScopedResource($encrypted, $badge, 'badge.json') ?? self::buildBadgeUrl($code));
         $evidence = self::useFrozen($frozen)
             ? self::frozenString($frozen, 'evidence_url', $CFG->apphome)
             : $CFG->apphome;
@@ -429,20 +567,18 @@ public static function getOb2Assertion($encrypted, $date, $code, $badge, $title,
     public static function getOb2Badge($encrypted, $code, $badge, $title, $frozen = null) {
         global $CFG;
 
-        $config_error = self::checkBadgeConfig();
+        $config_error = self::checkBadgeConfig(self::needsBadgeFiles($badge, $frozen));
         if ( $config_error !== false ) {
             return $config_error;
         }
 
-        $image = self::useFrozen($frozen)
-            ? self::frozenString($frozen, 'image_url', $CFG->badge_url.'/'.$code.'.png')
-            : $CFG->badge_url.'/'.$code.'.png';
+        $image = self::claimImage($badge, $code, $frozen, $encrypted);
         $badge_url = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'badge.json')
-            : self::buildBadgeUrl($code);
+            : (self::courseScopedResource($encrypted, $badge, 'badge.json') ?? self::buildBadgeUrl($code));
         $issuer_url = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'issuer.json')
-            : self::buildIssuerUrl();
+            : (self::courseScopedResource($encrypted, $badge, 'issuer.json') ?? self::buildIssuerUrl());
         $narrative = self::claimNarrative($badge, $title, $frozen);
         $criteria_id = self::useFrozen($frozen)
             ? self::frozenString($frozen, 'evidence_url', $CFG->apphome)
@@ -476,7 +612,7 @@ public static function getOb2Badge($encrypted, $code, $badge, $title, $frozen =
      * @return string JSON-encoded issuer
      */
     public static function getOb2Issuer($encrypted = null, $code = null, $badge = null, $title = null, $frozen = null) {
-        $config_error = self::checkBadgeConfig();
+        $config_error = self::checkBadgeConfig(self::needsBadgeFiles($badge, $frozen));
         if ( $config_error !== false ) {
             return $config_error;
         }
@@ -484,7 +620,7 @@ public static function getOb2Issuer($encrypted = null, $code = null, $badge = nu
         $fields = self::issuerFields($frozen);
         $issuer_url = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'issuer.json')
-            : self::buildIssuerUrl();
+            : (self::courseScopedResource($encrypted, $badge, 'issuer.json') ?? self::buildIssuerUrl());
         
         $issuer = array(
             "@context" => self::OB2_CONTEXT,
@@ -518,22 +654,21 @@ public static function getOb2Issuer($encrypted = null, $code = null, $badge = nu
     public static function getOb3Assertion($encrypted, $date, $code, $badge, $title, $email, $frozen = null) {
         global $CFG;
 
-        $config_error = self::checkBadgeConfig();
+        $config_error = self::checkBadgeConfig(self::needsBadgeFiles($badge, $frozen));
         if ( $config_error !== false ) {
             return $config_error;
         }
 
-        $image = self::useFrozen($frozen)
-            ? self::frozenString($frozen, 'image_url', $CFG->badge_url.'/'.$code.'.png')
-            : $CFG->badge_url.'/'.$code.'.png';
+        $image = self::claimImage($badge, $code, $frozen, $encrypted);
         $recipient = 'sha256$' . hash('sha256', $email . $CFG->badge_assert_salt);
         $credential_id = $CFG->wwwroot . "/assertions/" . urlencode($encrypted) . ".vc.json";
         $achievement_id = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'achievement.json')
-            : self::buildBadgeUrlWithFormat($code, 'ob3');
+            : (self::courseScopedResource($encrypted, $badge, 'achievement.json') ?? self::buildBadgeUrlWithFormat($code, 'ob3'));
+        $scoped_issuer = self::courseScopedResource($encrypted, $badge, 'issuer.json');
         $issuer_id = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'issuer.json') . '?format=ob3'
-            : self::buildIssuerUrlWithFormat('ob3');
+            : ($scoped_issuer !== null ? $scoped_issuer . '?format=ob3' : self::buildIssuerUrlWithFormat('ob3'));
         $evidence = self::useFrozen($frozen)
             ? self::frozenString($frozen, 'evidence_url', $CFG->apphome)
             : $CFG->apphome;
@@ -625,20 +760,19 @@ public static function getOb3Assertion($encrypted, $date, $code, $badge, $title,
     public static function getOb3Achievement($encrypted, $code, $badge, $title, $frozen = null) {
         global $CFG;
 
-        $config_error = self::checkBadgeConfig();
+        $config_error = self::checkBadgeConfig(self::needsBadgeFiles($badge, $frozen));
         if ( $config_error !== false ) {
             return $config_error;
         }
 
-        $image = self::useFrozen($frozen)
-            ? self::frozenString($frozen, 'image_url', $CFG->badge_url.'/'.$code.'.png')
-            : $CFG->badge_url.'/'.$code.'.png';
+        $image = self::claimImage($badge, $code, $frozen, $encrypted);
         $achievement_id = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'achievement.json')
-            : self::buildBadgeUrlWithFormat($code, 'ob3');
+            : (self::courseScopedResource($encrypted, $badge, 'achievement.json') ?? self::buildBadgeUrlWithFormat($code, 'ob3'));
+        $scoped_issuer = self::courseScopedResource($encrypted, $badge, 'issuer.json');
         $issuer_id = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'issuer.json') . '?format=ob3'
-            : self::buildIssuerUrlWithFormat('ob3');
+            : ($scoped_issuer !== null ? $scoped_issuer . '?format=ob3' : self::buildIssuerUrlWithFormat('ob3'));
         $narrative = self::claimNarrative($badge, $title, $frozen);
         $criteria_id = self::useFrozen($frozen)
             ? self::frozenString($frozen, 'evidence_url', $CFG->apphome)
@@ -683,15 +817,16 @@ public static function getOb3Achievement($encrypted, $code, $badge, $title, $fro
     public static function getOb3Issuer($encrypted = null, $code = null, $badge = null, $title = null, $frozen = null) {
         global $CFG;
 
-        $config_error = self::checkBadgeConfig();
+        $config_error = self::checkBadgeConfig(self::needsBadgeFiles($badge, $frozen));
         if ( $config_error !== false ) {
             return $config_error;
         }
 
         $fields = self::issuerFields($frozen);
+        $scoped_issuer = self::courseScopedResource($encrypted, $badge, 'issuer.json');
         $issuer_id = self::useFrozen($frozen)
             ? self::assertionResourceUrl($frozen['guid'], 'issuer.json') . '?format=ob3'
-            : self::buildIssuerUrlWithFormat('ob3');
+            : ($scoped_issuer !== null ? $scoped_issuer . '?format=ob3' : self::buildIssuerUrlWithFormat('ob3'));
         
         $issuer = array(
             "@context" => array(
diff --git a/lib/src/LinkedIn/LinkedIn.php b/lib/src/LinkedIn/LinkedIn.php
index 13161e68a..d8b477343 100644
--- a/lib/src/LinkedIn/LinkedIn.php
+++ b/lib/src/LinkedIn/LinkedIn.php
@@ -57,6 +57,14 @@ public static function fromConfig($CFG): self
         return new self($organizationId, $organizationName);
     }
 
+    /**
+     * True when Add to Profile can name an organization.
+     */
+    public function canAddToProfile(): bool
+    {
+        return $this->organizationId !== null || ($this->organizationName !== null && $this->organizationName !== '');
+    }
+
     /**
      * Build a LinkedIn "Add certification" URL.
      *
diff --git a/lib/src/Services/Badges/BadgeService.php b/lib/src/Services/Badges/BadgeService.php
index f9ed7cca4..8af5a2e5f 100644
--- a/lib/src/Services/Badges/BadgeService.php
+++ b/lib/src/Services/Badges/BadgeService.php
@@ -106,7 +106,7 @@ public static function mintOrGet(
             ));
         }
         $json = self::encodeAccomplishments($accomplishments);
-        $linked = self::imageColumnsReady() ? self::storedImageForBadgeCode($badge_code) : null;
+        $linked = self::imageColumnsReady() ? self::storedImageForBadgeCode($badge_code, $context_id) : null;
 
         $q = $PDOX->queryReturnError(
             "SELECT badge_guid FROM {$CFG->dbprefix}badges WHERE user_id = :UID AND context_id = :CID AND badge_code = :CODE",
@@ -312,12 +312,17 @@ public static function getAssertionDataForGuid(string $guid): ?array {
      * @param object $badge A lessons badge object
      * @return array<string,mixed>
      */
-    public static function captureAccomplishments($lessons, $badge, string $context_title): array {
+    public static function captureAccomplishments($lessons, $badge, string $context_title, int $context_id = 0): array {
         global $CFG;
 
         $code = '';
+        $imagePath = '';
         if ( isset($badge->image) && is_string($badge->image) ) {
-            $code = basename($badge->image, '.png');
+            $imagePath = $badge->image;
+            $code = CourseBadges::codeFromImage($imagePath);
+            if ( $code === '' ) {
+                $code = basename($imagePath, '.png');
+            }
         }
         $title = (isset($badge->title) && is_string($badge->title) && $badge->title !== '')
             ? $badge->title
@@ -328,7 +333,7 @@ public static function captureAccomplishments($lessons, $badge, string $context_
             $narrative .= " at {$servicename}";
         }
 
-        $image = self::imageSnapshot($code);
+        $image = self::imageSnapshot($code, $imagePath, $context_id);
         $evidence = (isset($CFG->apphome) && is_string($CFG->apphome)) ? $CFG->apphome : '';
 
         $threshold = null;
@@ -338,7 +343,7 @@ public static function captureAccomplishments($lessons, $badge, string $context_
 
         $items = array();
         if ( $code !== '' && is_object($lessons) ) {
-            $items = self::getAssignmentsForEvidence($code, $lessons);
+            $items = self::getAssignmentsForEvidence($code, $lessons, $context_id);
         }
 
         return array(
@@ -354,16 +359,31 @@ public static function captureAccomplishments($lessons, $badge, string $context_
     }
 
     /**
-     * Public image URL and the SHA-256 of the PNG bytes at badge_path.
+     * Public image URL and the SHA-256 of the PNG bytes.
      *
-     * An empty hash means the file was not readable when the snapshot was written.
-     * The key is still stored so a later upgrade does not clear the row again.
+     * A Public files path is read from that course. Anything else is the site
+     * badge folder. An empty hash means the file was not readable when the
+     * snapshot was written. The key is still stored so a later upgrade does
+     * not clear the row again.
      *
      * @return array{image_url:string,image_sha256:string}
      */
-    private static function imageSnapshot(string $code): array {
+    private static function imageSnapshot(string $code, string $imagePath = '', int $contextId = 0): array {
         global $CFG;
 
+        if ( CourseBadges::isPublicImage($imagePath) ) {
+            $url = CourseBadges::displayUrl($imagePath, $contextId);
+            $sha = '';
+            $bytes = CourseBadges::bytes($imagePath, $contextId);
+            if ( is_string($bytes) && $bytes !== '' ) {
+                $sha = hash('sha256', $bytes);
+            }
+            return array(
+                'image_url' => $url,
+                'image_sha256' => $sha,
+            );
+        }
+
         $url = '';
         $sha = '';
         if ( $code !== '' && isset($CFG->badge_url) && is_string($CFG->badge_url) && $CFG->badge_url !== '' ) {
@@ -488,7 +508,7 @@ public static function backfillStoredImages(): void {
         }
 
         $q = $PDOX->queryReturnError(
-            "SELECT badge_guid, badge_code
+            "SELECT badge_guid, badge_code, context_id
                FROM {$table}
               WHERE image_id IS NULL AND (image_sha256 IS NULL OR image_sha256 = '')"
         );
@@ -503,7 +523,10 @@ public static function backfillStoredImages(): void {
 
         foreach ( $rows as $row ) {
             $guid = (string) ($row['badge_guid'] ?? '');
-            $linked = self::storedImageForBadgeCode((string) ($row['badge_code'] ?? ''));
+            $linked = self::storedImageForBadgeCode(
+                (string) ($row['badge_code'] ?? ''),
+                isset($row['context_id']) ? (int) $row['context_id'] : 0
+            );
             if ( $guid === '' || ! is_array($linked) || $linked['sha256'] === '' ) {
                 continue;
             }
@@ -557,16 +580,29 @@ private static function findImageBySha(string $sha): ?array {
     }
 
     /**
-     * Read the site badge PNG for this code.
+     * Read the PNG for this code.
      *
-     * Null means the file is not there yet. image_id is null when the file is
-     * over the cap; sha256 is still set so the row is not retried.
+     * A manifest badge whose image is in Files Public is copied from that
+     * file. Otherwise the site badge folder is used. Null means the file is
+     * not there yet. image_id is null when the file is over the cap; sha256
+     * is still set so the row is not retried.
      *
      * @return array{image_id:?int,sha256:string}|null
      */
-    private static function storedImageForBadgeCode(string $code): ?array {
+    private static function storedImageForBadgeCode(string $code, int $contextId = 0): ?array {
         global $CFG;
 
+        if ( $contextId > 0 && $code !== '' ) {
+            $lessons = self::lessonsForContext($contextId, null);
+            $defined = self::badgeDefinition($lessons, $code);
+            $imagePath = (is_object($defined) && isset($defined->image) && is_string($defined->image))
+                ? $defined->image
+                : '';
+            if ( CourseBadges::isPublicImage($imagePath) ) {
+                return CourseBadges::storedLink($imagePath, $contextId);
+            }
+        }
+
         if ( $code === '' || ! isset($CFG->badge_path) || ! is_string($CFG->badge_path) || $CFG->badge_path === '' ) {
             return null;
         }
@@ -718,7 +754,8 @@ public static function backfillMissingAccomplishments(): void {
                 $accomplishments = self::captureAccomplishments(
                     $lessons,
                     $badge,
-                    (string) ($row['context_title'] ?? '')
+                    (string) ($row['context_title'] ?? ''),
+                    isset($row['context_id']) ? (int) $row['context_id'] : 0
                 );
             } else {
                 $accomplishments = self::minimalAccomplishments($row);
@@ -862,11 +899,43 @@ private static function siteLessons() {
         return is_object($loaded) ? $loaded : null;
     }
 
+    /**
+     * Lessons for the course named inside an unpublished assertion id.
+     *
+     * A manifest course wins. Otherwise the current file-based lessons.
+     *
+     * @param LessonsService|null $fallback
+     * @return LessonsService|null
+     */
+    public static function lessonsForAssertion(string $encrypted, $fallback = null): ?LessonsService {
+        global $PDOX;
+        if ( ! isset($PDOX) || ! is_object($PDOX) ) {
+            $PDOX = \Tsugi\Core\LTIX::getConnection();
+        }
+        $contextId = \Tsugi\Core\Badges::contextIdFromAssertion($encrypted);
+        if ( $contextId > 0 ) {
+            $course = self::lessonsForContext($contextId, null);
+            if ( $course instanceof LessonsService ) {
+                return $course;
+            }
+        }
+        if ( $fallback instanceof LessonsService ) {
+            return $fallback;
+        }
+        if ( Manifest::hasCurrent() ) {
+            $current = Manifest::currentLessons();
+            if ( $current instanceof LessonsService ) {
+                return $current;
+            }
+        }
+        return null;
+    }
+
     /**
      * @param LessonsService|null $siteLessons
      * @return LessonsService|null
      */
-    private static function lessonsForContext(int $context_id, $siteLessons) {
+    public static function lessonsForContext(int $context_id, $siteLessons = null) {
         global $CFG, $PDOX;
 
         if ( $context_id > 0 ) {
@@ -904,7 +973,7 @@ private static function badgeDefinition($lessons, string $badge_code) {
             return null;
         }
         foreach ( $lessons->lessons->badges as $badge ) {
-            if ( isset($badge->image) && $badge->image === $badge_code . '.png' ) {
+            if ( isset($badge->image) && CourseBadges::imageMatchesCode($badge->image, $badge_code) ) {
                 return $badge;
             }
         }
@@ -916,18 +985,10 @@ private static function badgeDefinition($lessons, string $badge_code) {
      *
      * @return array<int, array{resource_link_id:string, title:string, href:?string}>
      */
-    public static function getAssignmentsForEvidence(string $badge_code, $lessons): array {
+    public static function getAssignmentsForEvidence(string $badge_code, $lessons, int $contextId = 0): array {
         global $CFG;
         $base = rtrim($CFG->apphome ?? $CFG->wwwroot ?? '', '/');
-        $badge = null;
-        if ( is_object($lessons) && isset($lessons->lessons->badges) && is_iterable($lessons->lessons->badges) ) {
-            foreach ( $lessons->lessons->badges as $b ) {
-                if ( isset($b->image) && $b->image === $badge_code . '.png' ) {
-                    $badge = $b;
-                    break;
-                }
-            }
-        }
+        $badge = self::badgeDefinition($lessons, $badge_code);
         if ( ! $badge || ! isset($badge->assignments) || ! is_iterable($badge->assignments) ) {
             return array();
         }
@@ -936,8 +997,20 @@ public static function getAssignmentsForEvidence(string $badge_code, $lessons):
             $resource_link_id = (string) $resource_link_id;
             $lti = $lessons->getLtiByRlid($resource_link_id);
             $mod = $lessons->getModuleByRlid($resource_link_id);
-            $title = $lti ? $lti->title : $resource_link_id;
-            $href = $mod ? $base . '/lessons/' . urlencode($mod->anchor) : null;
+            $place = CourseBadges::placement($lessons, $resource_link_id, $contextId);
+            if ( $lti && isset($lti->title) && is_string($lti->title) && $lti->title !== '' ) {
+                $title = $lti->title;
+            } elseif ( ! empty($place['known']) && $place['title'] !== '' ) {
+                $title = $place['title'];
+            } else {
+                $title = $resource_link_id;
+            }
+            $href = null;
+            if ( $mod && isset($mod->anchor) ) {
+                $href = $base . '/lessons/' . urlencode($mod->anchor);
+            } elseif ( ! empty($place['anchor']) ) {
+                $href = $base . '/lessons/' . urlencode($place['anchor']);
+            }
             $result[] = array(
                 'resource_link_id' => $resource_link_id,
                 'title' => $title,
diff --git a/lib/src/Services/Badges/CourseBadges.php b/lib/src/Services/Badges/CourseBadges.php
new file mode 100644
index 000000000..6b6bdd057
--- /dev/null
+++ b/lib/src/Services/Badges/CourseBadges.php
@@ -0,0 +1,556 @@
+<?php
+
+namespace Tsugi\Services\Badges;
+
+use Tsugi\Core\ReqScope;
+use Tsugi\Services\Files\FileRepository;
+use Tsugi\Services\Lessons\LessonsNormalize;
+use Tsugi\Services\Lessons\LessonsService;
+use Tsugi\Services\Outbound\LtiContentService;
+use Tsugi\Services\Quiz1\Quiz1Repository;
+
+/**
+ * Badge definitions stored on a course manifest, with pictures in Files Public.
+ *
+ * The badge code is the PNG file name without .png. It must match the
+ * pattern baked into an assertion id: letters, numbers, and underscores.
+ */
+class CourseBadges {
+
+    /** @var array<string, list<array{id:string,title:string,anchor:?string,graded:bool,published:bool}>> */
+    private static $courseItemsCache = array();
+
+    /**
+     * @param mixed $image
+     */
+    public static function isPublicImage($image): bool {
+        return self::canonicalPublicPath($image) !== null;
+    }
+
+    /**
+     * Public/hello.png with a canonical Public folder name, or null.
+     *
+     * @param mixed $image
+     */
+    public static function canonicalPublicPath($image): ?string {
+        if ( ! is_string($image) || $image === '' ) {
+            return null;
+        }
+        $path = FileRepository::normalizeFilePath($image);
+        if ( $path === null || ! FileRepository::isPublicPath($path) ) {
+            return null;
+        }
+        $parts = explode('/', $path);
+        if ( count($parts) < 2 ) {
+            return null;
+        }
+        $parts[0] = FileRepository::PUBLIC_FOLDER;
+        return implode('/', $parts);
+    }
+
+    /**
+     * File name without .png. Empty when the name is not a lowercase .png.
+     *
+     * @param mixed $image
+     */
+    public static function codeFromImage($image): string {
+        if ( ! is_string($image) || $image === '' ) {
+            return '';
+        }
+        $base = basename(str_replace('\\', '/', $image));
+        if ( strlen($base) < 5 || substr($base, -4) !== '.png' ) {
+            return '';
+        }
+        return substr($base, 0, -4);
+    }
+
+    public static function isSafeCode(string $code): bool {
+        return $code !== '' && preg_match('/^[A-Za-z0-9_]+$/', $code) === 1;
+    }
+
+    /**
+     * @param mixed $image
+     */
+    public static function imageMatchesCode($image, string $code): bool {
+        return $code !== '' && self::codeFromImage($image) === $code;
+    }
+
+    /**
+     * Absolute URL for a Public file, or the site badge folder for a file name.
+     *
+     * A Public path is turned into that course's content hash. The same
+     * Public/name.png in two courses must not share one URL.
+     *
+     * @param object|string $badge Badge object or image path
+     */
+    public static function displayUrl($badge, int $contextId = 0): string {
+        global $CFG;
+
+        $image = '';
+        if ( is_object($badge) && isset($badge->image) && is_string($badge->image) ) {
+            $image = $badge->image;
+        } elseif ( is_string($badge) ) {
+            $image = $badge;
+        }
+        $public = self::canonicalPublicPath($image);
+        if ( $public !== null ) {
+            if ( $contextId < 1 ) {
+                $contextId = ReqScope::currentContextId();
+            }
+            $href = null;
+            if ( $contextId > 0 ) {
+                $link = FileRepository::ensureLink($contextId);
+                $row = $link ? FileRepository::getFileRowByPath($public, $link, $contextId) : null;
+                if ( is_array($row) && isset($row['file_sha256']) ) {
+                    $href = FileRepository::downloadHrefForSha256($row['file_sha256']);
+                }
+            }
+            if ( is_string($href) && $href !== '' && isset($CFG->wwwroot) && is_string($CFG->wwwroot) ) {
+                return rtrim($CFG->wwwroot, '/') . $href;
+            }
+            return '';
+        }
+        if ( $image !== '' && isset($CFG->badge_url) && is_string($CFG->badge_url) && $CFG->badge_url !== '' ) {
+            return rtrim($CFG->badge_url, '/') . '/' . ltrim($image, '/');
+        }
+        return '';
+    }
+
+    /**
+     * PNG bytes for a Public file in this course.
+     *
+     * A zero context id looks up the public path in any course.
+     */
+    public static function bytes(string $image, int $contextId = 0): ?string {
+        $path = self::canonicalPublicPath($image);
+        if ( $path === null ) {
+            return null;
+        }
+        $row = null;
+        if ( $contextId > 0 ) {
+            $link = FileRepository::ensureLink($contextId);
+            if ( $link ) {
+                $row = FileRepository::getFileRowByPath($path, $link, $contextId);
+            }
+            if ( ! is_array($row) ) {
+                return null;
+            }
+        } else {
+            $row = FileRepository::getPublicFileByPath($path);
+            if ( is_array($row) && isset($row['context_id']) ) {
+                $contextId = (int) $row['context_id'];
+            }
+        }
+        if ( ! is_array($row) || empty($row['file_sha256']) ) {
+            return null;
+        }
+        $payload = FileRepository::readExportPayload($row['file_sha256'], $contextId);
+        if ( ! is_array($payload) || ! isset($payload['bytes']) || ! is_string($payload['bytes']) || $payload['bytes'] === '' ) {
+            return null;
+        }
+        return $payload['bytes'];
+    }
+
+    /**
+     * Copy a Public PNG into badge_images.
+     *
+     * Null means the file is missing. image_id is null when the file is over
+     * the cap; sha256 is still set so the row is not retried.
+     *
+     * @return array{image_id:?int,sha256:string}|null
+     */
+    public static function storedLink(string $image, int $contextId): ?array {
+        $bytes = self::bytes($image, $contextId);
+        if ( ! is_string($bytes) || $bytes === '' ) {
+            return null;
+        }
+        if ( strlen($bytes) > BadgeService::MAX_IMAGE_BYTES ) {
+            return array(
+                'image_id' => null,
+                'sha256' => hash('sha256', $bytes),
+            );
+        }
+        $stored = BadgeService::storeImageBytes($bytes);
+        if ( ! is_array($stored) ) {
+            return null;
+        }
+        return array(
+            'image_id' => $stored['image_id'],
+            'sha256' => $stored['sha256'],
+        );
+    }
+
+    /**
+     * PNG files already in this course's Public folder.
+     *
+     * @return list<array{path:string,code:string,safe:bool}>
+     */
+    public static function publicPngs(int $contextId): array {
+        $link = FileRepository::ensureLink($contextId);
+        if ( ! $link ) {
+            return array();
+        }
+        $out = array();
+        foreach ( FileRepository::allItems($link, $contextId) as $row ) {
+            $meta = FileRepository::decodeMeta($row);
+            if ( $meta['kind'] !== FileRepository::KIND_FILE || ! FileRepository::isPublicPath($meta['folder']) ) {
+                continue;
+            }
+            $path = FileRepository::pathFromFileRow($row);
+            $canonical = self::canonicalPublicPath($path);
+            if ( $canonical === null ) {
+                continue;
+            }
+            $code = self::codeFromImage($canonical);
+            if ( $code === '' ) {
+                continue;
+            }
+            $out[] = array(
+                'path' => $canonical,
+                'code' => $code,
+                'safe' => self::isSafeCode($code),
+            );
+        }
+        usort($out, function ($a, $b) {
+            return strcmp($a['path'], $b['path']);
+        });
+        return $out;
+    }
+
+    /**
+     * Published graded items a badge can count.
+     *
+     * A native quiz is included once it is published. Its grade is stored
+     * under the quiz link key. A content launch is included when students
+     * can see it and it records a grade.
+     *
+     * @return array<string, string> resource_link_id => title
+     */
+    public static function assignmentChoices(LessonsService $lessons): array {
+        $choices = array();
+        foreach ( self::courseItems($lessons) as $item ) {
+            if ( empty($item['published']) || empty($item['graded']) || $item['id'] === '' ) {
+                continue;
+            }
+            if ( isset($choices[$item['id']]) ) {
+                continue;
+            }
+            $choices[$item['id']] = $item['title'] !== '' ? $item['title'] : $item['id'];
+        }
+        return $choices;
+    }
+
+    /**
+     * Title, module anchor, and whether this id counts toward a badge.
+     *
+     * An id that is not in the course stays graded so an older badge still
+     * reads a stored score.
+     *
+     * @return array{title:string,anchor:?string,graded:bool,known:bool}
+     */
+    public static function placement(LessonsService $lessons, string $id, int $contextId = 0): array {
+        $id = trim($id);
+        foreach ( self::courseItems($lessons, $contextId) as $item ) {
+            if ( $item['id'] !== $id ) {
+                continue;
+            }
+            return array(
+                'title' => $item['title'] !== '' ? $item['title'] : $id,
+                'anchor' => $item['anchor'],
+                'graded' => $item['graded'],
+                'known' => true,
+            );
+        }
+        return array(
+            'title' => $id !== '' ? $id : 'Assignment',
+            'anchor' => null,
+            'graded' => true,
+            'known' => false,
+        );
+    }
+
+    /**
+     * Every gradable lesson item, published or not.
+     *
+     * @return list<array{id:string,title:string,anchor:?string,graded:bool,published:bool}>
+     */
+    private static function courseItems(LessonsService $lessons, int $contextId = 0): array {
+        if ( $contextId < 1 ) {
+            $contextId = ReqScope::currentContextId();
+        }
+        $cacheKey = spl_object_id($lessons) . ':' . $contextId;
+        if ( isset(self::$courseItemsCache[$cacheKey]) ) {
+            return self::$courseItemsCache[$cacheKey];
+        }
+        $items = array();
+        $push = function ($id, $title, $anchor, $graded, $published) use (&$items) {
+            $id = trim((string) $id);
+            if ( $id === '' ) {
+                return;
+            }
+            $items[] = array(
+                'id' => $id,
+                'title' => is_string($title) ? $title : '',
+                'anchor' => (is_string($anchor) && $anchor !== '') ? $anchor : null,
+                'graded' => (bool) $graded,
+                'published' => (bool) $published,
+            );
+        };
+        $record = function ($item, $anchor) use ($lessons, $contextId, $push) {
+            if ( is_array($item) ) {
+                $item = (object) $item;
+            }
+            if ( ! is_object($item) ) {
+                return;
+            }
+            if ( LessonsNormalize::isNativeQuiz($item) ) {
+                $quizId = LessonsNormalize::quizIdOf($item);
+                if ( $quizId < 1 ) {
+                    return;
+                }
+                $push(
+                    Quiz1Repository::resourceLinkId($quizId, $contextId),
+                    self::itemTitle($item),
+                    $anchor,
+                    true,
+                    $lessons->quiz1IsPublished($quizId)
+                );
+                return;
+            }
+            $contentId = isset($item->content_id) ? (int) $item->content_id : 0;
+            if ( $contentId > 0 ) {
+                $row = LtiContentService::find($contextId, $contentId);
+                if ( ! is_array($row) ) {
+                    return;
+                }
+                $title = self::itemTitle($item);
+                if ( $title === '' && isset($row['title']) && is_string($row['title']) ) {
+                    $title = $row['title'];
+                }
+                $graded = (int) ($row['send_grade'] ?? 0) === 1 || ! empty($row['link_id']);
+                $push(
+                    isset($row['resource_link_id']) ? $row['resource_link_id'] : '',
+                    $title,
+                    $anchor,
+                    $graded,
+                    LtiContentService::studentVisible($contextId, $contentId) === true
+                );
+                return;
+            }
+            if ( ! LessonsNormalize::isAssignmentLti($item) ) {
+                return;
+            }
+            $rlid = (string) $item->resource_link_id;
+            $push(
+                $rlid,
+                self::itemTitle($item),
+                $anchor,
+                LessonsService::ltiLaunchIsGraded($item),
+                $lessons->resourceLinkPublished($rlid) === true
+            );
+        };
+
+        foreach ( $lessons->getLaunches() as $launch ) {
+            $record($launch, null);
+        }
+        $doc = $lessons->lessons;
+        if ( isset($doc->modules) && is_iterable($doc->modules) ) {
+            foreach ( $doc->modules as $mod ) {
+                $anchor = (is_object($mod) && isset($mod->anchor)) ? (string) $mod->anchor : null;
+                if ( isset($mod->lti) && is_iterable($mod->lti) ) {
+                    foreach ( $mod->lti as $lti ) {
+                        $record($lti, $anchor);
+                    }
+                }
+                if ( isset($mod->items) && is_iterable($mod->items) ) {
+                    foreach ( $mod->items as $item ) {
+                        $record($item, $anchor);
+                    }
+                }
+            }
+        }
+        self::$courseItemsCache[$cacheKey] = $items;
+        return $items;
+    }
+
+    /**
+     * @param object $item
+     */
+    private static function itemTitle($item): string {
+        if ( isset($item->title) && is_string($item->title) && $item->title !== '' ) {
+            return $item->title;
+        }
+        return '';
+    }
+
+    /**
+     * Apply an authoring post to the manifest badges array.
+     *
+     * @param mixed $badges
+     * @param array<string, mixed> $post
+     * @return list<array<string, mixed>>
+     */
+    public static function apply($badges, array $post, LessonsService $lessons, int $contextId): array {
+        $clean = self::listFromDocument($badges);
+        $action = isset($post['badge_action']) ? (string) $post['badge_action'] : '';
+        $index = self::postIndex($post);
+
+        if ( $action === 'delete' ) {
+            if ( $index === null || ! isset($clean[$index]) ) {
+                throw new \InvalidArgumentException('Badge not found.');
+            }
+            array_splice($clean, $index, 1);
+            return array_values($clean);
+        }
+
+        if ( $action === 'move' ) {
+            if ( $index === null || ! isset($clean[$index]) ) {
+                throw new \InvalidArgumentException('Badge not found.');
+            }
+            $dir = (isset($post['move_dir']) && $post['move_dir'] === 'up') ? -1 : 1;
+            $swap = $index + $dir;
+            if ( $swap < 0 || $swap >= count($clean) ) {
+                return $clean;
+            }
+            $item = $clean[$index];
+            $clean[$index] = $clean[$swap];
+            $clean[$swap] = $item;
+            return array_values($clean);
+        }
+
+        if ( $action !== 'save' ) {
+            throw new \InvalidArgumentException('Unknown badge action.');
+        }
+
+        $one = self::fromEditor($post, $lessons, $contextId);
+        $code = self::codeFromImage($one['image']);
+        foreach ( $clean as $i => $existing ) {
+            if ( $index !== null && $i === $index ) {
+                continue;
+            }
+            $existingImage = isset($existing['image']) ? $existing['image'] : '';
+            if ( self::codeFromImage($existingImage) === $code ) {
+                throw new \InvalidArgumentException('Another badge already uses that image name.');
+            }
+        }
+
+        if ( $index === null ) {
+            $clean[] = $one;
+        } else {
+            if ( ! isset($clean[$index]) ) {
+                throw new \InvalidArgumentException('Badge not found.');
+            }
+            $merged = $clean[$index];
+            $merged['title'] = $one['title'];
+            $merged['image'] = $one['image'];
+            $merged['threshold'] = $one['threshold'];
+            $merged['assignments'] = $one['assignments'];
+            if ( ! empty($one['completion']) ) {
+                $merged['completion'] = true;
+            } else {
+                unset($merged['completion']);
+            }
+            $clean[$index] = $merged;
+        }
+        return array_values($clean);
+    }
+
+    /**
+     * @param mixed $badges
+     * @return list<array<string, mixed>>
+     */
+    public static function listFromDocument($badges): array {
+        if ( ! is_array($badges) ) {
+            return array();
+        }
+        $out = array();
+        foreach ( $badges as $badge ) {
+            if ( is_object($badge) ) {
+                $badge = json_decode(json_encode($badge), true);
+            }
+            if ( is_array($badge) ) {
+                $out[] = $badge;
+            }
+        }
+        return $out;
+    }
+
+    /**
+     * @param array<string, mixed> $post
+     * @return array{title:string,image:string,threshold:float,assignments:list<string>,completion?:bool}
+     */
+    private static function fromEditor(array $post, LessonsService $lessons, int $contextId): array {
+        $title = isset($post['title']) && is_string($post['title']) ? trim($post['title']) : '';
+        if ( $title === '' ) {
+            throw new \InvalidArgumentException('Title is required.');
+        }
+
+        $image = isset($post['image']) && is_string($post['image']) ? $post['image'] : '';
+        $path = self::canonicalPublicPath($image);
+        $code = $path === null ? '' : self::codeFromImage($path);
+        if ( $path === null || ! self::isSafeCode($code) ) {
+            throw new \InvalidArgumentException('Choose a Public PNG whose name uses only letters, numbers, and underscores, like hello_world.png.');
+        }
+        $known = false;
+        foreach ( self::publicPngs($contextId) as $png ) {
+            if ( $png['path'] === $path && $png['safe'] ) {
+                $known = true;
+                break;
+            }
+        }
+        if ( ! $known ) {
+            throw new \InvalidArgumentException('That image is not in Files Public. Upload the PNG there first.');
+        }
+
+        $percentRaw = isset($post['threshold_percent']) ? $post['threshold_percent'] : '';
+        if ( ! is_numeric($percentRaw) ) {
+            throw new \InvalidArgumentException('Percent required must be a whole number from 0 to 100.');
+        }
+        $asFloat = (float) $percentRaw;
+        if ( $asFloat < 0 || $asFloat > 100 || abs($asFloat - round($asFloat)) > 0.001 ) {
+            throw new \InvalidArgumentException('Percent required must be a whole number from 0 to 100.');
+        }
+        $percent = (int) round($asFloat);
+
+        $choices = self::assignmentChoices($lessons);
+        $posted = isset($post['assignments']) && is_array($post['assignments']) ? $post['assignments'] : array();
+        $assignments = array();
+        foreach ( $posted as $rlid ) {
+            if ( ! is_string($rlid) && ! is_numeric($rlid) ) {
+                throw new \InvalidArgumentException('Unknown assignment.');
+            }
+            $rlid = (string) $rlid;
+            if ( ! isset($choices[$rlid]) && ! self::placement($lessons, $rlid)['known'] ) {
+                throw new \InvalidArgumentException('Unknown assignment.');
+            }
+            if ( ! in_array($rlid, $assignments, true) ) {
+                $assignments[] = $rlid;
+            }
+        }
+
+        $one = array(
+            'title' => $title,
+            'image' => $path,
+            'threshold' => $percent / 100,
+            'assignments' => $assignments,
+        );
+        if ( ! empty($post['completion']) ) {
+            $one['completion'] = true;
+        }
+        return $one;
+    }
+
+    /**
+     * @param array<string, mixed> $post
+     */
+    private static function postIndex(array $post): ?int {
+        if ( ! isset($post['badge_index']) ) {
+            return null;
+        }
+        $raw = trim((string) $post['badge_index']);
+        if ( $raw === '' || ! ctype_digit($raw) ) {
+            return null;
+        }
+        return (int) $raw;
+    }
+}
diff --git a/lib/src/Services/CourseNav/CourseNav.php b/lib/src/Services/CourseNav/CourseNav.php
index 11879964d..771745a8e 100644
--- a/lib/src/Services/CourseNav/CourseNav.php
+++ b/lib/src/Services/CourseNav/CourseNav.php
@@ -147,6 +147,7 @@ public static function catalog() {
             array('id' => 'discussions_widget', 'kind' => 'widget', 'label' => 'Discussions widget', 'route' => '/discussions', 'site' => false),
             array('id' => 'discussions', 'kind' => 'link', 'label' => 'Discussions', 'route' => '/discussions', 'site' => false),
             array('id' => 'grades', 'kind' => 'link', 'label' => 'Grades', 'route' => '/grades', 'site' => false),
+            array('id' => 'badges', 'kind' => 'link', 'label' => 'Badges', 'route' => '/badges', 'site' => false),
             array('id' => 'quiz1', 'kind' => 'link', 'label' => 'Quizzes', 'route' => '/quiz1', 'site' => false),
             array('id' => 'calendar_widget', 'kind' => 'widget', 'label' => 'Calendar widget', 'route' => '/calendar', 'site' => false),
             array('id' => 'calendar', 'kind' => 'link', 'label' => 'Calendar', 'route' => '/calendar', 'site' => false),
diff --git a/lib/src/UI/MenuSet.php b/lib/src/UI/MenuSet.php
index f4e8a36ae..a1ca6d3a1 100644
--- a/lib/src/UI/MenuSet.php
+++ b/lib/src/UI/MenuSet.php
@@ -36,9 +36,9 @@ class MenuSet {
      *
      * @return MenuSet The instance to allow for chaining
      */
-    public function setHome($link, $href)
+    public function setHome($link, $href, $attr=false)
     {
-        $this->home = new \Tsugi\UI\MenuEntry($link, $href);
+        $this->home = new \Tsugi\UI\MenuEntry($link, $href, $attr);
         return $this;
     }
 
diff --git a/lib/src/UI/Output.php b/lib/src/UI/Output.php
index 5ae0a8919..cdc0609bb 100644
--- a/lib/src/UI/Output.php
+++ b/lib/src/UI/Output.php
@@ -67,6 +67,13 @@ class Output {
 
     public $buffer = false;
 
+    /**
+     * When set, topNav() renders this menu and skips the course and site menus.
+     *
+     * @var \Tsugi\UI\MenuSet|false
+     */
+    public $menuOverride = false;
+
     const SUPPRESS_SITE_NAV = 'TSUGI_OUTPUT_SUPPRESS_SITE_NAV';
 
     /** Session key for error flash messages (must match U::FLASH_ERROR) */
@@ -876,7 +883,9 @@ function topNav($tool_menu=false) {
         global $CFG, $TSUGI_LAUNCH;
 
         $menu_set = false;
-        if ( \Tsugi\Controllers\Courses::isCourseMountedRequest() ) {
+        if ( $this->menuOverride instanceof \Tsugi\UI\MenuSet ) {
+            $menu_set = $this->menuOverride;
+        } else if ( \Tsugi\Controllers\Courses::isCourseMountedRequest() ) {
             $cid = \Tsugi\Controllers\Courses::courseIdFromRequest();
             $doc = \Tsugi\Core\Manifest::navigationDocumentForContext($cid);
             $menu_set = \Tsugi\Services\CourseNav\CourseNav::compile($doc, $cid);
@@ -1160,7 +1169,11 @@ function menuNav($set, $is_tool_menu = false) {
 EOF;
 
         if ( $set->home ) {
-            $retval .= '      <a class="navbar-brand" href="'.$set->home->href.'">'.$set->home->link.'</a>'."\n";
+            $home_attr = '';
+            if ( isset($set->home->attr) && is_string($set->home->attr) && $set->home->attr !== '' ) {
+                $home_attr = ' '.$set->home->attr;
+            }
+            $retval .= '      <a class="navbar-brand" href="'.$set->home->href.'"'.$home_attr.'>'.$set->home->link.'</a>'."\n";
         }
         $retval .= "    </div>\n";
         $retval .= '    <div id="'.$collapse_id.'" class="navbar-collapse collapse">'."\n";
diff --git a/lib/tests/Services/CourseNav/CourseNavTest.php b/lib/tests/Services/CourseNav/CourseNavTest.php
index 0b2836ea4..1703c94c2 100644
--- a/lib/tests/Services/CourseNav/CourseNavTest.php
+++ b/lib/tests/Services/CourseNav/CourseNavTest.php
@@ -327,6 +327,7 @@ public function testCatalogOrder()
                 'discussions_widget',
                 'discussions',
                 'grades',
+                'badges',
                 'quiz1',
                 'calendar_widget',
                 'calendar',
@@ -343,10 +344,10 @@ public function testCatalogOrder()
             $ids
         );
         $this->assertNotContains('topics', $ids);
-        $this->assertNotContains('badges', $ids);
+        $this->assertContains('badges', $ids);
     }
 
-    public function testStoredBadgesLinkIsDropped()
+    public function testStoredBadgesLinkIsKept()
     {
         $doc = CourseNav::normalize(array(
             'items' => array(
@@ -358,7 +359,7 @@ public function testStoredBadgesLinkIsDropped()
         foreach ( $doc['items'] as $item ) {
             $ids[] = $item['id'];
         }
-        $this->assertNotContains('badges', $ids);
+        $this->assertContains('badges', $ids);
         $this->assertContains('lessons', $ids);
     }