diff --git a/.github/release-notes.md b/.github/release-notes.md
index fee40c3..f8b7ef9 100644
--- a/.github/release-notes.md
+++ b/.github/release-notes.md
@@ -1,19 +1,47 @@
-rexplorer's context menu on the desktop: right-click the desktop and get the same menu as in a rexplorer folder.
+Lower CPU use and quicker responses: rexplorer no longer reloads a folder on every change notification, preloads
+less, and keeps slow shell work off the window's thread.
 
 **Install.** Download the zip, extract it, and run `rexplorer.exe` to try it. `rexplorer.exe --install` makes it
 the default file manager for your user; it needs no administrator rights. Already installed? Run the new
 `rexplorer.exe --install` to replace the old copy. Undo with
 `%LOCALAPPDATA%\Programs\rexplorer\rexplorer.exe --uninstall`.
 
-**Changes.**
-- Desktop context menu: a small helper (`rexplorer --desktop`, one per sign-in) shows rexplorer's menu when you
-  right-click the desktop. On icons it has the shell's verbs for the selection; on the background it has View,
-  Sort by, Refresh and Paste plus the shell's background verbs. Explorer still draws the desktop, the taskbar and
-  Start. Install adds a Startup shortcut so the helper runs at every sign-in, and starts it right away.
-- Install and uninstall close a running helper before they replace or remove the exe, and start it again
-  afterwards. If an install fails, Roll back also removes or restores the Start menu and Startup shortcuts.
-- Not covered yet: right-dragging desktop icons (the press goes to the menu), and Shift+F10 or the Menu key on the
-  desktop, which still open Explorer's menu.
+**CPU and latency.** Measured on the developer's machine against 0.1.1.
+- Change notifications (#11): a folder whose files keep changing reloads at most once a second, and not at all while
+  the window is minimized; restoring it catches up once. A folder under constant writes costs about a third of the
+  CPU it did, and about none while minimized. Idle CPU is about 7x lower.
+- Sidebar (#12): it is rebuilt every 30 seconds while shown instead of every 5, and right away when a drive is added
+  or removed.
+- Hover preview (#9): only text files and light images (png, jpg, gif, bmp, webp, ico) are loaded ahead when the
+  pointer rests on them, only once it has stopped moving for the hover delay, and only while rexplorer is the
+  active window. PDFs and other heavy types are previewed only when selected.
+- Preview pane (#10): showing the same file again keeps its preview handler instead of starting a new one.
+- Home (#13): it is built faster at startup, and its icons repaint in batches.
+- First launch (#14): Windows' system icons are exported only when the theme uses them (`icon_theme=default`).
+  First-launch CPU went from about 4.5 s to 0.5 s.
+- Icons view (#15): heavy types (PDF, video, documents) show icons instead of rendered thumbnails; pictures keep
+  thumbnails, and only pictures are loaded ahead of the scroll.
+- Open terminal (#16): it starts in the background, so the window no longer waits for it.
+- From the #17 backlog:
+  - Sorting runs on the load thread. Cell text and icons are cached, so repaints and type-to-select no longer ask
+    the shell again.
+  - Switching tabs reloads a folder only if it changed while the tab was in the background.
+  - Thumbnails of rows scrolled past are skipped, and thumbnails are scaled off the window's thread.
+  - Copy, Cut, Paste, Delete and Properties no longer load every shell extension (Copy: about 350 ms down to 80 ms).
+  - A navigation that is superseded stops early. Search stops at its result cap, and the elevated index search can
+    be cancelled.
+  - The breadcrumb chevron no longer lists network folders, the hidden folder tree is not kept in sync, and the
+    text preview reads up to 64 KB.
+  - A second launch waits for a busy first window instead of opening its own window after 3 s.
+
+**Fixes.**
+- Sorting keeps the selection on the same files. Before, it stayed on the same row positions, so a Delete right
+  after a sort could act on a file you had not picked.
+- Sorting in the Icons and Thumbnails views no longer leaves thumbnails on the wrong files.
+- Open terminal finds Windows Terminal installed outside the Store (scoop, the zip) on PATH, and never runs a
+  `wt.exe` found through the browsed folder.
+
+**Roadmap.** `VERSION-1-X.md` lists what a stable 1.0 needs; each item has an issue in the v1.0 milestone (#71).
 
 The binary is built by GitHub Actions from the tagged commit; `SHA256SUMS.txt` lists the checksums. It is not
 code-signed, so SmartScreen may warn on first run.
diff --git a/Cargo.lock b/Cargo.lock
index 1c4c6d8..c149f43 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -94,7 +94,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "rexplorer"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "rexplorer-core",
  "windows",
@@ -103,7 +103,7 @@ dependencies = [
 
 [[package]]
 name = "rexplorer-core"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "unrar-ng",
  "windows",
diff --git a/README.md b/README.md
index 095cc2e..d31174a 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ Sidebar, every row read from the shell with its localized name and icon:
 Click a row to go there; the row of the current folder, or of its nearest ancestor, is highlighted. Right-click a
 pinned Quick Access folder for **Unpin from Home**, a frequent (not pinned) one for **Pin to Home**, a bookmark for
 **Remove bookmark** (its `bookmark.<label>` line leaves settings.ini). Pinned and frequent are told apart by the
-shell's `System.Home.IsPinned` property. The rows are built on a worker thread, rebuilt every 5 s while the window is active and right after
+shell's `System.Home.IsPinned` property. The rows are built on a worker thread, rebuilt when the window is activated, every 30 s while the sidebar shows, when a drive comes or goes, and right after
 a pin or unpin from rexplorer, so the sidebar fills in after the first listing. More > **Folder tree** shows the
 shell's folder tree in the sidebar's place (choose it again for the sidebar).
 
@@ -406,9 +406,10 @@ Icon themes: `icons\<name>\` holds PNGs named by extension (`rs.png`, `pdf.png`.
 the system icons, for folders, archive members and search results alike. A folder whose name ends in a themed
 extension (a zip, a folder to the shell) gets that extension's PNG. PNGs are decoded on first use, so a theme of
 hundreds costs nothing at startup. `icons\default` is written on first run: `folder.png` and `file.png` in the
-theme's accent, then, in the background (about ten seconds), Windows' own 48 px icon for every extension registered
-on the machine that has an icon of its own (about 560 here; `system-icons.txt` lists them and marks the export
-done; delete it to pick up extensions registered since). The export never overwrites a PNG, so edit or replace any.
+theme's accent. Only while a theme sets `icon_theme=default`, the app also exports, in the background (about ten
+seconds), Windows' own 48 px icon for every extension registered on the machine that has an icon of its own (about
+560 here; `system-icons.txt` lists them and marks the export done; delete it to pick up extensions registered
+since). The export never overwrites a PNG, so edit or replace any.
 
 Opening-app icons: a file type Windows registers without an icon of its own shows Explorer's blank page (`.ps1` on
 a machine whose PowerShell file type was never registered, `.py` or `.md` opened with an editor that registers no
diff --git a/VERSION-1-X.md b/VERSION-1-X.md
new file mode 100644
index 0000000..f0f0424
--- /dev/null
+++ b/VERSION-1-X.md
@@ -0,0 +1,201 @@
+# rexplorer 1.x: requirements for a stable release
+
+rexplorer is at 0.1.x: fast, and in daily use as the default file manager, but tested on one Windows 11 machine.
+**1.0 is a promise that anyone can make rexplorer their default file manager on any supported Windows PC without
+losing data, getting locked out of a feature they rely on, or having their settings broken by an upgrade.** This
+file lists what that promise needs. Every item has a "done when" and its own issue; all of them are in the
+[v1.0 milestone](https://github.com/CodingDiego/rexplorer/milestone/1) and tracked in
+[#71](https://github.com/CodingDiego/rexplorer/issues/71).
+
+Legend: **[blocker]** must be done for 1.0 · **[should]** expected for 1.0 unless explicitly deferred with a reason in
+the release notes · **[later]** fine for 1.x.
+
+## 1. Legal and branding
+
+- [ ] **[blocker] Own app icon.** ([#18](https://github.com/CodingDiego/rexplorer/issues/18)) `crates/app/app.ico` is Windows Explorer's icon, copied from `explorer.exe` by
+  `scripts/extract-icon.py`. It is Microsoft's artwork, and the README says it is for personal use, yet it is in the public repo and
+  in every release binary.
+  *Done when:* rexplorer ships its own icon, `app.ico` is replaced in history-forward commits, the extraction script
+  is removed or local-only, and the README no longer says the window looks like Explorer's because of it.
+- [ ] **[blocker] Complete third-party notices.** ([#19](https://github.com/CodingDiego/rexplorer/issues/19)) *Done when:* `THIRD-PARTY-NOTICES.md` covers every bundled crate
+  license (generated, for example with `cargo about`) and every asset in the binary.
+- [ ] **[should] Trademark hygiene.** ([#20](https://github.com/CodingDiego/rexplorer/issues/20)) *Done when:* no UI text, docs, or store listing suggests rexplorer is Windows
+  Explorer or a Microsoft product.
+
+## 2. Accessibility
+
+The custom-drawn controls have no accessibility layer: no `WM_GETOBJECT` or UI Automation provider exists in
+`crates/app` for the tab strip, the breadcrumb, the toolbar and command bar, the sidebar, Home or the preview pane.
+The README also lists the sidebar as mouse-only.
+
+- [ ] **[blocker] UI Automation for every custom control.** ([#21](https://github.com/CodingDiego/rexplorer/issues/21)) *Done when:* each one exposes name, role, state and
+  invoke/selection patterns, and Narrator can read and operate tabs, crumbs, every toolbar button, every sidebar row,
+  Home tiles and rows, and the preview caption.
+- [ ] **[blocker] Full keyboard reach.** ([#22](https://github.com/CodingDiego/rexplorer/issues/22)) *Done when:* every control is reachable with Tab/F6 and operable without a
+  mouse, the sidebar included. The focus is always visible, and the README's keyboard section covers each control.
+- [ ] **[blocker] High contrast.** ([#23](https://github.com/CodingDiego/rexplorer/issues/23)) *Done when:* with a Windows contrast theme on, rexplorer uses system colors
+  instead of its themes, and nothing is invisible.
+- [ ] **[should] Text scaling.** ([#24](https://github.com/CodingDiego/rexplorer/issues/24)) *Done when:* Windows "Text size" (Accessibility > Text size) up to 225% gives no clipped or
+  overlapping text.
+- [ ] **[should] An accessibility check in the smoke test.** ([#25](https://github.com/CodingDiego/rexplorer/issues/25)) *Done when:* an automated pass walks the UIA tree and fails on unnamed
+  interactive elements.
+
+## 3. Data safety and reliability
+
+- [ ] **[blocker] No data-loss paths.** ([#26](https://github.com/CodingDiego/rexplorer/issues/26)) Delete, move, rename, paste with conflicts, drag and drop, archive extraction,
+  and New > item all go through the shell, as today, and have tests. *Done when:* each operation has an automated
+  check that the result matches Explorer's on the same input, including conflicts and cancel.
+- [ ] **[blocker] Undo and redo.** ([#27](https://github.com/CodingDiego/rexplorer/issues/27)) Explorer users rely on Ctrl+Z. *Done when:* Ctrl+Z undoes the last copy, move, rename,
+  delete-to-Recycle-Bin and new item through the shell's undo (or an equivalent), and Ctrl+Y redoes.
+- [ ] **[blocker] Panic audit.** ([#28](https://github.com/CodingDiego/rexplorer/issues/28)) *Done when:* no `unwrap`/`expect` remains on any shell, filesystem, registry or
+  window result outside tests, and every fallible path degrades: a beep, a message, or the embedded Explorer view.
+- [ ] **[blocker] Soak test.** ([#29](https://github.com/CodingDiego/rexplorer/issues/29)) *Done when:* an 8-hour scripted session (navigate, switch tabs, search, preview,
+  thumbnails, file operations) ends with GDI objects, USER objects, handles, threads and private bytes flat within
+  a stated margin. The test runs before every release.
+- [ ] **[should] Crash reports users can send.** ([#30](https://github.com/CodingDiego/rexplorer/issues/30)) Crash recovery exists (`--recover`, a second crash opens Explorer).
+  *Done when:* a crash also writes a minidump and a short text report under `%LOCALAPPDATA%\rexplorer\crashes`, and
+  `SECURITY.md`/README say how to send them (no telemetry).
+- [ ] **[should] Hang watchdog.** ([#31](https://github.com/CodingDiego/rexplorer/issues/31)) *Done when:* a UI thread blocked for more than N seconds is detected and logged
+  with the operation it was running.
+
+## 4. Compatibility
+
+- [ ] **[blocker] Supported Windows versions stated and tested.** ([#32](https://github.com/CodingDiego/rexplorer/issues/32)) *Done when:* the README names the minimum version,
+  and every release is smoke-tested on at least Windows 10 22H2 and the two newest Windows 11 releases. Today only
+  Windows 11 10.0.26200 is tested. Home already falls back to This PC where it does not exist.
+- [ ] **[blocker] Display scaling and multi-monitor.** ([#33](https://github.com/CodingDiego/rexplorer/issues/33)) *Done when:* everything is checked at 100/125/150/200/250% and on mixed-DPI multi-monitor
+  setups (drag between monitors), in light and dark mode.
+- [ ] **[blocker] Every place Explorer users browse.** ([#34](https://github.com/CodingDiego/rexplorer/issues/34)) *Done when:* each of these is verified:
+  - mapped drives and UNC shares, both reachable and unreachable (no hang);
+  - OneDrive placeholders (online-only, always-keep, sync errors);
+  - MTP phones, WSL (`\\wsl$`), Linux shares, BitLocker-locked drives, removable media and the Recycle Bin;
+  - long paths over 260 characters.
+- [ ] **[should] ARM64 build.** ([#35](https://github.com/CodingDiego/rexplorer/issues/35)) *Done when:* releases include a native arm64 zip that passes the smoke test on ARM
+  hardware.
+- [ ] **[should] FTP verified or dropped.** ([#36](https://github.com/CodingDiego/rexplorer/issues/36)) The README calls it untested against a live server. *Done when:* it is tested against one, or removed
+  from the docs.
+
+## 5. Localization
+
+rexplorer's own strings are English-only and in the code. Sizes, dates and item names already come from the shell
+in the user's language, so a Spanish Windows shows "Nueva carpeta" next to English menus.
+
+- [ ] **[blocker] Externalized strings.** ([#37](https://github.com/CodingDiego/rexplorer/issues/37)) *Done when:* every user-visible string comes from a resource table, and a
+  missing translation falls back to English.
+- [ ] **[should] First translations.** ([#38](https://github.com/CodingDiego/rexplorer/issues/38)) *Done when:* Spanish ships in addition to English, and the process to add a
+  language is documented in CONTRIBUTING.md.
+- [ ] **[should] Right-to-left layout.** ([#39](https://github.com/CodingDiego/rexplorer/issues/39)) *Done when:* the window mirrors correctly for Arabic and Hebrew UI languages.
+
+## 6. Explorer parity for daily use
+
+Each gap below is either closed, or explicitly accepted for 1.0 and listed under "Known gaps" in the release notes.
+
+- [ ] **[blocker] Desktop menu completeness** ([#40](https://github.com/CodingDiego/rexplorer/issues/40)). The desktop menu shipped in 0.1.3
+  (`rexplorer --desktop`). *Done when:* right-dragging desktop icons works as in Explorer, and Shift+F10 and the Menu
+  key on the desktop open rexplorer's menu.
+- [ ] **[blocker] Indexed search and full search results.** ([#41](https://github.com/CodingDiego/rexplorer/issues/41)) *Done when:* unelevated searches use the Windows Search index where it covers the folder,
+  with the walker as fallback (today a drive-wide fast search needs `--elevated` for the USN index). Results also get
+  real icons, thumbnails, preview, drag, sort, rename and refresh after delete.
+- [ ] **[should] Search results context menu and Back** ([#42](https://github.com/CodingDiego/rexplorer/issues/42)) across results from different folders, and Back returns to the results.
+- [ ] **[should] Archive view.** ([#43](https://github.com/CodingDiego/rexplorer/issues/43)) *Done when:* archive members get icons, thumbnails and preview in all views;
+  multi-volume and encrypted RAR are tested; zip either goes through the same view or the difference is documented.
+- [ ] **[should] Themed embedded Explorer view** ([#44](https://github.com/CodingDiego/rexplorer/issues/44)) follows the theme, or the difference is documented.
+- [ ] **[should] Home page completeness.** ([#45](https://github.com/CodingDiego/rexplorer/issues/45)) *Done when:* the location-status column exists, sort works, and the undocumented
+  `System.Home.Grouping` value is guarded (a missing value degrades quietly).
+- [ ] **[should] Send to, Properties on multiple selections, file conflict dialogs and progress** ([#46](https://github.com/CodingDiego/rexplorer/issues/46)) behave exactly as in
+  Explorer (all from the shell; verified, not reimplemented).
+- [ ] **[later] Tab drag and drop.** ([#47](https://github.com/CodingDiego/rexplorer/issues/47)) Drag a tab to a new window, and drag files onto a tab.
+
+## 7. Performance budgets (enforced, not just measured)
+
+Measured on 2026-10-11 with the 0.1.4 work, on a 12-core laptop:
+- Home ink about 0.4 s from process start; a 100k-file folder listed in about 0.4 s.
+- Idle while focused: about 0.55% of one core. Minimized under file churn: about 0.
+- Terminal launch: 0.4 ms on the UI thread.
+
+- [ ] **[blocker] Budgets in CI.** ([#48](https://github.com/CodingDiego/rexplorer/issues/48)) *Done when:* `scripts/bench-vs-explorer.ps1` (or a headless variant) runs on every
+  PR and fails the build when a budget is exceeded. Budgets: cold start to first ink ≤ 600 ms, 100k-file folder
+  ≤ 600 ms, idle CPU focused ≤ 1% of a core, churn reloads ≤ 1/s, no UI-thread call over 100 ms in the scripted
+  session.
+- [ ] **[should] UI-thread budget tooling.** ([#49](https://github.com/CodingDiego/rexplorer/issues/49)) *Done when:* a debug build logs every UI-thread message that takes over 50 ms,
+  with its source.
+- [ ] **[should] Backlog from issue #17** ([#17](https://github.com/CodingDiego/rexplorer/issues/17)) is closed or explicitly accepted.
+
+## 8. Stability contract (semantic versioning)
+
+From 1.0, breaking any of these needs 2.0:
+
+- [ ] **[blocker] Command line frozen.** ([#50](https://github.com/CodingDiego/rexplorer/issues/50)) `--select` (and `/select,`), `--profile`, `--new-tab`/`-t`, `--search`,
+  `--register`, `--unregister`, `--install`, `--uninstall`, `--import-explorer`, `--overwrite`, `--recover`,
+  `--elevated`, `-h`/`--help`, and the Explorer argument forms rexplorer accepts or forwards. *Done when:* they are
+  documented as stable, with a test per flag (`cli.rs` already checks that usage lists all of them).
+- [ ] **[blocker] Settings format versioned.** ([#51](https://github.com/CodingDiego/rexplorer/issues/51)) `settings.ini`, `themes\*.ini`, `icons\<name>\`, `[keys]` overrides
+  and `session.txt`. *Done when:* the files carry a format version, every older format is migrated on load (tested
+  with fixtures from each 0.x release), and unknown keys are preserved, not dropped.
+- [ ] **[blocker] Cross-version hand-off.** ([#52](https://github.com/CodingDiego/rexplorer/issues/52)) *Done when:* the `WM_COPYDATA` payload between a running instance and a new
+  launch is versioned, so an upgraded exe never mis-hands off to an older running one (or the reverse).
+- [ ] **[should] Deprecation policy** ([#53](https://github.com/CodingDiego/rexplorer/issues/53)) written in the README: how long a deprecated key or flag keeps working.
+
+## 9. Testing and engineering
+
+- [ ] **[blocker] Smoke test in CI.** ([#54](https://github.com/CodingDiego/rexplorer/issues/54)) Today `scripts/smoke.ps1` runs locally, and its keyboard, share and dnd checks
+  SKIP without an interactive foreground. *Done when:* it runs in CI on a runner with an interactive desktop (or
+  those checks are rewritten to drive the app through messages), with zero SKIPs on the release run.
+- [ ] **[blocker] Data-operation tests** ([#55](https://github.com/CodingDiego/rexplorer/issues/55)) from section 3, in CI.
+- [ ] **[should] Clippy clean** ([#56](https://github.com/CodingDiego/rexplorer/issues/56)) with `-D warnings` in CI, plus a stated minimum supported Rust version, checked in CI.
+- [ ] **[should] Fuzzing** ([#57](https://github.com/CodingDiego/rexplorer/issues/57)) of path handling, archive path splitting and `settings.ini`/theme parsing.
+- [ ] **[should] Reproducible releases.** ([#58](https://github.com/CodingDiego/rexplorer/issues/58)) Release binaries are built only by CI from the tag, as today, and the build
+  embeds no local paths.
+
+## 10. Security
+
+The whole project was reviewed on 2026-10-10 and every finding was fixed. These keep it that way:
+
+- [ ] **[blocker] Code-signed releases.** ([#59](https://github.com/CodingDiego/rexplorer/issues/59)) Today SmartScreen warns on first run. *Done when:* the exe and the zip are
+  signed by CI (signing key in a protected environment) and the signature is checked in the release job.
+- [ ] **[blocker] Pre-1.0 security review** ([#60](https://github.com/CodingDiego/rexplorer/issues/60)) repeated on the 1.0 candidate, covering everything added since
+  2026-10-10, the Desktop helper (a low-level mouse hook) above all.
+- [ ] **[should] Dependency hygiene.** ([#61](https://github.com/CodingDiego/rexplorer/issues/61)) `cargo audit` runs weekly (exists). *Done when:* the pinned `windows` crate
+  and `unrar` updates follow a written cadence, and Dependabot PRs are reviewed within a stated time.
+- [ ] **[should] Advisory response time.** ([#62](https://github.com/CodingDiego/rexplorer/issues/62)) `SECURITY.md` states a response time for private advisories.
+
+## 11. Distribution and updates
+
+- [ ] **[blocker] winget package.** ([#63](https://github.com/CodingDiego/rexplorer/issues/63)) *Done when:* `winget install rexplorer` works, and `winget upgrade` picks up
+  releases.
+- [ ] **[blocker] Upgrade path.** ([#64](https://github.com/CodingDiego/rexplorer/issues/64)) *Done when:* installing a new version over a running one is tested: the old copy is
+  moved aside, the next launch runs the new one, settings carry over, and nothing is left elevated.
+- [ ] **[blocker] Uninstall restores Explorer completely.** ([#65](https://github.com/CodingDiego/rexplorer/issues/65)) *Done when:* every registry key, App Paths entry, Start
+  menu shortcut and Startup entry is removed. It is tested on a clean VM.
+- [ ] **[should] In-app update notice.** ([#66](https://github.com/CodingDiego/rexplorer/issues/66)) *Done when:* there is an opt-in check of the GitHub releases feed, with no
+  telemetry.
+- [ ] **[should] Full changelog.** ([#67](https://github.com/CodingDiego/rexplorer/issues/67)) *Done when:* `CHANGELOG.md` keeps every release's notes, not only the latest in
+  `.github/release-notes.md`.
+
+## 12. Documentation
+
+- [ ] **[blocker] User guide.** ([#68](https://github.com/CodingDiego/rexplorer/issues/68)) *Done when:* it covers install, make default, revert to Explorer, keys, settings
+  reference, themes and icon themes, and troubleshooting ("a folder hangs", "go back to Explorer now").
+- [ ] **[should] Architecture overview** ([#69](https://github.com/CodingDiego/rexplorer/issues/69)) for contributors: the core/app split, threads and apartments, and the
+  timers and messages.
+- [ ] **[should] Known gaps in release notes** ([#70](https://github.com/CodingDiego/rexplorer/issues/70)) kept current in every release's notes.
+
+## 13. Exit criteria for 1.0
+
+- [ ] Every **[blocker]** above is done.
+- [ ] Every **[should]** is done or deferred with a written reason.
+- [ ] A public beta (1.0.0-rc.N) has been used by at least five people other than the author as their default
+  file manager for four weeks.
+- [ ] No open crash, hang or data-loss bug, and no data-loss bug reported during the beta.
+- [ ] Performance budgets green on the release candidate; soak test green.
+
+## Suggested path
+
+| Release | Focus |
+|---|---|
+| 0.2 | Own icon and notices; UI Automation and keyboard reach; high contrast |
+| 0.3 | Signing, winget, upgrade and uninstall tests; Windows 10 and the DPI matrix; smoke test in CI |
+| 0.4 | Externalized strings and Spanish; Ctrl+Z; data-operation tests; panic audit |
+| 0.5 | Desktop menu completeness; indexed search; search and archive parity; performance budgets in CI; soak test |
+| 1.0.0-rc | Settings format version, migrations and contract frozen; security review; public beta |
+| 1.0 | Exit criteria met |
diff --git a/crates/app/Cargo.toml b/crates/app/Cargo.toml
index bda9011..c8b616f 100644
--- a/crates/app/Cargo.toml
+++ b/crates/app/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rexplorer"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/CodingDiego/rexplorer"
@@ -25,6 +25,7 @@ windows = { workspace = true, features = [
     "Win32_System_Ole",
     "Win32_System_SystemInformation",
     "Win32_System_Threading",
+    "Win32_System_WindowsProgramming",
     "Win32_UI_Controls",
     "Win32_UI_HiDpi",
     "Win32_UI_Input_KeyboardAndMouse",
diff --git a/crates/app/src/commands.rs b/crates/app/src/commands.rs
index a421dc4..85212d4 100644
--- a/crates/app/src/commands.rs
+++ b/crates/app/src/commands.rs
@@ -153,7 +153,7 @@ pub(crate) unsafe fn new_menu(app: *mut App) {
     match done {
         Ok(()) => {
             (*app).new_item = Some((folder, before));
-            // The change watch refreshes too (and pushes this back while changes keep coming).
+            // The change watch may reload first; whichever reload starts cancels the other.
             SetTimer(Some(hwnd), TIMER_REFRESH, 300, None);
         }
         Err(_) => {
diff --git a/crates/app/src/folder_options.rs b/crates/app/src/folder_options.rs
index 1c267b7..c5bde58 100644
--- a/crates/app/src/folder_options.rs
+++ b/crates/app/src/folder_options.rs
@@ -1116,6 +1116,16 @@ unsafe fn apply_profile(app: *mut App, new: Profile) {
         }
     }
     sync(&new);
+    for tab in &mut (*app).tabs {
+        // Show hidden files changes what a listing holds: the other tabs reload when shown.
+        tab.dirty |= old.show_hidden != new.show_hidden;
+        // Show file extensions changes the Name column's text; the listings cached it.
+        if old.show_extensions != new.show_extensions {
+            if let Some(Source::Shell(l)) = &mut tab.source {
+                l.cells.fill(Default::default());
+            }
+        }
+    }
     ui::sync_list_style(app);
     let _ = InvalidateRect(Some((*app).list), None, true);
     ui::layout(app);
diff --git a/crates/app/src/home.rs b/crates/app/src/home.rs
index 6dbf048..fe1410e 100644
--- a/crates/app/src/home.rs
+++ b/crates/app/src/home.rs
@@ -56,6 +56,8 @@ pub const HM_SELECT_NAMED: u32 = WM_APP + 0x53;
 pub const HM_RECT: u32 = WM_APP + 0x54;
 /// wparam = generation << 32 | slot, lparam = HBITMAP (ours once received).
 const HM_ICON: u32 = WM_APP + 0x50;
+/// Coalesces the repaints HM_ICON asks for.
+const ICON_TIMER: usize = 1;
 /// wparam: 0 cancels the rename edit, 1 commits it (a key), 2 commits it (the edit lost the focus).
 const HM_END_EDIT: u32 = WM_APP + 0x51;
 
@@ -214,6 +216,8 @@ pub fn build(folder: &ShellFolder, items: &[ShellItem]) -> Content {
     let profile = std::env::var("USERPROFILE").unwrap_or_default();
     let mut tiles = Vec::new();
     let mut rows: Vec<(String, Entry)> = Vec::new();
+    // The columns of each local file's folder, mapped once per folder rather than once per row.
+    let mut by_dir: HashMap<String, Vec<(PROPERTYKEY, u32, String)>> = HashMap::new();
     for item in items {
         let key = item.parsing_name();
         let attrs = item.attributes(SFGAO_FOLDER | SFGAO_STREAM);
@@ -251,16 +255,22 @@ pub fn build(folder: &ShellFolder, items: &[ShellItem]) -> Content {
             continue;
         }
         // Home fills its columns for cloud files; a local file's own folder knows its details.
-        let mut own: Option<Option<(Vec<(PROPERTYKEY, u32, String)>, ShellItem)>> = None;
+        let mut own: Option<Option<(String, ShellItem)>> = None;
         e.cells = CELLS
             .iter()
             .map(|k| {
                 let text = find(&cols, k).map(|(c, _)| item.detail(c)).unwrap_or_default();
-                if !text.is_empty() || !is_fs_path(&e.key) {
+                // A network file's cells stay empty, as Home's own do: binding its folder can block on the share.
+                if !text.is_empty() || !is_fs_path(&e.key) || e.key.starts_with("\\\\") {
                     return text;
                 }
-                let o = own.get_or_insert_with(|| crate::source::hit_for_path(Path::new(&e.key)).map(|h| (columns_by_key(&h.item.parent), h.item)));
-                o.as_ref().and_then(|(c, it)| find(c, k).map(|(i, _)| it.detail(i))).unwrap_or_default()
+                let o = own.get_or_insert_with(|| {
+                    let h = crate::source::hit_for_path(Path::new(&e.key))?;
+                    let dir = h.folder.to_lowercase();
+                    by_dir.entry(dir.clone()).or_insert_with(|| columns_by_key(&h.item.parent));
+                    Some((dir, h.item))
+                });
+                o.as_ref().and_then(|(d, it)| find(&by_dir[d], k).map(|(i, _)| it.detail(i))).unwrap_or_default()
             })
             .collect();
         // The shell writes dates as yyyy/mm/dd:hh:mm:ss.fff, which sorts as text.
@@ -401,6 +411,8 @@ struct State {
     shown: Vec<usize>,
     /// Per slot (the tiles, then every row, shown or not); owned.
     icons: Vec<Option<HBITMAP>>,
+    /// ICON_TIMER is armed.
+    icon_timer: bool,
     /// Per entry.
     selected: Vec<bool>,
     focus: Option<usize>,
@@ -482,6 +494,7 @@ pub fn create(parent: HWND, id: usize) -> Result<HWND> {
             filter: Filter::Recent,
             shown: Vec::new(),
             icons: Vec::new(),
+            icon_timer: false,
             selected: Vec::new(),
             focus: None,
             hover: None,
@@ -922,11 +935,22 @@ unsafe extern "system" fn wndproc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam:
                 if let Some(old) = s.icons[slot].replace(bmp) {
                     let _ = DeleteObject(old.into());
                 }
-                let _ = InvalidateRect(Some(hwnd), None, false);
+                // One repaint per batch of icons, not per icon; re-arming would postpone it for as long as icons keep coming.
+                if !s.icon_timer {
+                    s.icon_timer = SetTimer(Some(hwnd), ICON_TIMER, 50, None) != 0;
+                    if !s.icon_timer {
+                        let _ = InvalidateRect(Some(hwnd), None, false);
+                    }
+                }
             } else {
                 let _ = DeleteObject(bmp.into());
             }
         }
+        WM_TIMER if wparam.0 == ICON_TIMER => {
+            let _ = KillTimer(Some(hwnd), ICON_TIMER);
+            s.icon_timer = false;
+            let _ = InvalidateRect(Some(hwnd), None, false);
+        }
         HM_END_EDIT => end_edit(hwnd, s, wparam.0),
         WM_CTLCOLOREDIT => {
             let dc = HDC(wparam.0 as *mut c_void);
diff --git a/crates/app/src/instance.rs b/crates/app/src/instance.rs
index 2939751..ca974c3 100644
--- a/crates/app/src/instance.rs
+++ b/crates/app/src/instance.rs
@@ -3,14 +3,14 @@
 use std::path::Path;
 
 use windows::Win32::Foundation::{
-    CloseHandle, ERROR_ALREADY_EXISTS, E_FAIL, GetLastError, HANDLE, HWND, LPARAM, WPARAM,
+    CloseHandle, ERROR_ALREADY_EXISTS, ERROR_TIMEOUT, E_FAIL, GetLastError, HANDLE, HWND, LPARAM, WPARAM,
 };
 use windows::Win32::System::DataExchange::COPYDATASTRUCT;
 use windows::Win32::System::Threading::CreateMutexW;
 use windows::Win32::UI::Shell::ShellExecuteW;
 use windows::Win32::UI::WindowsAndMessaging::{
-    FindWindowExW, GetPropW, SMTO_ABORTIFHUNG, SetPropW, SW_SHOWNORMAL, SendMessageTimeoutW, SetForegroundWindow,
-    WM_COPYDATA,
+    FindWindowExW, GetPropW, IsHungAppWindow, SMTO_ABORTIFHUNG, SMTO_NORMAL, SetPropW, SW_SHOWNORMAL, SendMessageTimeoutW,
+    SetForegroundWindow, WM_COPYDATA,
 };
 use windows::core::{Error, HSTRING, PCWSTR, Result, w};
 
@@ -78,15 +78,13 @@ pub fn send(hwnd: HWND, payload: &str) -> bool {
         lpData: wide.as_ptr() as *mut _,
     };
     unsafe {
-        let r = SendMessageTimeoutW(
-            hwnd,
-            WM_COPYDATA,
-            WPARAM(0),
-            LPARAM(&cds as *const _ as isize),
-            SMTO_ABORTIFHUNG,
-            3000,
-            None,
-        );
+        let call = |flags, ms| SendMessageTimeoutW(hwnd, WM_COPYDATA, WPARAM(0), LPARAM(&cds as *const _ as isize), flags, ms, None);
+        let mut r = call(SMTO_ABORTIFHUNG, 3000);
+        // A busy UI thread is not a dead one: wait longer before this launch becomes a second window. Read before
+        // anything else can clobber the error; other failures (access denied) and a hung window fall through unchanged.
+        if r.0 == 0 && GetLastError() == ERROR_TIMEOUT && !IsHungAppWindow(hwnd).as_bool() {
+            r = call(SMTO_NORMAL, 10_000);
+        }
         let _ = SetForegroundWindow(hwnd);
         r.0 != 0
     }
@@ -105,7 +103,7 @@ pub fn receive(lparam: LPARAM) -> Option<String> {
     }
 }
 
-fn exec(file: PCWSTR, params: &HSTRING, dir: &HSTRING) -> bool {
+fn exec(file: &HSTRING, params: &HSTRING, dir: &HSTRING) -> bool {
     unsafe { ShellExecuteW(None, w!("open"), file, params, dir, SW_SHOWNORMAL).0 as isize > 32 }
 }
 
@@ -120,12 +118,18 @@ const BS: &str = "\\";
 
 pub fn open_terminal(dir: &Path) -> Result<()> {
     let d = HSTRING::from(dir.display().to_string());
+    // Absolute paths: ShellExecute resolves a bare name against the working directory (the browsed folder) first.
+    // The Store alias (a reparse point `is_file` cannot follow), then wt.exe in PATH's absolute folders (scoop, zip).
+    let alias = std::env::var_os("LOCALAPPDATA").map(|l| Path::new(&l).join(r"Microsoft\WindowsApps\wt.exe")).filter(|a| a.symlink_metadata().is_ok());
+    let path = std::env::var_os("PATH").unwrap_or_default();
+    let on_path = std::env::split_paths(&path).filter(|p| p.is_absolute()).map(|p| p.join("wt.exe")).filter(|f| f.is_file());
     let wt = HSTRING::from(format!("-d {}", quoted_dir(dir)));
-    if exec(w!("wt.exe"), &wt, &d) {
+    if alias.into_iter().chain(on_path).any(|exe| exec(&HSTRING::from(exe.as_os_str()), &wt, &d)) {
         return Ok(());
     }
+    let cmd_exe = Path::new(&std::env::var_os("SystemRoot").unwrap_or_else(|| r"C:\Windows".into())).join(r"System32\cmd.exe");
     let cmd = HSTRING::from(format!("/K cd /d {}", quoted_dir(dir)));
-    if exec(w!("cmd.exe"), &cmd, &d) {
+    if exec(&HSTRING::from(cmd_exe.as_os_str()), &cmd, &d) {
         Ok(())
     } else {
         Err(Error::from(E_FAIL))
@@ -172,6 +176,50 @@ mod tests {
         assert_eq!(receive(LPARAM(&cds as *const _ as isize)), None);
     }
 
+    #[test]
+    fn send_waits_out_a_busy_receiver() {
+        use std::sync::atomic::{AtomicBool, Ordering};
+        use windows::Win32::Foundation::LRESULT;
+        use windows::Win32::UI::WindowsAndMessaging::{
+            CreateWindowExW, DefWindowProcW, DispatchMessageW, GetMessageW, HWND_MESSAGE, MSG, PostMessageW,
+            PostQuitMessage, RegisterClassW, WINDOW_EX_STYLE, WINDOW_STYLE, WM_CLOSE, WM_DESTROY, WNDCLASSW,
+        };
+        static FIRST: AtomicBool = AtomicBool::new(true);
+        unsafe extern "system" fn busy(h: HWND, m: u32, w: WPARAM, l: LPARAM) -> LRESULT {
+            match m {
+                // Longer than the first send waits, so only the retry gets an answer.
+                WM_COPYDATA if FIRST.swap(false, Ordering::Relaxed) => {
+                    std::thread::sleep(std::time::Duration::from_secs(4));
+                    LRESULT(1)
+                }
+                WM_COPYDATA => LRESULT(1),
+                WM_DESTROY => {
+                    unsafe { PostQuitMessage(0) };
+                    LRESULT(0)
+                }
+                _ => unsafe { DefWindowProcW(h, m, w, l) },
+            }
+        }
+        let (tx, rx) = std::sync::mpsc::channel();
+        let thread = std::thread::spawn(move || unsafe {
+            let class = w!("RexplorerBusyReceiverTest");
+            RegisterClassW(&WNDCLASSW { lpfnWndProc: Some(busy), lpszClassName: class, ..Default::default() });
+            let h = CreateWindowExW(
+                WINDOW_EX_STYLE(0), class, PCWSTR::null(), WINDOW_STYLE(0), 0, 0, 0, 0, Some(HWND_MESSAGE), None, None, None,
+            )
+            .unwrap();
+            tx.send(h.0 as isize).unwrap();
+            let mut m = MSG::default();
+            while GetMessageW(&mut m, None, 0, 0).as_bool() {
+                DispatchMessageW(&m);
+            }
+        });
+        let h = HWND(rx.recv().unwrap() as *mut _);
+        assert!(send(h, "x"));
+        unsafe { PostMessageW(Some(h), WM_CLOSE, WPARAM(0), LPARAM(0)).unwrap() };
+        thread.join().unwrap();
+    }
+
     #[test]
     fn find_main_window_no_panic() {
         let _ = find_main_window();
diff --git a/crates/app/src/list.rs b/crates/app/src/list.rs
index f2d2616..7110254 100644
--- a/crates/app/src/list.rs
+++ b/crates/app/src/list.rs
@@ -131,9 +131,27 @@ unsafe fn on_column_click(app: *mut App, sub: usize) {
 pub(crate) unsafe fn sort_by(app: *mut App, col: u32, desc: bool) {
     let list = (*app).list;
     let Some(Source::Shell(l)) = &mut cur(app).source else { return };
+    // The list keeps selection and focus per row position: carry them over to the same items. The sort moves the
+    // items but not their PIDLs, so a PIDL's address is the item's identity (exact, unlike a case-folded name).
+    let focus = SendMessageW(list, LVM_GETNEXTITEM, Some(WPARAM(usize::MAX)), Some(LPARAM(LVNI_FOCUSED as isize))).0;
+    let key = |i: usize| l.items.get(i).map(|it| it.pidl.as_ptr() as usize);
+    let selected: std::collections::HashSet<usize> = selected_indices(list).into_iter().filter_map(key).collect();
+    let focused = usize::try_from(focus).ok().and_then(key);
     l.sort_col = col;
     l.sort_desc = desc;
     sort_listing(l);
+    // Icon views keep images per row position: drop them, or thumbnails stay where their files were.
+    views::reset(app, l.items.len());
+    set_item_state(list, usize::MAX, LIST_VIEW_ITEM_STATE_FLAGS(0), LIST_VIEW_ITEM_STATE_FLAGS(LVIS_SELECTED.0 | LVIS_FOCUSED.0));
+    for (i, it) in l.items.iter().enumerate() {
+        let p = it.pidl.as_ptr() as usize;
+        if selected.contains(&p) {
+            set_item_state(list, i, LVIS_SELECTED, LVIS_SELECTED);
+        }
+        if focused == Some(p) {
+            set_item_state(list, i, LVIS_FOCUSED, LVIS_FOCUSED);
+        }
+    }
     let _ = InvalidateRect(Some(list), None, true);
 }
 
@@ -494,6 +512,12 @@ pub(crate) unsafe fn rename_item(app: *mut App, index: usize, name: &str, cell:
                 Some(ext) => target.rename((*app).hwnd, &format!("{name}{ext}"), true),
                 None => target.rename((*app).hwnd, name, false),
             };
+            // The row asks the shell for its text again instead of showing the old name from the cache.
+            if let Some(Source::Shell(l)) = &mut cur(app).source {
+                if let Some(row) = l.cells.get_mut(index) {
+                    row.take();
+                }
+            }
             SetTimer(Some((*app).hwnd), TIMER_REFRESH, 150, None);
         }
     }
@@ -646,6 +670,8 @@ pub(crate) unsafe extern "system" fn subclass(hwnd: HWND, msg: u32, wparam: WPAR
     } else if msg == WM_MOUSELEAVE {
         (*app).panes.hover_tracking = false;
         crate::panes::stop_hover(app);
+    } else if msg == WM_MOUSEWHEEL {
+        crate::panes::stop_hover(app);
     }
     let r = DefSubclassProc(hwnd, msg, wparam, lparam);
     theme::card_message(hwnd, msg, (*(data as *mut App)).theme.background);
diff --git a/crates/app/src/main.rs b/crates/app/src/main.rs
index a5d53cb..2c20135 100644
--- a/crates/app/src/main.rs
+++ b/crates/app/src/main.rs
@@ -36,7 +36,7 @@ mod views;
 use std::ffi::c_void;
 use std::mem::size_of;
 use std::path::PathBuf;
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 use rexplorer_core::cli;
 use rexplorer_core::com::{ComInit, Pidl};
@@ -82,6 +82,8 @@ const TIMER_SKELETON: usize = 7;
 const TIMER_PULSE: usize = 8;
 /// Typing in the Search box has paused.
 pub(crate) const TIMER_SEARCH: usize = 9;
+/// A shell change notification, debounced and at most one reload per second.
+const TIMER_CHANGE: usize = 11;
 const ICON_UNKNOWN: i32 = i32::MIN;
 
 const ID_ADDR: usize = 100;
@@ -214,6 +216,10 @@ pub(crate) struct App {
     image_list_set: bool,
     session: session::Session,
     debounce: session::Debounce,
+    /// Spaces the reloads that shell change notifications cause.
+    change_gate: session::Debounce,
+    /// A change arrived while minimized: reload once when the window is restored.
+    stale: bool,
     recent: Recent,
     panes: panes::Panes,
     views: views::Views,
@@ -281,7 +287,10 @@ fn main() -> Result<()> {
     if !args.recover {
         crash::reset_recoveries();
     }
-    std::thread::spawn(rexplorer_core::install::cleanup_old);
+    std::thread::spawn(|| {
+        ui::background_priority();
+        rexplorer_core::install::cleanup_old();
+    });
     crash::install(&["--recover".to_string()]);
     // Undocumented, for the smoke test: an access violation after this many ms exercises the recovery path. A
     // recovery launch inherits the variable and ignores it.
@@ -314,11 +323,7 @@ fn main() -> Result<()> {
         if let Some(p) = &args.profile {
             settings.active = p.clone();
         }
-        let mut profile = settings.active_profile().clone();
-        // Home needs a recent Windows; elsewhere the default start is This PC.
-        if profile.start.eq_ignore_ascii_case(settings::HOME_START) && ShellFolder::parse(&profile.start).is_err() {
-            profile.start = "shell:MyComputerFolder".into();
-        }
+        let profile = settings.active_profile().clone();
         folder_options::sync(&profile);
         let theme = settings.theme(&profile.theme).clone();
         let brushes = theme::Brushes::new(&theme);
@@ -368,6 +373,8 @@ fn main() -> Result<()> {
             views: views::Views::new(views::View::parse(&session.view)),
             session,
             debounce: session::Debounce::new(Duration::from_secs(2)),
+            change_gate: session::Debounce::new(Duration::from_secs(1)),
+            stale: false,
             recent: Recent::load(dir.join("recent.txt")),
             panes: panes::Panes::default(),
             browser: None,
@@ -484,12 +491,25 @@ unsafe extern "system" fn wndproc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam:
         return DefWindowProcW(hwnd, msg, wparam, lparam);
     }
     match msg {
-        WM_SIZE => ui::layout(app),
+        WM_SIZE => {
+            ui::layout(app);
+            if wparam.0 as u32 != SIZE_MINIMIZED && std::mem::take(&mut (*app).stale) {
+                SetTimer(Some(hwnd), TIMER_CHANGE, 1, None);
+            }
+        }
         WM_PAINT => ui::paint(app),
         WM_ACTIVATE => {
-            // Drives come and go: the sidebar re-reads them every 5 s, only while the window is active.
+            // Pins change in Explorer: activation re-reads the sidebar if it is over 5 s old, else it polls every 30 s
+            // while the window is active (drives are announced by WM_DEVICECHANGE).
             if (wparam.0 & 0xFFFF) as u32 != WA_INACTIVE {
-                SetTimer(Some(hwnd), TIMER_SIDEBAR, 5000, None);
+                SetTimer(Some(hwnd), TIMER_SIDEBAR, if panes::sidebar_stale(app) { 1 } else { 30_000 }, None);
+            }
+            return DefWindowProcW(hwnd, msg, wparam, lparam);
+        }
+        WM_DEVICECHANGE => {
+            // DBT_DEVICEARRIVAL / DBT_DEVICEREMOVECOMPLETE: drives come and go without polling.
+            if matches!(wparam.0, 0x8000 | 0x8004) {
+                panes::sidebar_changed(app);
             }
             return DefWindowProcW(hwnd, msg, wparam, lparam);
         }
@@ -557,17 +577,38 @@ unsafe extern "system" fn wndproc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam:
         WM_MOUSEMOVE => panes::on_mouse_move(app, lparam),
         WM_LBUTTONUP | WM_CAPTURECHANGED => panes::end_drag(app),
         WM_SHELL_CHANGE => {
-            ChangeWatch::acknowledge(wparam, lparam);
-            SetTimer(Some(hwnd), TIMER_REFRESH, 150, None);
+            // A change in a tab we are not showing only marks that tab; it reloads when shown.
+            if nav::mark_changed(app, &ChangeWatch::acknowledge(wparam, lparam)) {
+                if IsIconic(hwnd).as_bool() {
+                    (*app).stale = true;
+                } else {
+                    SetTimer(Some(hwnd), TIMER_CHANGE, 150, None);
+                }
+            }
         }
         WM_TIMER => {
             let _ = KillTimer(Some(hwnd), wparam.0);
             match wparam.0 {
                 TIMER_REFRESH => nav::refresh(app),
+                // Armed for the tab and folder active then: a clean one shown since has nothing to catch up on.
+                TIMER_CHANGE if !nav::cur(app).dirty => {}
+                TIMER_CHANGE => {
+                    let (now, tab) = (Instant::now(), nav::cur(app));
+                    // One change reload at a time (F5 and the rest still restart one): a change during it reloads once more after.
+                    if tab.pending != 0 && tab.loading.is_none() {
+                        SetTimer(Some(hwnd), TIMER_CHANGE, 500, None);
+                    } else if (*app).change_gate.should_save(now) {
+                        // Covers an in-app rename or new item whose own follow-up reload is still pending.
+                        let _ = KillTimer(Some(hwnd), TIMER_REFRESH);
+                        nav::refresh(app);
+                    } else {
+                        SetTimer(Some(hwnd), TIMER_CHANGE, (*app).change_gate.remaining(now).as_millis() as u32, None);
+                    }
+                }
                 TIMER_STATUS => ui::update_status(app),
                 TIMER_SESSION => nav::save_session(app),
                 TIMER_PREVIEW => panes::update_preview(app),
-                TIMER_HOVER => panes::prefetch_hovered(app),
+                TIMER_HOVER if GetForegroundWindow() == hwnd => panes::prefetch_hovered(app),
                 TIMER_TREE => {
                     panes::ensure_tree(app);
                     ui::layout(app);
@@ -576,8 +617,10 @@ unsafe extern "system" fn wndproc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam:
                 TIMER_PULSE => nav::on_pulse_timer(app),
                 TIMER_SEARCH => source::on_search_timer(app),
                 TIMER_SIDEBAR if GetActiveWindow() == hwnd => {
-                    panes::refresh_sidebar(app);
-                    SetTimer(Some(hwnd), TIMER_SIDEBAR, 5000, None);
+                    if IsWindowVisible((*app).sidebar).as_bool() && !IsIconic(hwnd).as_bool() {
+                        panes::refresh_sidebar(app);
+                    }
+                    SetTimer(Some(hwnd), TIMER_SIDEBAR, 30_000, None);
                 }
                 _ => {}
             }
diff --git a/crates/app/src/nav.rs b/crates/app/src/nav.rs
index 2d66b04..089fee9 100644
--- a/crates/app/src/nav.rs
+++ b/crates/app/src/nav.rs
@@ -3,7 +3,10 @@
 
 use super::*;
 use crate::source::Source;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::Instant;
+use windows::Win32::Foundation::E_ABORT;
 use windows::Win32::UI::Shell::{SHGetNameFromIDList, SHParseDisplayName, SIGDN, SIGDN_DESKTOPABSOLUTEPARSING, SIGDN_NORMALDISPLAY};
 
 /// The shell's Home ("Inicio") and Quick Access, as parsing names.
@@ -59,6 +62,9 @@ pub(crate) struct Listing {
     pub items: Vec<ShellItem>,
     pub columns: Vec<Column>,
     pub icons: Vec<i32>,
+    /// Text per row and header position, filled when first asked for (the shell calls behind it are not cheap); a
+    /// row's cells are allocated then too.
+    pub cells: Vec<std::cell::OnceCell<Box<[std::cell::OnceCell<String>]>>>,
     /// Shell column index, not header position.
     pub sort_col: u32,
     pub sort_desc: bool,
@@ -79,10 +85,14 @@ pub(crate) struct Tab {
     pub source: Option<Source>,
     pub back: Vec<Target>,
     pub forward: Vec<Target>,
-    /// Only the active tab watches its folder.
+    /// Watches the folder from the tab's first show until it closes, so a tab switch need not reload.
     pub watch: Option<ChangeWatch>,
+    /// A change was notified in the folder since its load started: showing the tab reloads it.
+    pub dirty: bool,
     /// Generation of the load in flight for this tab, 0 when none.
     pub pending: u64,
+    /// Generation of the newest load started for this tab; an older one still running gives up after enumerating.
+    pub latest: Arc<AtomicU64>,
     pub top: i32,
     pub selected: Vec<String>,
     /// Parsing name to select once the first load lands (`--select`).
@@ -139,6 +149,9 @@ pub(crate) unsafe fn navigate(app: *mut App, t: usize, target: Target, history:
     let generation = (*app).generation;
     let Some(tab) = (&mut (*app).tabs).get_mut(t) else { return };
     tab.pending = generation;
+    tab.latest.store(generation, Ordering::Relaxed);
+    // A change notified from here on is not in this load.
+    tab.dirty = false;
     if history != History::Refresh {
         (*app).new_item = None;
         let (name, parsing) = destination(&target);
@@ -153,11 +166,29 @@ pub(crate) unsafe fn navigate(app: *mut App, t: usize, target: Target, history:
     if let Some(Source::Search(s)) = &mut tab.source {
         s.stop();
     }
+    // The worker sorts, as on_enum_done would: a refresh keeps the tab's sort, anything else starts by name.
+    let sort = match &tab.source {
+        Some(Source::Shell(l)) if history == History::Refresh => (l.sort_col, l.sort_desc),
+        _ => (0, false),
+    };
+    let latest = tab.latest.clone();
     let hwnd = (*app).hwnd.0 as isize;
     let show_hidden = (*app).profile.show_hidden;
+    // Details' first screen from the top; a refresh keeps its scroll position, so it (and theme icons) load as painted.
+    let prefill = if history == History::Refresh || views::icon_theme_active(app) || (*app).views.view != views::View::Details {
+        0
+    } else {
+        SendMessageW((*app).list, LVM_GETCOUNTPERPAGE, None, None).0.max(0) as usize + 1
+    };
     std::thread::spawn(move || {
         let _com = ComInit::mta();
-        let done = Box::new(EnumDone { generation, history, result: load(target, show_hidden) });
+        let superseded = || latest.load(Ordering::Relaxed) != generation;
+        let result = load(target, show_hidden, sort, prefill, &superseded);
+        // A newer load of this tab would make on_enum_done drop this one anyway.
+        if superseded() {
+            return;
+        }
+        let done = Box::new(EnumDone { generation, history, result });
         let _ = PostMessageW(Some(HWND(hwnd as *mut c_void)), WM_ENUM_DONE, WPARAM(0), LPARAM(Box::into_raw(done) as isize));
     });
 }
@@ -167,14 +198,19 @@ pub(crate) unsafe fn go(app: *mut App, target: Target, history: History) {
     navigate(app, (*app).active, target, history);
 }
 
-fn load(target: Target, show_hidden: bool) -> std::result::Result<Loaded, LoadError> {
+/// Worker side: the listing sorted by `sort` (shell column, descending), the first `prefill` icons looked up.
+/// Once `superseded` says a newer load of the tab started, gives up after enumerating (an error nobody reads).
+fn load(target: Target, show_hidden: bool, sort: (u32, bool), prefill: usize, superseded: &dyn Fn() -> bool) -> std::result::Result<Loaded, LoadError> {
     if let Target::Name(n) = &target {
         if let Some((archive, dir)) = archive_view::split_archive_path(n).filter(|(a, _)| a.is_file()) {
             return source::load_archive(&archive, &dir).map_err(|err| LoadError { name: n.clone(), err });
         }
     }
     let folder = match target {
-        Target::Name(n) => ShellFolder::parse(&n).map_err(|err| LoadError { name: n, err })?,
+        // Windows without Home: its start place is This PC.
+        Target::Name(n) => ShellFolder::parse(&n)
+            .or_else(|e| if n.eq_ignore_ascii_case(settings::HOME_START) { ShellFolder::parse("shell:MyComputerFolder") } else { Err(e) })
+            .map_err(|err| LoadError { name: n, err })?,
         Target::Pidl(p) => ShellFolder::from_pidl(&p).map_err(|err| LoadError { name: String::new(), err })?,
     };
     let crumbs = crumbs_of(&folder);
@@ -190,6 +226,9 @@ fn load(target: Target, show_hidden: bool) -> std::result::Result<Loaded, LoadEr
             None => return Ok(Loaded { source: Source::Browser(source::BrowserPlace::of(&folder)), crumbs, icon }),
         },
     };
+    if superseded() {
+        return Err(LoadError { name: String::new(), err: E_ABORT.into() });
+    }
     if !show_hidden {
         items.retain(|i| !i.is_hidden());
     }
@@ -198,10 +237,19 @@ fn load(target: Target, show_hidden: bool) -> std::result::Result<Loaded, LoadEr
     }
     let columns = folder.columns();
     let icons = vec![ICON_UNKNOWN; items.len()];
-    let mut l = Listing { folder, items, columns, icons, sort_col: 0, sort_desc: false, home: None, denied };
+    let cells = vec![std::cell::OnceCell::new(); items.len()];
+    let mut l = Listing { folder, items, columns, icons, cells, sort_col: sort.0, sort_desc: sort.1, home: None, denied };
     if is_home(&l) {
         l.home = Some(home::build(&l.folder, &l.items));
     }
+    // After the Home build: its tiles keep the enumeration order.
+    unsafe { sort_listing(&mut l) };
+    // Home's list is hidden, nothing asks it for icons.
+    if l.home.is_none() {
+        for (icon, item) in l.icons.iter_mut().zip(&l.items).take(prefill) {
+            *icon = item.icon_index(&l.folder.pidl).1;
+        }
+    }
     Ok(Loaded { source: Source::Shell(l), crumbs, icon })
 }
 
@@ -298,9 +346,12 @@ pub(crate) unsafe fn on_enum_done(app: *mut App, done: Box<EnumDone>) {
 
     let mut src = loaded.source;
     if let Source::Shell(l) = &mut src {
-        l.sort_col = sort_col;
-        l.sort_desc = sort_desc;
-        sort_listing(l);
+        // load() sorted by the sort the tab had then; only a sort changed meanwhile (a header click) sorts again.
+        if (l.sort_col, l.sort_desc) != (sort_col, sort_desc) {
+            l.sort_col = sort_col;
+            l.sort_desc = sort_desc;
+            sort_listing(l);
+        }
     }
     let shell = matches!(src, Source::Shell(_));
     tab.name = src.parsing_name();
@@ -323,7 +374,10 @@ pub(crate) unsafe fn on_enum_done(app: *mut App, done: Box<EnumDone>) {
     if let Some(q) = pending_search {
         source::start_search(app, t, &q, true);
     }
-    session_changed(app);
+    // A refresh reloads the same place; saving there made the settings folder refresh itself via session.txt.
+    if !refresh {
+        session_changed(app);
+    }
 }
 
 /// Puts the active tab into the list (or the embedded browser), address bar, breadcrumb, title and toolbar; a
@@ -340,7 +394,6 @@ unsafe fn show_source(app: *mut App, mode: Show) {
     let hwnd = (*app).hwnd;
     let list = (*app).list;
     let tab = cur(app);
-    tab.watch = None;
     let Some(src) = &tab.source else {
         source::leave_browser(app);
         views::reset(app, 0);
@@ -382,8 +435,13 @@ unsafe fn show_source(app: *mut App, mode: Show) {
     }
     ui::set_crumbs(app);
     sidebar::select((*app).sidebar, &tab.name);
-    if let Source::Shell(l) = src {
-        tab.watch = ChangeWatch::register(hwnd, &l.folder, WM_SHELL_CHANGE);
+    match src {
+        // Afresh on every show, the old one dropped first: one kept through steady churn gets 3 s SHCNE_UPDATEDIR batches.
+        Source::Shell(l) => {
+            tab.watch = None;
+            tab.watch = ChangeWatch::register(hwnd, &l.folder, WM_SHELL_CHANGE);
+        }
+        _ => tab.watch = None,
     }
 
     let count = src.len();
@@ -396,17 +454,11 @@ unsafe fn show_source(app: *mut App, mode: Show) {
     }
     let select = |names: &[String]| -> Option<usize> {
         let Source::Shell(l) = src else { return None };
-        let mut first = None;
-        if !names.is_empty() {
-            for (i, item) in l.items.iter().enumerate() {
-                let p = item.parsing_name();
-                if names.iter().any(|n| n.eq_ignore_ascii_case(&p)) {
-                    list::set_item_state(list, i, LVIS_SELECTED, LVIS_SELECTED);
-                    first.get_or_insert(i);
-                }
-            }
+        let hits = selection_matches(names, l.items.iter().map(|i| i.parsing_name()));
+        for &i in &hits {
+            list::set_item_state(list, i, LVIS_SELECTED, LVIS_SELECTED);
         }
-        first
+        hits.first().copied()
     };
     match mode {
         Show::Fresh(names) => {
@@ -438,6 +490,20 @@ unsafe fn show_source(app: *mut App, mode: Show) {
     update_chrome(app);
 }
 
+/// Indices of the items whose parsing name is one of `names` (ASCII case-insensitive), stopping at the last match.
+fn selection_matches(names: &[String], parsing: impl Iterator<Item = String>) -> Vec<usize> {
+    let mut wanted: std::collections::HashSet<String> = names.iter().map(|n| n.to_ascii_lowercase()).collect();
+    let mut parsing = parsing.enumerate();
+    let mut hits = Vec::new();
+    while !wanted.is_empty() {
+        let Some((i, p)) = parsing.next() else { break };
+        if wanted.remove(&p.to_ascii_lowercase()) {
+            hits.push(i);
+        }
+    }
+    hits
+}
+
 // ---- the Home page ----------------------------------------------------------------------------------
 
 /// Shows the Home page in the list's place when the active tab is Home or Quick Access (and not showing the
@@ -522,6 +588,7 @@ pub(crate) unsafe fn sort_listing(l: &mut Listing) {
         l.items.reverse();
     }
     l.icons.fill(ICON_UNKNOWN);
+    l.cells.fill(Default::default());
 }
 
 pub(crate) unsafe fn set_columns(app: *mut App, columns: &[Column]) {
@@ -567,9 +634,24 @@ pub(crate) unsafe fn refresh(app: *mut App) {
         Some(s) => s.location(),
         None => return,
     };
+    // This reload covers the changes notified so far.
+    let _ = KillTimer(Some((*app).hwnd), crate::TIMER_CHANGE);
     go(app, target, History::Refresh);
 }
 
+/// WM_SHELL_CHANGE: marks the tabs whose folder the notified `items` are about as changed. Returns whether the
+/// active tab is one. A notification that names no item, or no watched folder, concerns every tab.
+pub(crate) unsafe fn mark_changed(app: *mut App, items: &[Pidl]) -> bool {
+    let hit = |t: &Tab| t.watch.as_ref().is_some_and(|w| items.iter().any(|p| w.concerns(p)));
+    let all = !(&(*app).tabs).iter().any(hit);
+    // Watched tabs only: a search, archive or browser tab has nothing a shell change makes stale.
+    let marks = |t: &Tab| t.watch.is_some() && (all || hit(t));
+    for t in (&mut (*app).tabs).iter_mut() {
+        t.dirty |= marks(t);
+    }
+    (&(*app).tabs).get((*app).active).is_some_and(marks)
+}
+
 pub(crate) unsafe fn go_back(app: *mut App) {
     if let Some(p) = cur(app).back.pop() {
         go(app, p, History::Back);
@@ -603,7 +685,9 @@ pub(crate) unsafe fn new_tab(app: *mut App, target: Target, activate: bool, sele
         back: Vec::new(),
         forward: Vec::new(),
         watch: None,
+        dirty: false,
         pending: 0,
+        latest: Arc::default(),
         top: 0,
         selected: Vec::new(),
         select_after,
@@ -634,7 +718,6 @@ pub(crate) unsafe fn switch_tab(app: *mut App, t: usize) {
     if t >= (*app).tabs.len() || t == old {
         return;
     }
-    cur(app).watch = None;
     save_view_state(app);
     show_tab(app, t, true);
 }
@@ -751,10 +834,12 @@ unsafe fn show_tab(app: *mut App, t: usize, refresh_after: bool) {
     tabs::set_active((*app).strip, t);
     let tab = cur(app);
     let (top, selected) = (tab.top, std::mem::take(&mut tab.selected));
-    // Inactive tabs are not watched, so a shell listing catches up on changes made while away.
-    let watched = matches!(tab.source, Some(Source::Shell(_)));
+    // A watched folder reloads only if it changed while away. Virtual folders (Home) get no matching notifications,
+    // shares may send none (WSL, WebDAV), and a tab whose load landed while away watches none or the folder it left:
+    // those catch up on every show.
+    let catch_up = matches!(&tab.source, Some(Source::Shell(l)) if tab.dirty || !tab.watch.as_ref().is_some_and(|w| w.is_on(&l.folder.pidl)) || !ui::is_fs_path(&l.folder.parsing_name) || ui::is_remote(&l.folder.parsing_name));
     show(app, Show::Restore { top, selected, columns: true });
-    if watched && refresh_after {
+    if catch_up && refresh_after {
         refresh(app);
     }
     session_changed(app);
@@ -861,4 +946,56 @@ mod tests {
         let bad = "shell:NoSuchFolder".to_string();
         assert_eq!(destination(&Target::Name(bad.clone())), (bad.clone(), bad));
     }
+
+    fn shell_listing(dir: &std::path::Path, sort: (u32, bool), prefill: usize) -> Listing {
+        match load(Target::Name(dir.display().to_string()), true, sort, prefill, &|| false) {
+            Ok(Loaded { source: Source::Shell(l), .. }) => l,
+            _ => panic!("a shell listing"),
+        }
+    }
+
+    #[test]
+    fn load_sorts_on_the_worker_and_prefills_icons_and_caches_cells() {
+        let _com = ComInit::mta();
+        let dir = std::env::temp_dir().join(format!("rexplorer-nav-load-{}", std::process::id()));
+        std::fs::create_dir_all(dir.join("sub")).unwrap();
+        for n in ["c.txt", "a.txt", "b.txt"] {
+            std::fs::write(dir.join(n), b"x").unwrap();
+        }
+        let names = |l: &Listing| l.items.iter().map(|i| i.display_name().trim_end_matches(".txt").to_string()).collect::<Vec<_>>();
+        let l = shell_listing(&dir, (0, false), 3);
+        assert_eq!(names(&l), ["sub", "a", "b", "c"], "folders first, then by name");
+        assert!(l.icons[..3].iter().all(|&i| i != ICON_UNKNOWN), "the first icons are looked up on the worker");
+        assert_eq!(l.icons[3], ICON_UNKNOWN, "only as many as asked for");
+        assert_eq!(shell_listing(&dir, (0, true), 0).icons, vec![ICON_UNKNOWN; 4], "no prefill for a refresh or an icon theme");
+        assert_eq!(names(&shell_listing(&dir, (0, true), 0)), ["c", "b", "a", "sub"]);
+
+        let src = Source::Shell(l);
+        let Source::Shell(l) = &src else { unreachable!() };
+        assert!(l.cells.iter().all(|row| row.get().is_none()), "rows wait until asked for");
+        let name = src.text(1, 0);
+        assert_eq!(src.text(1, 0), name);
+        assert_eq!(l.cells[1].get().unwrap()[0].get(), Some(&name));
+        assert!(l.cells[1].get().unwrap().get(1).is_none_or(|c| c.get().is_none()), "other cells wait until asked for");
+        assert!(l.cells[2].get().is_none(), "other rows too");
+        assert_eq!(src.text(9, 0), "");
+        let mut src = src;
+        let Source::Shell(l) = &mut src else { unreachable!() };
+        unsafe { sort_listing(l) };
+        assert!(l.cells[1].get().is_none(), "sorting moves the rows");
+        assert!(load(Target::Name(dir.display().to_string()), true, (0, false), 0, &|| true).is_err(), "superseded");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn selection_matches_ascii_case_insensitively_and_stops_at_the_last() {
+        let names = ["C:\\A.txt".to_string(), "c:\\B.TXT".to_string()];
+        let parsing = ["c:\\a.TXT", "c:\\x", "C:\\b.txt", "never"].into_iter().enumerate().map(|(i, p)| {
+            assert!(i < 3, "read past the last match");
+            p.to_string()
+        });
+        assert_eq!(selection_matches(&names, parsing), [0, 2]);
+        assert!(selection_matches(&["É".to_string()], ["é".to_string()].into_iter()).is_empty(), "ASCII only, as eq_ignore_ascii_case");
+        assert!(selection_matches(&[], std::iter::once_with(|| -> String { panic!("no names, nothing to parse") })).is_empty());
+    }
 }
diff --git a/crates/app/src/panes.rs b/crates/app/src/panes.rs
index 36476b7..d7917a5 100644
--- a/crates/app/src/panes.rs
+++ b/crates/app/src/panes.rs
@@ -46,6 +46,8 @@ pub(crate) struct Panes {
     /// The list item under the pointer and whether a WM_MOUSELEAVE is pending for it.
     pub hover: Option<usize>,
     pub hover_tracking: bool,
+    /// When the sidebar's rows were last asked for.
+    pub sidebar_at: Option<Instant>,
 }
 
 fn scale(px: i32, dpi: u32) -> i32 {
@@ -89,8 +91,12 @@ pub(crate) unsafe fn theme_tree(app: *mut App) {
     }
 }
 
-/// Selects the active folder in the tree; folders the tree cannot show are ignored.
+/// Selects the active folder in the tree; folders the tree cannot show are ignored. A hidden tree is synced when
+/// it is shown again.
 pub(crate) unsafe fn sync_tree(app: *mut App) {
+    if !(*app).session.show_tree {
+        return;
+    }
     if let (Some(t), Some(l)) = (&(*app).panes.tree, listing(app)) {
         let _ = t.select(&l.folder.pidl);
     }
@@ -136,6 +142,7 @@ pub(crate) unsafe fn toggle_tree(app: *mut App) {
     s.show_sidebar |= !s.show_tree;
     if s.show_tree {
         ensure_tree(app);
+        sync_tree(app);
     }
     show_left(app);
 }
@@ -160,6 +167,10 @@ pub(crate) unsafe fn show_left(app: *mut App) {
         let _ = ShowWindow(t.hwnd(), if tree { SW_SHOW } else { SW_HIDE });
     }
     let _ = ShowWindow((*app).sidebar, if side { SW_SHOW } else { SW_HIDE });
+    // While hidden it is not polled, so it may have gone stale.
+    if side && sidebar_stale(app) {
+        refresh_sidebar(app);
+    }
     ui::layout(app);
     nav::session_changed(app);
 }
@@ -260,6 +271,7 @@ impl SidebarRows {
 /// Builds the sidebar rows on a worker: Home, Favorites (bookmarks, then Quick Access), This PC, Devices, Cloud
 /// and Network. Icons are loaded there too; the rows arrive as WM_SIDEBAR_ROWS.
 pub(crate) unsafe fn refresh_sidebar(app: *mut App) {
+    (*app).panes.sidebar_at = Some(Instant::now());
     if SIDEBAR_BUSY.swap(true, Ordering::SeqCst) {
         SIDEBAR_AGAIN.store(true, Ordering::SeqCst);
         return;
@@ -267,6 +279,7 @@ pub(crate) unsafe fn refresh_sidebar(app: *mut App) {
     let bookmarks = (*app).profile.bookmarks.clone();
     let hwnd = (*app).hwnd.0 as isize;
     std::thread::spawn(move || {
+        crate::ui::background_priority();
         let _com = ComInit::mta();
         let rows = Box::new(sidebar_rows(&bookmarks));
         SIDEBAR_BUSY.store(false, Ordering::SeqCst);
@@ -280,6 +293,12 @@ pub(crate) unsafe fn refresh_sidebar(app: *mut App) {
     });
 }
 
+/// The rows are older than 5 s. None is not stale: WM_ACTIVATE arrives inside WM_CREATE, before create_children's
+/// first build, and must not start a second one.
+pub(crate) unsafe fn sidebar_stale(app: *mut App) -> bool {
+    (*app).panes.sidebar_at.is_some_and(|t| t.elapsed() > Duration::from_secs(5))
+}
+
 /// After our own pin or unpin: rebuild now, and once more a second later in case the shell updates late.
 pub(crate) unsafe fn sidebar_changed(app: *mut App) {
     refresh_sidebar(app);
@@ -510,11 +529,9 @@ pub(crate) unsafe fn schedule_preview(app: *mut App) {
     }
 }
 
-/// The hovered list item changed (None: the pointer left or is over empty space).
+/// The pointer moved over a list item (None: it is over empty space). Every move restarts the timer, so the
+/// prefetch only fires once the pointer has been still.
 pub(crate) unsafe fn set_hover(app: *mut App, item: Option<usize>) {
-    if (*app).panes.hover == item {
-        return;
-    }
     (*app).panes.hover = item;
     let _ = KillTimer(Some((*app).hwnd), TIMER_HOVER);
     if item.is_some() && (*app).session.show_preview {
@@ -537,7 +554,11 @@ pub(crate) unsafe fn prefetch_hovered(app: *mut App) {
     if item.is_folder() || !ui::is_fs_path(&parsing) {
         return;
     }
-    preview_pane::prefetch(PathBuf::from(&parsing), l.folder.child_pidl(item), preview_pane::request_size((*app).panes.preview));
+    let path = PathBuf::from(&parsing);
+    if !rexplorer_core::preview::prefetchable(path.extension().and_then(|e| e.to_str()).unwrap_or("")) {
+        return;
+    }
+    preview_pane::prefetch(path, l.folder.child_pidl(item), preview_pane::request_size((*app).panes.preview));
 }
 
 /// Shows the focused (else first) selected item, or nothing without a selection.
diff --git a/crates/app/src/preview_pane.rs b/crates/app/src/preview_pane.rs
index 6eec94f..56da039 100644
--- a/crates/app/src/preview_pane.rs
+++ b/crates/app/src/preview_pane.rs
@@ -21,10 +21,12 @@ use windows::core::{HSTRING, PCWSTR, Result, w};
 
 /// Reserved for the parent's notifications; the pane currently sends none.
 pub const PVN_FIRST: u32 = 0x9000;
-/// Posted to the pane by a worker that filled the cache for a file; the pane shows the subject again from the cache.
+/// Posted to the pane by a worker that filled the cache for a file (lparam = Box<PathBuf> of it); the pane shows the
+/// subject again from the cache if it is still that file.
 const PV_READY: u32 = WM_APP + 0x51;
 
-const MAX_TEXT: u64 = 256 * 1024;
+// The Edit word-wraps all of its text on every set and resize, so keep what goes in small.
+const MAX_TEXT: u64 = 64 * 1024;
 
 /// An owned GDI bitmap, shared between the cache and the pane; the last holder deletes it.
 struct Bmp(HBITMAP);
@@ -75,7 +77,7 @@ fn store(path: &Path, st: Stamp, set: impl FnOnce(&mut Entry)) {
     set(&mut c[i]);
 }
 
-/// The file's text (first 256 KB, decoded for the Edit), from the cache when its mtime and size still match.
+/// The file's text (first 64 KB, decoded for the Edit), from the cache when its mtime and size still match.
 fn cached_text(path: &Path) -> Option<String> {
     let st = stamp(path);
     if let Some(t) = st.and_then(|st| lookup(path, st, |e| e.text.clone())) {
@@ -120,18 +122,22 @@ fn kind_of(path: &Path) -> Kind {
     }
 }
 
-/// Fills the cache for a hovered file on a worker thread; shell-handler previews need the UI thread and are skipped.
+/// Fills the cache for a hovered file on a worker thread; only text and images: shell-handler previews need the UI
+/// thread, and PDFs, Office files and the like load only once selected.
 pub fn prefetch(path: PathBuf, abs: Pidl, size: i32) {
     let kind = kind_of(&path);
-    if kind != Kind::Handler {
+    if matches!(kind, Kind::Text | Kind::Image) {
         fetch(path, abs, size, kind, 0);
     }
 }
 
 /// Reads the file (text) or asks the shell (thumbnail) off the UI thread, so a stalled network file never hangs the
-/// window; `notify` is the pane to post PV_READY to, or 0.
+/// window; `notify` is the pane to post PV_READY (with the file's path) to, or 0 for a speculative hover fetch.
 fn fetch(path: PathBuf, abs: Pidl, size: i32, kind: Kind, notify: isize) {
     std::thread::spawn(move || {
+        if notify == 0 {
+            crate::ui::background_priority();
+        }
         let _com = ComInit::mta();
         if kind == Kind::Text {
             let _ = cached_text(&path);
@@ -139,7 +145,12 @@ fn fetch(path: PathBuf, abs: Pidl, size: i32, kind: Kind, notify: isize) {
             let _ = cached_thumb(Some(&path), &abs, size);
         }
         if notify != 0 {
-            let _ = unsafe { PostMessageW(Some(HWND(notify as *mut c_void)), PV_READY, WPARAM(0), LPARAM(0)) };
+            // shortcut: one still queued when the pane is destroyed leaks its path (only at exit today); drain
+            // PV_READY in WM_DESTROY if panes ever close earlier.
+            let p = Box::into_raw(Box::new(path));
+            if unsafe { PostMessageW(Some(HWND(notify as *mut c_void)), PV_READY, WPARAM(0), LPARAM(p as isize)) }.is_err() {
+                drop(unsafe { Box::from_raw(p) });
+            }
         }
     });
 }
@@ -176,6 +187,8 @@ struct State {
     preview: Option<Preview>,
     /// What is shown, kept for PV_READY.
     subject: Option<Subject>,
+    /// The shown file's mtime and size when its handler opened or its text was set: both are kept while they still match.
+    stamp: Option<Stamp>,
 }
 
 /// Formats a byte count like "1.5 MB" (binary units, one decimal above 1 KB).
@@ -259,6 +272,7 @@ pub fn create(parent: HWND, id: usize) -> Result<HWND> {
             detail: String::new(),
             preview: None,
             subject: None,
+            stamp: None,
         }));
         let r = CreateWindowExW(
             WINDOW_EX_STYLE(0),
@@ -325,12 +339,16 @@ unsafe extern "system" fn wndproc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam:
             LRESULT(0)
         }
         PV_READY => {
+            let ready = Box::from_raw(lparam.0 as *mut PathBuf);
             // Cache only: a file that cannot be cached (vanished) would otherwise spawn a worker per PV_READY.
-            // A handler already showing stays (a stale PV_READY must not open a second one).
-            if let Some(sub) = (*s).subject.take().filter(|_| (*s).preview.is_none()) {
-                present(hwnd, s, &sub, false);
+            // A handler already showing stays (a stale PV_READY must not open a second one), and so does a
+            // completion for a file no longer shown (it would re-run a folder thumbnail on the UI thread).
+            if let Some(sub) = (*s).subject.take() {
+                if (*s).preview.is_none() && sub.path.as_ref() == Some(&*ready) {
+                    present(hwnd, s, &sub, false);
+                    let _ = InvalidateRect(Some(hwnd), None, false);
+                }
                 (*s).subject = Some(sub);
-                let _ = InvalidateRect(Some(hwnd), None, false);
             }
             LRESULT(0)
         }
@@ -475,8 +493,24 @@ pub fn show(hwnd: HWND, subject: Option<Subject>) {
         if s.is_null() {
             return;
         }
+        // The same file version is already live in a handler (re-hosting reloads it out of process on the UI thread)
+        // or set as text (setting it again re-wraps all of it): keep it.
+        let same = match (&subject, &(*s).subject) {
+            (Some(new), Some(old)) => {
+                (if (*s).preview.is_some() { HANDLERS.load(Ordering::Relaxed) } else { (*s).stamp.is_some() })
+                    && new.path.is_some()
+                    && new.path == old.path
+                    && new.path.as_deref().and_then(stamp) == (*s).stamp
+            }
+            _ => false,
+        };
+        if same {
+            (*s).subject = subject;
+            return;
+        }
         (*s).preview = None;
         (*s).subject = None;
+        (*s).stamp = None;
         clear_bitmap(s);
         (*s).name.clear();
         (*s).detail.clear();
@@ -506,17 +540,25 @@ unsafe fn present(hwnd: HWND, s: *mut State, sub: &Subject, spawn: bool) {
         }
     };
     if kind == Kind::Text {
-        match stamp(path).and_then(|st| lookup(path, st, |e| e.text.clone())) {
+        let st = stamp(path);
+        match st.and_then(|st| lookup(path, st, |e| e.text.clone())) {
             Some(t) => {
-                let _ = SetWindowTextW((*s).edit, &HSTRING::from(t));
+                // PV_READY can repeat for a version already set.
+                if (*s).stamp != st {
+                    let _ = SetWindowTextW((*s).edit, &HSTRING::from(t));
+                    (*s).stamp = st;
+                }
                 let _ = ShowWindow((*s).edit, SW_SHOW);
                 return;
             }
             None => start(Kind::Text),
         }
     } else if kind == Kind::Handler {
+        // Stamped before the load: a write during it leaves the stamp behind, so the next show re-hosts.
+        let st = stamp(path);
         if let Ok(p) = preview::open(path, hwnd, content_rect(hwnd)) {
             (*s).preview = Some(p);
+            (*s).stamp = st;
             return;
         }
     }
@@ -621,6 +663,15 @@ mod tests {
             }
             assert_eq!(edit_text(pane), "hola\r\nmundo");
 
+            // The same file version again leaves the Edit's text alone.
+            let _ = SetWindowTextW(GetWindow(pane, GW_CHILD).unwrap(), w!("kept"));
+            show(pane, Some(Subject {
+                path: Some(file.clone()), abs_pidl: parse(&file), name: "a.txt".into(),
+                is_folder: false, size: Some(10), type_text: "Text".into(),
+            }));
+            pump();
+            assert_eq!(edit_text(pane), "kept");
+
             show(pane, Some(Subject {
                 path: Some(dir.clone()), abs_pidl: parse(&dir), name: "d".into(),
                 is_folder: true, size: None, type_text: "Folder".into(),
diff --git a/crates/app/src/session.rs b/crates/app/src/session.rs
index 7b8a34b..13d9076 100644
--- a/crates/app/src/session.rs
+++ b/crates/app/src/session.rs
@@ -118,6 +118,11 @@ impl Debounce {
             false
         }
     }
+
+    /// How long until `should_save` says yes again.
+    pub fn remaining(&self, now: Instant) -> Duration {
+        self.last.map_or(Duration::ZERO, |l| self.min.saturating_sub(now.saturating_duration_since(l)))
+    }
 }
 
 #[cfg(test)]
@@ -187,5 +192,7 @@ mod tests {
         assert!(!d.should_save(t0 + Duration::from_secs(1)));
         assert!(d.should_save(t0 + Duration::from_secs(2)));
         assert!(!d.should_save(t0 + Duration::from_secs(3)));
+        assert_eq!(d.remaining(t0 + Duration::from_secs(3)), Duration::from_secs(1));
+        assert_eq!(d.remaining(t0 + Duration::from_secs(9)), Duration::ZERO);
     }
 }
diff --git a/crates/app/src/source.rs b/crates/app/src/source.rs
index a350f56..bff063d 100644
--- a/crates/app/src/source.rs
+++ b/crates/app/src/source.rs
@@ -165,10 +165,14 @@ impl Source {
     /// Text of row `i`, column `sub` (header position).
     pub fn text(&self, i: usize, sub: usize) -> String {
         match self {
-            Source::Shell(l) => match l.items.get(i) {
-                Some(e) if sub == 0 => name_cell(e).0,
-                Some(e) => l.columns.get(sub).map(|c| e.detail(c.index)).unwrap_or_default(),
-                None => String::new(),
+            Source::Shell(l) => match (l.items.get(i), l.cells.get(i).and_then(|row| row.get_or_init(|| vec![std::cell::OnceCell::new(); l.columns.len().max(1)].into()).get(sub))) {
+                (Some(e), Some(cell)) => cell.get().cloned().unwrap_or_else(|| {
+                    let text = if sub == 0 { name_cell(e).0 } else { e.detail(l.columns[sub].index) };
+                    // set, not get_or_init: a shell call that pumps messages may ask for this cell again meanwhile
+                    let _ = cell.set(text.clone());
+                    text
+                }),
+                _ => String::new(),
             },
             Source::Archive(a) => a.rows.get(i).map(|e| ArchiveListing::detail(e, sub)).unwrap_or_default(),
             Source::Search(s) => s
@@ -466,9 +470,12 @@ pub(crate) unsafe fn start_search(app: *mut App, t: usize, needle: &str, push: b
     };
     (*app).generation += 1;
     let generation = (*app).generation;
-    // A load still in flight for this tab no longer lands here.
+    // A load still in flight for this tab no longer lands here, nor does a change reload already armed, nor (for a
+    // background tab) the watch on the folder it searches.
     tab.pending = 0;
     tab.loading = None;
+    tab.dirty = false;
+    tab.watch = None;
     let old = tab.source.take();
     if let (true, Some(o)) = (push, &old) {
         tab.back.push(o.location());
@@ -511,7 +518,15 @@ pub(crate) unsafe fn start_search(app: *mut App, t: usize, needle: &str, push: b
                 drop(unsafe { Box::from_raw(b) });
             }
         };
-        let mut sink = |hits: Vec<Hit>| post(rows_of(hits), false);
+        // The walk has no result limit of its own; stop it where the USN path stops.
+        let mut n = 0usize;
+        let mut sink = |hits: Vec<Hit>| {
+            n += hits.len();
+            if n >= USN_LIMIT {
+                cancel.store(true, Ordering::Relaxed);
+            }
+            post(rows_of(hits), false)
+        };
         let indexed = drive.is_some_and(|d| usn_search(&usn_cache, d, &needle, &cancel, &mut sink).is_ok());
         if !indexed {
             let _ = search::walk(&root, &needle, scope, &cancel, &mut sink);
@@ -533,8 +548,12 @@ fn usn_search(cache: &UsnCache, drive: char, needle: &str, cancel: &AtomicBool,
             }
         }
     };
+    // A superseded search must not scan a whole index it no longer needs.
+    if cancel.load(Ordering::Relaxed) {
+        return Ok(());
+    }
     let mut batch = Vec::new();
-    for path in index.search(needle, USN_LIMIT) {
+    for path in index.search(needle, USN_LIMIT, cancel) {
         if cancel.load(Ordering::Relaxed) {
             break;
         }
diff --git a/crates/app/src/thumbs.rs b/crates/app/src/thumbs.rs
index edbb443..d72ab64 100644
--- a/crates/app/src/thumbs.rs
+++ b/crates/app/src/thumbs.rs
@@ -9,6 +9,7 @@ use std::thread::{self, JoinHandle};
 
 use rexplorer_core::com::{ComInit, Pidl};
 use rexplorer_core::images;
+use crate::views;
 use windows::Win32::Foundation::{HWND, LPARAM, WPARAM};
 use windows::Win32::Graphics::Gdi::{DeleteObject, HBITMAP, HGDIOBJ};
 use windows::Win32::UI::WindowsAndMessaging::PostMessageW;
@@ -18,15 +19,21 @@ struct Request {
     id: usize,
     abs: Pidl,
     size: i32,
+    icon_only: bool,
 }
 
+/// `window` before the first scroll: every item.
+const ALL: u64 = u32::MAX as u64;
+
 pub struct Thumbs {
     tx: Option<Sender<Request>>,
     gen_: Arc<AtomicU64>,
+    /// Items worth rendering, `start << 32 | end`: the worker skips requests outside it.
+    window: Arc<AtomicU64>,
     worker: Option<JoinHandle<()>>,
 }
 
-/// Decoded completion message; the receiver owns `bitmap` and must DeleteObject it.
+/// Decoded completion message; the receiver owns `bitmap` (already fitted to the request's size) and must DeleteObject it.
 pub struct Done {
     pub id: usize,
     pub bitmap: HBITMAP,
@@ -37,16 +44,23 @@ pub fn start(hwnd: HWND, msg: u32) -> Thumbs {
     let (tx, rx) = channel::<Request>();
     let gen_ = Arc::new(AtomicU64::new(0));
     let latest = gen_.clone();
+    let window = Arc::new(AtomicU64::new(ALL));
+    let win = window.clone();
     let hwnd = hwnd.0 as isize;
     let worker = thread::spawn(move || {
         let _com = ComInit::mta();
         // recv fails once the sender is dropped.
         while let Ok(r) = rx.recv() {
-            if r.gen_ < latest.load(Ordering::SeqCst) {
+            // Stale, or scrolled out of the window while queued.
+            if r.gen_ < latest.load(Ordering::SeqCst) || !in_window(&win, r.id & 0xFFFF_FFFF) {
                 continue;
             }
-            let bmp = images::thumbnail(&r.abs, r.size);
+            let bmp = if r.icon_only { images::icon(&r.abs, r.size) } else { images::thumbnail(&r.abs, r.size) };
             let Ok(bmp) = bmp else { continue };
+            // Scaled here: the UI thread only adds the image to its list.
+            let fitted = unsafe { views::fit(bmp, r.size) };
+            let _ = unsafe { DeleteObject(HGDIOBJ(bmp.0)) };
+            let Some(bmp) = fitted else { continue };
             let posted = unsafe {
                 PostMessageW(Some(HWND(hwnd as *mut _)), msg, WPARAM(r.id), LPARAM(bmp.0 as isize))
             };
@@ -56,33 +70,49 @@ pub fn start(hwnd: HWND, msg: u32) -> Thumbs {
             }
         }
     });
-    Thumbs { tx: Some(tx), gen_, worker: Some(worker) }
+    Thumbs { tx: Some(tx), gen_, window, worker: Some(worker) }
 }
 
 impl Thumbs {
-    pub fn request(&self, id: usize, abs: Pidl, size: i32) {
-        self.send(self.generation(), id, abs, size);
+    pub fn request(&self, id: usize, abs: Pidl, size: i32, icon_only: bool) {
+        self.send(self.generation(), id, abs, size, icon_only);
     }
 
     #[cfg(test)]
-    pub fn request_with_generation(&self, gen_: u64, id: usize, abs: Pidl, size: i32) {
-        self.send(gen_, id, abs, size);
+    pub fn request_with_generation(&self, gen_: u64, id: usize, abs: Pidl, size: i32, icon_only: bool) {
+        self.send(gen_, id, abs, size, icon_only);
     }
 
-    fn send(&self, gen_: u64, id: usize, abs: Pidl, size: i32) {
+    fn send(&self, gen_: u64, id: usize, abs: Pidl, size: i32, icon_only: bool) {
         if let Some(tx) = &self.tx {
-            let _ = tx.send(Request { gen_, id, abs, size });
+            let _ = tx.send(Request { gen_, id, abs, size, icon_only });
         }
     }
 
-    /// Navigation happened: queued requests from older generations are skipped.
+    /// Navigation happened: queued requests from older generations are skipped, and every item is in the window again.
     pub fn invalidate(&self) {
         self.gen_.fetch_add(1, Ordering::SeqCst);
+        self.window.store(ALL, Ordering::SeqCst);
+    }
+
+    /// The items on screen plus a lookahead: queued requests for others are skipped.
+    pub fn set_window(&self, items: Range<usize>) {
+        self.window.store((items.start as u64) << 32 | items.end as u64, Ordering::SeqCst);
     }
 
     pub fn generation(&self) -> u64 {
         self.gen_.load(Ordering::SeqCst)
     }
+
+    /// Whether a request for item `i` would be rendered now rather than skipped.
+    pub fn in_window(&self, i: usize) -> bool {
+        in_window(&self.window, i)
+    }
+}
+
+fn in_window(window: &AtomicU64, i: usize) -> bool {
+    let w = window.load(Ordering::SeqCst);
+    (w >> 32..w & ALL).contains(&(i as u64))
 }
 
 impl Drop for Thumbs {
@@ -153,26 +183,58 @@ mod tests {
         }
         .unwrap();
         let t = start(hwnd, MSG_ID);
-        t.request(7, temp_pidl(), 64);
+        t.request(7, temp_pidl(), 64, false);
         let m = wait_msg(5000).expect("no thumbnail within 5s");
         let d = done(m.wParam, m.lParam);
         assert_eq!(d.id, 7);
         let mut bm = BITMAP::default();
         let n = unsafe { GetObjectW(HGDIOBJ(d.bitmap.0), size_of::<BITMAP>() as i32, Some(&mut bm as *mut _ as *mut _)) };
-        assert!(n > 0 && bm.bmWidth > 0);
+        assert!(n > 0 && (bm.bmWidth, bm.bmHeight.abs()) == (64, 64), "fitted to the request's size on the worker");
         let _ = unsafe { DeleteObject(HGDIOBJ(d.bitmap.0)) };
 
         let old = t.generation();
         t.invalidate();
         assert_eq!(t.generation(), old + 1);
-        t.request_with_generation(old, 8, temp_pidl(), 64);
+        t.request_with_generation(old, 8, temp_pidl(), 64, false);
         assert!(wait_msg(1000).is_none(), "stale request was delivered");
         // A current-generation request still works after invalidate.
-        t.request(9, temp_pidl(), 64);
+        t.request(9, temp_pidl(), 64, true);
         let m = wait_msg(5000).expect("no icon within 5s");
         let _ = unsafe { DeleteObject(HGDIOBJ(done(m.wParam, m.lParam).bitmap.0)) };
 
         drop(t);
         let _ = unsafe { DestroyWindow(hwnd) };
     }
+
+    #[test]
+    fn skips_requests_outside_the_window_until_invalidate() {
+        let _com = ComInit::sta();
+        let hwnd = unsafe {
+            CreateWindowExW(WINDOW_EX_STYLE(0), w!("STATIC"), PCWSTR::null(), WS_OVERLAPPEDWINDOW, 0, 0, 800, 600, None, None, None, None)
+        }
+        .unwrap();
+        let t = start(hwnd, MSG_ID);
+        t.set_window(0..5);
+        assert!(t.in_window(4) && !t.in_window(5) && !t.in_window(9), "what the UI asks before requesting");
+        t.request(9, temp_pidl(), 64, true);
+        t.request(2, temp_pidl(), 64, true);
+        let m = wait_msg(5000).expect("the request inside the window is delivered");
+        let d = done(m.wParam, m.lParam);
+        assert_eq!(d.id, 2);
+        let _ = unsafe { DeleteObject(HGDIOBJ(d.bitmap.0)) };
+        assert!(wait_msg(1000).is_none(), "the request outside the window was rendered");
+        // The listing token in the high bits does not matter: only the item index is compared.
+        t.request((3 << 32) | 4, temp_pidl(), 64, true);
+        let m = wait_msg(5000).expect("item 4 is inside 0..5");
+        let _ = unsafe { DeleteObject(HGDIOBJ(done(m.wParam, m.lParam).bitmap.0)) };
+        t.invalidate();
+        assert!(t.in_window(9));
+        t.request(9, temp_pidl(), 64, true);
+        let m = wait_msg(5000).expect("invalidate opens the window again");
+        let d = done(m.wParam, m.lParam);
+        assert_eq!(d.id, 9);
+        let _ = unsafe { DeleteObject(HGDIOBJ(d.bitmap.0)) };
+        drop(t);
+        let _ = unsafe { DestroyWindow(hwnd) };
+    }
 }
diff --git a/crates/app/src/ui.rs b/crates/app/src/ui.rs
index 40f72e3..0bc34d7 100644
--- a/crates/app/src/ui.rs
+++ b/crates/app/src/ui.rs
@@ -13,6 +13,9 @@ use windows::Win32::Graphics::Gdi::{
     BeginPaint, DT_CENTER, DT_NOPREFIX, DT_SINGLELINE, DT_VCENTER, DrawTextW, EndPaint, FillRect, PAINTSTRUCT, SelectObject,
     SetBkMode, SetTextColor, TRANSPARENT,
 };
+use windows::Win32::Storage::FileSystem::GetDriveTypeW;
+use windows::Win32::System::Threading::{GetCurrentThread, SetThreadPriority, THREAD_MODE_BACKGROUND_BEGIN};
+use windows::Win32::System::WindowsProgramming::DRIVE_REMOTE;
 
 pub(crate) const THIS_PC: &str = "::{20D04FE0-3AEA-1069-A2D8-08002B30309D}";
 const HEADER_H: i32 = 44;
@@ -33,12 +36,23 @@ fn scale(px: i32, dpi: u32) -> i32 {
     px * dpi as i32 / 96
 }
 
+/// Puts the calling worker thread in background mode (lower CPU, I/O and memory priority): speculative work yields to the user.
+pub(crate) fn background_priority() {
+    let _ = unsafe { SetThreadPriority(GetCurrentThread(), THREAD_MODE_BACKGROUND_BEGIN) };
+}
+
 /// A drive path or UNC path: something a terminal can start in.
 pub(crate) fn is_fs_path(p: &str) -> bool {
     let b = p.as_bytes();
     (b.len() >= 2 && b[0].is_ascii_alphabetic() && b[1] == b':') || p.starts_with("\\\\")
 }
 
+/// A network path: a UNC name, or a drive letter mapped to a share.
+pub(crate) fn is_remote(p: &str) -> bool {
+    let drive = p.get(1..3) == Some(":\\");
+    p.starts_with("\\\\") || (drive && unsafe { GetDriveTypeW(&HSTRING::from(&p[..3])) } == DRIVE_REMOTE)
+}
+
 pub(crate) unsafe fn create_children(app: *mut App) -> Result<()> {
     let hwnd = (*app).hwnd;
     let hinst: HINSTANCE = GetModuleHandleW(None)?.into();
@@ -511,6 +525,10 @@ pub(crate) unsafe fn crumb_dropdown(app: *mut App, index: usize) {
     if !(is_fs_path(&c.parsing) || c.parsing.eq_ignore_ascii_case(THIS_PC)) {
         return;
     }
+    // A dead share would block here until the SMB timeout; the crumb itself still navigates.
+    if is_remote(&c.parsing) {
+        return;
+    }
     let Ok(folder) = ShellFolder::from_pidl(pidl) else { return };
     // Bounded: this runs on the UI thread, and the menu shows 500 at most anyway.
     let Ok(mut items) = folder.subfolders_up_to(2000) else { return };
@@ -800,12 +818,17 @@ pub(crate) unsafe fn on_palette(app: *mut App, hdr: &NMHDR) {
 }
 
 pub(crate) unsafe fn open_terminal(app: *mut App) {
-    match listing(app).map(|l| l.folder.parsing_name.clone()).filter(|p| is_fs_path(p)) {
-        Some(p) if instance::open_terminal(std::path::Path::new(&p)).is_ok() => {}
-        _ => {
+    let Some(p) = listing(app).map(|l| l.folder.parsing_name.clone()).filter(|p| is_fs_path(p)) else {
+        let _ = MessageBeep(MB_OK);
+        return;
+    };
+    // The click returns at once; ShellExecute on an app alias (wt.exe) can take a while.
+    std::thread::spawn(move || {
+        let _com = ComInit::sta();
+        if instance::open_terminal(std::path::Path::new(&p)).is_err() {
             let _ = MessageBeep(MB_OK);
         }
-    }
+    });
 }
 
 /// The status bar and the command bar's enabled states.
diff --git a/crates/app/src/views.rs b/crates/app/src/views.rs
index 339f54c..0fa6cc1 100644
--- a/crates/app/src/views.rs
+++ b/crates/app/src/views.rs
@@ -193,6 +193,10 @@ unsafe fn load_icon_theme(dir: &std::path::Path, size: i32) -> Option<ThemeIcons
     (!list.is_invalid()).then(|| ThemeIcons { theme, list, index: HashMap::new() })
 }
 
+pub(crate) unsafe fn icon_theme_active(app: *mut App) -> bool {
+    (*app).views.icon_theme.is_some()
+}
+
 /// Small-icon index from the icon theme, or None when no theme is active.
 pub(crate) unsafe fn theme_icon(app: *mut App, item: &ShellItem) -> Option<i32> {
     (*app).views.icon_theme.as_ref()?;
@@ -291,30 +295,78 @@ pub(crate) unsafe fn on_cache_hint(app: *mut App, from: i32, to: i32) {
         let _ = InvalidateRect(Some((*app).list), None, false);
     }
     let count = (*app).views.slots.len();
-    for i in thumbs::visible_range(from, to - from + 1, count, LOOKAHEAD) {
+    // What the worker may still render: the screen (and the hint, should the two disagree) plus a lookahead. Slots
+    // requested outside it are dropped there, so they ask again if scrolled back to.
+    let screen = on_screen((*app).list);
+    let first = screen.start.min(from);
+    let win = thumbs::visible_range(first, screen.end.max(to + 1) - first, count, LOOKAHEAD);
+    let v = &mut (*app).views;
+    if let Some(t) = &v.thumbs {
+        t.set_window(win.clone());
+    }
+    let (before, rest) = v.slots.split_at_mut(win.start);
+    for s in before.iter_mut().chain(&mut rest[win.end - win.start..]) {
+        if *s == REQUESTED {
+            *s = UNKNOWN;
+        }
+    }
+    for i in thumbs::visible_range(from, to - from + 1, count, 0) {
         if (&(*app).views.slots)[i] == UNKNOWN {
             request(app, i);
         }
     }
+    // The lookahead preloads pictures only: no off-screen PDF, Office or video rendering.
+    for i in thumbs::visible_range(from, to - from + 1, count, LOOKAHEAD) {
+        // shortcut: the extension comes from a parsing name asked per lookahead row; keep it per item if the hint gets hot
+        if (&(*app).views.slots)[i] == UNKNOWN && listing(app).and_then(|l| l.items.get(i)).is_some_and(|it| is_picture(&it.parsing_name())) {
+            request(app, i);
+        }
+    }
+}
+
+/// The items an icon view has on screen, from its scroll position: after a thumbnail lands, its redraw can make
+/// LVN_ODCACHEHINT shrink to that one item.
+unsafe fn on_screen(list: HWND) -> std::ops::Range<i32> {
+    let mut origin = POINT::default();
+    SendMessageW(list, LVM_GETORIGIN, None, Some(LPARAM(&mut origin as *mut POINT as isize)));
+    let space = SendMessageW(list, LVM_GETITEMSPACING, Some(WPARAM(0)), None).0 as u32;
+    let (cx, cy) = ((space & 0xFFFF).max(1) as i32, (space >> 16).max(1) as i32);
+    let mut rc = RECT::default();
+    let _ = GetClientRect(list, &mut rc);
+    let per_row = (rc.right / cx).max(1);
+    let top = origin.y.max(0);
+    top / cy * per_row..(top + rc.bottom) / cy * per_row + per_row
 }
 
 fn cache_key(view: View, size: i32, parsing: &str) -> String {
     format!("{}:{size}:{parsing}", view.name())
 }
 
+/// Whether the file is a picture by its extension (no registry access).
+fn is_picture(parsing: &str) -> bool {
+    rexplorer_core::preview::is_image(std::path::Path::new(parsing).extension().and_then(|e| e.to_str()).unwrap_or(""))
+}
+
 /// From the cache when possible (image index), else queued on the worker (placeholder until it lands).
 unsafe fn request(app: *mut App, i: usize) -> i32 {
     let Some(l) = listing(app) else { return 0 };
     let Some(item) = l.items.get(i) else { return 0 };
     let v = &mut (*app).views;
-    let key = cache_key(v.view, v.size, &item.parsing_name());
+    let parsing = item.parsing_name();
+    let key = cache_key(v.view, v.size, &parsing);
     if let Some(bmp) = v.cache.get(&key) {
         let index = ImageList_Add(v.normal, bmp, None).max(0);
         v.slots[i] = index;
         return index;
     }
     let Some(t) = &v.thumbs else { return 0 };
-    t.request((v.token << 32) | i, l.folder.child_pidl(item), v.size);
+    // Asked for off screen (LVM_GETITEM, accessibility): the worker would skip it, so it stays unknown until shown.
+    if !t.in_window(i) {
+        return 0;
+    }
+    // The Icons view shows pictures as thumbnails and everything else as its icon.
+    let icon_only = v.view == View::Icons && !is_picture(&parsing);
+    t.request((v.token << 32) | i, l.folder.child_pidl(item), v.size, icon_only);
     v.slots[i] = REQUESTED;
     0
 }
@@ -324,18 +376,17 @@ pub(crate) unsafe fn on_thumb_done(app: *mut App, wparam: WPARAM, lparam: LPARAM
     let d = thumbs::done(wparam, lparam);
     let (token, i) = (d.id >> 32, d.id & 0xFFFF_FFFF);
     let v = &mut (*app).views;
-    let live = v.thumbs.is_some() && token == v.token && v.view != View::Details && v.slots.get(i) == Some(&REQUESTED);
-    let fitted = if live { fit(d.bitmap, v.size) } else { None };
-    let _ = DeleteObject(d.bitmap.into());
+    let live = v.thumbs.is_some() && token == v.token && v.view != View::Details;
     if !live {
+        let _ = DeleteObject(d.bitmap.into());
         return;
     }
-    let Some(bmp) = fitted else {
-        v.slots[i] = 0; // placeholder for good, so it is not requested again
-        return;
-    };
-    let index = ImageList_Add(v.normal, bmp, None).max(0);
-    v.slots[i] = index;
+    let bmp = d.bitmap;
+    // One whose slot left the window while it rendered (a reload's jump to the end and back) is still cached.
+    let shown = v.slots.get(i) == Some(&REQUESTED);
+    if shown {
+        v.slots[i] = ImageList_Add(v.normal, bmp, None).max(0);
+    }
     let parsing = listing(app).and_then(|l| l.items.get(i)).map(|it| it.parsing_name());
     let v = &mut (*app).views;
     match parsing {
@@ -344,7 +395,9 @@ pub(crate) unsafe fn on_thumb_done(app: *mut App, wparam: WPARAM, lparam: LPARAM
             let _ = DeleteObject(bmp.into());
         }
     }
-    SendMessageW((*app).list, LVM_REDRAWITEMS, Some(WPARAM(i)), Some(LPARAM(i as isize)));
+    if shown {
+        SendMessageW((*app).list, LVM_REDRAWITEMS, Some(WPARAM(i)), Some(LPARAM(i as isize)));
+    }
 }
 
 /// WM_DESTROY: stop the worker, delete bitmaps already queued for us, free the image lists.
@@ -392,7 +445,8 @@ pub(crate) unsafe fn dib(w: i32, h: i32) -> Option<(HBITMAP, *mut u8)> {
 }
 
 /// Shrinks `src` to fit a `size` square (never enlarges) and centers it: image lists need exact-size images.
-unsafe fn fit(src: HBITMAP, size: i32) -> Option<HBITMAP> {
+/// Runs on the thumbs worker.
+pub(crate) unsafe fn fit(src: HBITMAP, size: i32) -> Option<HBITMAP> {
     let mut bm = BITMAP::default();
     if GetObjectW(src.into(), size_of::<BITMAP>() as i32, Some(&mut bm as *mut _ as *mut c_void)) == 0 {
         return None;
@@ -521,8 +575,8 @@ pub(crate) fn try_save_profile_keys(profile: &str, pairs: &[(&str, String)]) ->
 const STARTER: [&str; 2] = ["folder", "file"];
 
 /// Writes `icons\default\`: `folder.png` and `file.png` once (when the folder does not exist yet), then, in the
-/// background, Windows' own icon for every registered extension; `system-icons.txt` lists those and marks the
-/// export done (delete it to export again, say after installing a program).
+/// background and only while the theme uses `icon_theme=default`, Windows' own icon for every registered extension;
+/// `system-icons.txt` lists those and marks the export done (delete it to export again, say after installing a program).
 pub(crate) fn ensure_starter_theme(t: &Theme) {
     let dir = settings::dir().join("icons").join("default");
     if !dir.exists() {
@@ -533,8 +587,9 @@ pub(crate) fn ensure_starter_theme(t: &Theme) {
             let _ = icons::save_png(&starter_icon(name, t), 32, 32, &dir.join(format!("{name}.png")));
         }
     }
+    // The export only feeds an enabled default theme.
     let done = dir.join("system-icons.txt");
-    if done.exists() {
+    if t.icon_theme.as_deref() != Some("default") || done.exists() {
         return;
     }
     std::thread::spawn(move || {
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index fae439b..2037244 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rexplorer-core"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/CodingDiego/rexplorer"
diff --git a/crates/core/src/icons.rs b/crates/core/src/icons.rs
index 512d9de..bb081fa 100644
--- a/crates/core/src/icons.rs
+++ b/crates/core/src/icons.rs
@@ -282,14 +282,19 @@ fn confined_to_corner(bmp: HBITMAP, edge: u32) -> bool {
 /// For an item the shell gives the blank page: the opening app's icon as a straight-alpha DIB at least
 /// `size` px (48 or 256 wide; the caller scales). None when the shell has an icon of its own for it.
 pub fn app_icon_bitmap(abs: &Pidl, size: i32) -> Option<HBITMAP> {
+    let name = unsafe { take_cotaskmem_string(SHGetNameFromIDList(abs.as_ptr(), SIGDN_PARENTRELATIVEPARSING).ok()?) };
+    let ext = Path::new(&name).extension().and_then(|e| e.to_str())?;
+    // The registry-only check (no disk access) goes first: it spares most items the bind and icon extraction below.
+    if system_icon_index(ext) != generic_index() {
+        return None;
+    }
     let mut fi = SHFILEINFOW::default();
     let flags = SHGFI_PIDL | SHGFI_SYSICONINDEX | SHGFI_SMALLICON;
     let himl = unsafe { SHGetFileInfoW(PCWSTR(abs.as_ptr() as *const u16), FILE_FLAGS_AND_ATTRIBUTES(0), Some(&mut fi), size_of::<SHFILEINFOW>() as u32, flags) };
     if himl == 0 || Some(fi.iIcon) != generic_index() {
         return None;
     }
-    let name = unsafe { take_cotaskmem_string(SHGetNameFromIDList(abs.as_ptr(), SIGDN_PARENTRELATIVEPARSING).ok()?) };
-    let index = Path::new(&name).extension().and_then(|e| e.to_str()).and_then(app_icon_index)?;
+    let index = app_icon_index(ext)?;
     let mut bmp = None;
     if size > 48 {
         bmp = draw_system_icon(SHIL_JUMBO, index).filter(|&b| {
diff --git a/crates/core/src/menu.rs b/crates/core/src/menu.rs
index d4b5602..a8b8041 100644
--- a/crates/core/src/menu.rs
+++ b/crates/core/src/menu.rs
@@ -1,6 +1,7 @@
 use windows::Win32::Foundation::{HWND, LPARAM, LRESULT, POINT, WPARAM};
 use windows::Win32::UI::Shell::{
     CMF_CANRENAME, CMF_DEFAULTONLY, CMF_EXPLORE, CMF_EXTENDEDVERBS, CMF_NORMAL,
+    CMF_OPTIMIZEFORINVOKE,
     CMIC_MASK_PTINVOKE, CMIC_MASK_SHIFT_DOWN, CMINVOKECOMMANDINFO, CMINVOKECOMMANDINFOEX,
     GCS_VERBW, IContextMenu, IContextMenu2, IContextMenu3, SEE_MASK_UNICODE,
 };
@@ -98,7 +99,9 @@ impl ContextMenu {
         let narrow = std::ffi::CString::new(verb).expect("ascii verb");
         let wide = HSTRING::from(verb);
         unsafe {
-            self.menu.QueryContextMenu(self.hmenu, 0, ID_FIRST, ID_LAST, CMF_NORMAL).ok()?;
+            // The built-in verbs need no extension handlers; pins and "New" items do.
+            let flags = if matches!(verb, "copy" | "cut" | "paste" | "delete" | "properties") { CMF_OPTIMIZEFORINVOKE } else { CMF_NORMAL };
+            self.menu.QueryContextMenu(self.hmenu, 0, ID_FIRST, ID_LAST, flags).ok()?;
             self.invoke(hwnd, PCSTR(narrow.as_ptr() as *const u8), PCWSTR(wide.as_ptr()), None, shift)
         }
     }
diff --git a/crates/core/src/notify.rs b/crates/core/src/notify.rs
index 4177b09..4b43dfe 100644
--- a/crates/core/src/notify.rs
+++ b/crates/core/src/notify.rs
@@ -1,37 +1,98 @@
 use windows::Win32::Foundation::{HANDLE, HWND, LPARAM, WPARAM};
 use windows::Win32::UI::Shell::{
-    SHCNE_ALLEVENTS, SHCNRF_InterruptLevel, SHCNRF_NewDelivery, SHCNRF_SOURCE, SHCNRF_ShellLevel,
+    ILClone, ILIsEqual, ILIsParent, SHCNE_ALLEVENTS, SHCNE_ASSOCCHANGED, SHCNE_EXTENDED_EVENT, SHCNE_FREESPACE,
+    SHCNE_UPDATEIMAGE, SHCNRF_InterruptLevel, SHCNRF_NewDelivery, SHCNRF_SOURCE, SHCNRF_ShellLevel,
     SHChangeNotification_Lock, SHChangeNotification_Unlock, SHChangeNotifyDeregister,
     SHChangeNotifyEntry, SHChangeNotifyRegister,
 };
 
+use crate::com::Pidl;
 use crate::folder::ShellFolder;
 
 /// Delivers shell change notifications for one folder to a window as message `msg`.
 /// Works for virtual folders too, unlike `ReadDirectoryChangesW`.
-pub struct ChangeWatch(u32);
+pub struct ChangeWatch {
+    id: u32,
+    folder: Pidl,
+}
 
 impl ChangeWatch {
     pub fn register(hwnd: HWND, folder: &ShellFolder, msg: u32) -> Option<Self> {
         let entry = SHChangeNotifyEntry { pidl: folder.pidl.as_ptr() as *mut _, fRecursive: false.into() };
         let sources = SHCNRF_SOURCE(SHCNRF_ShellLevel.0 | SHCNRF_InterruptLevel.0 | SHCNRF_NewDelivery.0);
         let id = unsafe { SHChangeNotifyRegister(hwnd, sources, SHCNE_ALLEVENTS.0 as i32, msg, 1, &entry) };
-        (id != 0).then_some(ChangeWatch(id))
+        (id != 0).then(|| ChangeWatch { id, folder: folder.pidl.clone() })
+    }
+
+    /// Whether this watch is on `folder`.
+    pub fn is_on(&self, folder: &Pidl) -> bool {
+        unsafe { ILIsEqual(self.folder.as_ptr(), folder.as_ptr()) }.as_bool()
     }
 
-    /// Call from the message handler: releases the notification payload we do not inspect.
-    pub fn acknowledge(wparam: WPARAM, lparam: LPARAM) {
+    /// Whether a notification about `changed` is about this folder: the folder itself or an item directly in it.
+    pub fn concerns(&self, changed: &Pidl) -> bool {
+        self.is_on(changed) || unsafe { ILIsParent(self.folder.as_ptr(), changed.as_ptr(), true) }.as_bool()
+    }
+
+    /// Call from the message handler: releases the notification payload and returns copies of the items it names
+    /// (empty for events that name none).
+    pub fn acknowledge(wparam: WPARAM, lparam: LPARAM) -> Vec<Pidl> {
+        let mut items = Vec::new();
         unsafe {
-            let lock = SHChangeNotification_Lock(HANDLE(wparam.0 as *mut _), lparam.0 as u32, None, None);
+            let (mut pidls, mut event) = (std::ptr::null_mut(), 0);
+            let lock = SHChangeNotification_Lock(HANDLE(wparam.0 as *mut _), lparam.0 as u32, Some(&mut pidls), Some(&mut event));
             if !lock.is_invalid() {
+                // These carry numbers, not PIDLs.
+                let numeric = SHCNE_ASSOCCHANGED.0 | SHCNE_EXTENDED_EVENT.0 | SHCNE_FREESPACE.0 | SHCNE_UPDATEIMAGE.0;
+                if !pidls.is_null() && event as u32 & numeric == 0 {
+                    for i in 0..2 {
+                        let p = *pidls.add(i);
+                        if !p.is_null() {
+                            let copy = ILClone(p);
+                            if !copy.is_null() {
+                                items.push(Pidl::from_raw(copy));
+                            }
+                        }
+                    }
+                }
                 let _ = SHChangeNotification_Unlock(lock);
             }
         }
+        items
     }
 }
 
 impl Drop for ChangeWatch {
     fn drop(&mut self) {
-        let _ = unsafe { SHChangeNotifyDeregister(self.0) };
+        let _ = unsafe { SHChangeNotifyDeregister(self.id) };
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::com::ComInit;
+    use windows::Win32::UI::Shell::SHParseDisplayName;
+    use windows::core::HSTRING;
+
+    fn pidl(path: &std::path::Path) -> Pidl {
+        let mut p = std::ptr::null_mut();
+        unsafe { SHParseDisplayName(&HSTRING::from(path.as_os_str()), None, &mut p, 0, None) }.unwrap();
+        unsafe { Pidl::from_raw(p) }
+    }
+
+    #[test]
+    fn a_watch_concerns_its_folder_and_the_items_directly_in_it() {
+        let _com = ComInit::sta();
+        let dir = std::env::temp_dir().join(format!("rexplorer-notify-{}", std::process::id()));
+        std::fs::create_dir_all(dir.join("sub")).unwrap();
+        std::fs::write(dir.join("a.txt"), b"x").unwrap();
+        std::fs::write(dir.join("sub").join("b.txt"), b"x").unwrap();
+        let w = ChangeWatch { id: 0, folder: pidl(&dir) };
+        assert!(w.is_on(&pidl(&dir)) && !w.is_on(&pidl(&dir.join("sub"))));
+        assert!(w.concerns(&pidl(&dir)) && w.concerns(&pidl(&dir.join("a.txt"))) && w.concerns(&pidl(&dir.join("sub"))));
+        assert!(!w.concerns(&pidl(&dir.join("sub").join("b.txt"))), "grandchildren are another folder's");
+        assert!(!w.concerns(&pidl(dir.parent().unwrap())));
+        let _ = std::fs::remove_dir_all(&dir);
     }
 }
diff --git a/crates/core/src/preview.rs b/crates/core/src/preview.rs
index a2cb6e1..f37aaa2 100644
--- a/crates/core/src/preview.rs
+++ b/crates/core/src/preview.rs
@@ -33,12 +33,23 @@ const IMAGE_EXTS: &[&str] = &[
     "png", "jpg", "jpeg", "gif", "bmp", "webp", "ico", "tif", "tiff", "heic", "heif", "avif", "jxl",
 ];
 
+/// Whether `ext` ("png" or ".png", any case) is an image type.
+pub fn is_image(ext: &str) -> bool {
+    IMAGE_EXTS.contains(&ext.trim_start_matches('.').to_ascii_lowercase().as_str())
+}
+
+/// Whether the hover prefetch may load `ext`: text and light images only, by extension (no registry access).
+pub fn prefetchable(ext: &str) -> bool {
+    let e = ext.trim_start_matches('.').to_ascii_lowercase();
+    TEXT_EXTS.contains(&e.as_str()) || matches!(e.as_str(), "png" | "jpg" | "jpeg" | "gif" | "bmp" | "webp" | "ico")
+}
+
 /// Classifies `ext` ("rs" or ".rs", any case); the Handler arm queries the registry.
 pub fn kind(ext: &str) -> Kind {
     let e = ext.trim_start_matches('.').to_ascii_lowercase();
     if TEXT_EXTS.contains(&e.as_str()) {
         Kind::Text
-    } else if IMAGE_EXTS.contains(&e.as_str()) {
+    } else if is_image(&e) {
         Kind::Image
     } else if handler_clsid(&e).is_some() {
         Kind::Handler
@@ -153,6 +164,17 @@ mod tests {
         assert_eq!(kind("zzz-not-a-type"), Kind::None);
     }
 
+    #[test]
+    fn only_light_types_prefetch() {
+        for e in ["pdf", "docx", "heic", "mp4", "tif", "zzz-not-a-type"] {
+            assert!(!prefetchable(e), "{e}");
+        }
+        for e in ["txt", "JPG", ".png", "rs"] {
+            assert!(prefetchable(e), "{e}");
+        }
+        assert!(is_image("HEIC") && is_image(".png") && !is_image("pdf") && !is_image("txt"));
+    }
+
     #[test]
     fn txt_has_a_system_preview_handler() {
         let _com = ComInit::sta();
diff --git a/crates/core/src/settings.rs b/crates/core/src/settings.rs
index dc27f35..159e000 100644
--- a/crates/core/src/settings.rs
+++ b/crates/core/src/settings.rs
@@ -301,7 +301,7 @@ impl Profile {
                 "show_extensions" => p.show_extensions = parse_bool(v).unwrap_or(p.show_extensions),
                 "single_click" => p.single_click = parse_bool(v).unwrap_or(p.single_click),
                 "search_delay_ms" => p.search_delay_ms = v.parse().unwrap_or(p.search_delay_ms),
-                "hover_preview_ms" => p.hover_preview_ms = v.parse().unwrap_or(p.hover_preview_ms),
+                "hover_preview_ms" => p.hover_preview_ms = v.parse().map_or(p.hover_preview_ms, |n: u32| n.clamp(200, 10000)),
                 "underline_titles" => p.underline_titles = if v.trim().eq_ignore_ascii_case("always") { "always" } else { "hover" }.into(),
                 "show_recent" => p.show_recent = parse_bool(v).unwrap_or(p.show_recent),
                 "show_frequent" => p.show_frequent = parse_bool(v).unwrap_or(p.show_frequent),
@@ -537,6 +537,8 @@ mod tests {
         assert!(p.show_recent && p.show_frequent && p.show_status && p.preview_handlers && p.search_system);
         assert!(!p.item_checkboxes && !p.search_archives);
         assert_eq!(Profile::from_section("x", &[("underline_titles".into(), "junk".into())]).underline_titles, "hover");
+        let hover = |v: &str| Profile::from_section("x", &[("hover_preview_ms".into(), v.into())]).hover_preview_ms;
+        assert_eq!((hover("5"), hover("1500"), hover("999999"), hover("junk")), (200, 1500, 10000, 2000));
     }
 
     #[test]
diff --git a/crates/core/src/usn.rs b/crates/core/src/usn.rs
index 4135606..04d1bdc 100644
--- a/crates/core/src/usn.rs
+++ b/crates/core/src/usn.rs
@@ -4,6 +4,7 @@ use std::ffi::c_void;
 use std::mem::size_of;
 use std::path::PathBuf;
 use std::ptr;
+use std::sync::atomic::{AtomicBool, Ordering};
 
 use windows::Win32::Foundation::{CloseHandle, ERROR_HANDLE_EOF, HANDLE};
 use windows::Win32::Storage::FileSystem::{
@@ -147,11 +148,12 @@ impl VolumeIndex {
         None
     }
 
-    /// Case-insensitive substring match on file names; at most `limit` resolvable paths.
-    pub fn search(&self, needle: &str, limit: usize) -> Vec<PathBuf> {
+    /// Case-insensitive substring match on file names; at most `limit` resolvable paths. Setting `cancel` ends the scan.
+    pub fn search(&self, needle: &str, limit: usize, cancel: &AtomicBool) -> Vec<PathBuf> {
         let needle = needle.to_lowercase();
         self.entries
             .iter()
+            .take_while(|_| !cancel.load(Ordering::Relaxed))
             .filter(|(_, e)| e.name.to_lowercase().contains(&needle))
             .filter_map(|(&frn, _)| self.path_of(frn))
             .take(limit)
@@ -216,6 +218,14 @@ mod tests {
         }
         let idx = build('C').unwrap();
         assert!(idx.len() > 10_000);
-        assert!(!idx.search("notepad.exe", 5).is_empty());
+        assert!(!idx.search("notepad.exe", 5, &AtomicBool::new(false)).is_empty());
+    }
+
+    #[test]
+    fn search_stops_when_cancelled() {
+        let entries = HashMap::from([(5, Entry { parent: 5, name: String::new() }), (10, Entry { parent: 5, name: "a".into() })]);
+        let idx = VolumeIndex { drive: 'C', entries };
+        assert_eq!(idx.search("a", 5, &AtomicBool::new(false)), vec![PathBuf::from("C:\\a")]);
+        assert!(idx.search("a", 5, &AtomicBool::new(true)).is_empty());
     }
 }
diff --git a/scripts/bench-vs-explorer.ps1 b/scripts/bench-vs-explorer.ps1
index 7e485a4..142b46e 100644
--- a/scripts/bench-vs-explorer.ps1
+++ b/scripts/bench-vs-explorer.ps1
@@ -237,13 +237,12 @@ try {
   foreach ($c in $cases) { Write-Host "creating $($c.n) files ..."; New-Files (Join-Path $Work $c.dir) $c.n }
   Write-Host "creating $navN files ..."; New-Files (Join-Path $Work "files-$navN") $navN
 
-  # rexplorer's first run writes settings and exports about 560 icons for ten seconds; let that finish so the
-  # measured runs see a settled profile, as a user's would.
+  # rexplorer's first run writes settings and the starter icons; let that finish so the measured runs see a
+  # settled profile, as a user's would.
   Write-Host 'rexplorer first run on the scratch profile ...'
-  $marker = Join-Path $RexAppData 'rexplorer\icons\default\system-icons.txt'
+  $marker = Join-Path $RexAppData 'rexplorer\icons\default\folder.png'
   $first = [Diagnostics.Process]::Start((Start-Rex (Join-Path $Work $cases[0].dir)))
-  try { for ($i = 0; $i -lt 120 -and -not (Test-Path $marker); $i++) { Start-Sleep -Milliseconds 500 } } finally { try { $first.Kill(); $first.WaitForExit(3000) | Out-Null } catch {} }
-  if (-not (Test-Path $marker)) { throw 'rexplorer did not finish its first-run icon export within 60 s' }
+  try { for ($i = 0; $i -lt 20 -and -not (Test-Path $marker); $i++) { Start-Sleep -Milliseconds 500 } } finally { try { $first.Kill(); $first.WaitForExit(3000) | Out-Null } catch {} }
   Start-Sleep -Milliseconds 700
 
   foreach ($c in $cases) {