diff --git a/AGENTS.md b/AGENTS.md
index 9c78d49..9573c28 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -81,11 +81,12 @@ Run `just ci` before claiming anything done.
   already there, including a symlink — so nothing planted in the download
   directory is ever followed or overwritten.
 - **Every translatable string is a literal.** `tests/i18n.test.js`
-  (`tests/support/i18n.js`'s `nonLiteralGettextCalls`) fails if any `_()`
-  call's message, or either of `_n()`'s two arguments, is a variable,
-  property access or template rather than a string literal — invisible to
-  `xgettext -k_ -k_n:1,2` exactly the same way a translator would never
-  see it.
+  (`tests/support/i18n.js`'s `nonLiteralGettextCalls`) reads the source of
+  every file under `modules/`, `prefs.js` and `extension.js`, and fails if
+  any `_()` call's message, or either of `_n()`'s two arguments, is a
+  variable, property access or template rather than a string literal —
+  invisible to `xgettext -k_ -k_n:1,2` exactly the same way a translator
+  would never see it.
 - **No JavaScript on the docs pages.** `docs/index.html` ships no
   `<script>`; `just test-docs` fails the build if one appears.
 - **The shared template files are byte-locked.** Everything in
@@ -98,11 +99,12 @@ Run `just ci` before claiming anything done.
 
 Write the failing test first (RED → GREEN). Layers:
 
-- **Vitest** (`just test`) — every module under `modules/`, `extension.js`
-  and `prefs.js` run exactly as shipped. `prefs.js` (Adw/Gtk widget
+- **Vitest** (`just test`) — every module under `modules/` except
+  `io.js`, and `extension.js`, run exactly as shipped; `prefs.js` is
+  excluded and imported by no test. `prefs.js` (Adw/Gtk widget
   construction) and `modules/io.js` (Soup/Gio plumbing, checked instead
-  against the real daemon) are excluded from coverage — identically in
-  `vitest.config.js` and `sonar-project.properties`. Stubs for `gi://` and
+  against the real daemon) are excluded from coverage — identically in `vitest.config.js`
+  and `sonar-project.properties`. Stubs for `gi://` and
   `resource:///` imports live in `tests/stubs/`; a fake daemon and a small
   fake Shell world are in `tests/support/`.
 - **`just localapi-check`** (`scripts/localapi-check.js`, under plain
@@ -181,10 +183,10 @@ and `tests/support/world.js` (`tests/support/actors.js` is template-locked).
 ## Settings keys
 
 `modules/settings.js` is the single source of truth: `KEYS` (the schema
-key names), `SHORTCUT_KEYS` (the one accelerator key), and `SETTINGS` (each
-key's gschema type plus the untranslated label and detail text `prefs.js`
-builds every row from). It imports nothing, so `tests/settings.test.js`
-checks it on plain Node against the gschema.
+key names), `SHORTCUT_KEYS` (the one accelerator key), `SETTINGS` (each
+key's gschema type), and `settingText` (the label and detail `prefs.js`
+builds every row from, each a literal `_()` call). It imports nothing, so
+`tests/settings.test.js` checks it on plain Node against the gschema.
 
 Adding, renaming or removing a setting means updating all three together,
 in this order, or the cross-check test fails:
@@ -192,11 +194,11 @@ in this order, or the cross-check test fails:
 1. `schemas/org.gnome.shell.extensions.quickts.gschema.xml` — the type,
    default, summary and description (and `<range>` for `max-menu-height`,
    currently 0–2000).
-2. `modules/settings.js` — the key constant, its `SETTINGS` entry, and any
-   place in `modules/panel.js` or `prefs.js` that reads it through `KEYS`
-   or `SHORTCUT_KEYS`.
+2. `modules/settings.js` — the key constant, its `SETTINGS` entry, its
+   `settingText` case, and any place in `modules/panel.js` or `prefs.js`
+   that reads it through `KEYS` or `SHORTCUT_KEYS`.
 3. `prefs.js` — only if the widget it needs is not already covered by
-   `describe()`'s label/detail lookup (`Adw.SpinRow` needs its own
+   `settingText`'s label/detail lookup (`Adw.SpinRow` needs its own
    `Gtk.Adjustment` bounds, kept equal to the gschema's `<range>`).
 
 `AdvertiseRoutes` (the advertised-subnets row in preferences) is
diff --git a/README.md b/README.md
index f7a76d7..809710c 100644
--- a/README.md
+++ b/README.md
@@ -20,8 +20,9 @@ testing, packaging and releasing.
 sudo tailscale set --operator=$USER
 ```
 
-Without that, the daemon refuses the socket and QuickTS says so in the menu
-rather than showing a tailnet that is silently disconnected.
+Without it the daemon refuses every change with a `403`. QuickTS says so in
+the menu and offers the command, rather than leaving a switch that silently
+flips back.
 
 ## Install
 
diff --git a/docs/index.html b/docs/index.html
index c1cbca8..cebdfa7 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1179,9 +1179,13 @@ <h2 id="keyboard-title">Keyboard</h2>
                         </tbody>
                     </table>
                     <p>
-                        A bare key, or one with only <kbd class="kbd">Shift</kbd>, is
-                        not accepted: it would be taken from every application. The
-                        shortcut does nothing on the lock screen or the login screen.
+                        A bare key is not accepted: it would be taken from every
+                        application. <kbd class="kbd">Shift</kbd> alone is accepted only
+                        with a key that types nothing, such as
+                        <kbd class="kbd">Shift</kbd>+<kbd class="kbd">F5</kbd>;
+                        <kbd class="kbd">Shift</kbd>+<kbd class="kbd">A</kbd> is how a
+                        capital A is typed. The shortcut does nothing on the lock screen
+                        or the login screen.
                     </p>
                     <p>
                         It is stored under <code>quickts-open-menu</code>. The prefix
@@ -1420,7 +1424,7 @@ <h3>Every module</h3>
                                     <code>menu-items.js</code>,
                                     <code>navigable-section.js</code>,
                                     <code>ping.js</code>, <code>settings.js</code>,
-                                    <code>taildrop.js</code>
+                                    <code>taildrop.js</code>, <code>text.js</code>
                                 </td>
                             </tr>
                             <tr>
@@ -1429,7 +1433,9 @@ <h3>Every module</h3>
                                     Why a request to tailscaled failed, as a
                                     <code>REASON</code> value rather than a string.
                                 </td>
-                                <td data-label="Imports" class="muted">—</td>
+                                <td data-label="Imports" class="muted">
+                                    <code>text.js</code>
+                                </td>
                             </tr>
                             <tr>
                                 <td data-label="Module">
@@ -1443,7 +1449,7 @@ <h3>Every module</h3>
                                 <td data-label="Imports" class="muted">
                                     <code>menu-items.js</code>, <code>mullvad.js</code>,
                                     <code>navigable-section.js</code>,
-                                    <code>settings.js</code>
+                                    <code>settings.js</code>, <code>text.js</code>
                                 </td>
                             </tr>
                             <tr>
@@ -1499,7 +1505,8 @@ <h3>Every module</h3>
                                     menu shares.
                                 </td>
                                 <td data-label="Imports" class="muted">
-                                    <code>errors.js</code>, <code>warnings.js</code>
+                                    <code>errors.js</code>, <code>text.js</code>,
+                                    <code>warnings.js</code>
                                 </td>
                             </tr>
                             <tr>
@@ -1552,7 +1559,8 @@ <h3>Every module</h3>
                                     <code>health.js</code>, <code>layout.js</code>,
                                     <code>menu-items.js</code>, <code>routes.js</code>,
                                     <code>settings.js</code>,
-                                    <code>taildrop-section.js</code>
+                                    <code>taildrop-section.js</code>,
+                                    <code>text.js</code>
                                 </td>
                             </tr>
                             <tr>
@@ -1626,7 +1634,7 @@ <h3>Every module</h3>
                                 </td>
                                 <td data-label="Imports" class="muted">
                                     <code>inbox.js</code>, <code>menu-items.js</code>,
-                                    <code>taildrop.js</code>
+                                    <code>taildrop.js</code>, <code>text.js</code>
                                 </td>
                             </tr>
                             <tr>
@@ -1638,6 +1646,15 @@ <h3>Every module</h3>
                                     <code>collate.js</code>
                                 </td>
                             </tr>
+                            <tr>
+                                <td data-label="Module"><code>text.js</code></td>
+                                <td data-label="Job">
+                                    Fills a translated sentence's <code>%s</code> and
+                                    <code>%d</code> in order, without reading
+                                    <code>$</code> patterns in the values.
+                                </td>
+                                <td data-label="Imports" class="muted">—</td>
+                            </tr>
                             <tr>
                                 <td data-label="Module"><code>timing.js</code></td>
                                 <td data-label="Job">
diff --git a/modules/device-section.js b/modules/device-section.js
index 71b6320..32c32b0 100644
--- a/modules/device-section.js
+++ b/modules/device-section.js
@@ -17,6 +17,7 @@ import {
     problemMessage,
 } from './menu-items.js';
 import { NavigableSection } from './navigable-section.js';
+import { fill } from './text.js';
 
 /** The device submenu. */
 export class DeviceSection {
@@ -52,8 +53,7 @@ export class DeviceSection {
                 this._visibleNodes(state).find(node => node.id === id) ?? null,
             detailTitle: node => node.name,
             renderList: (menu, state, open) => this._renderDevices(menu, state, open),
-            renderDetail: (menu, node, state) =>
-                this._renderDeviceActions(menu, node, state),
+            renderDetail: (menu, node) => this._renderDeviceActions(menu, node),
         });
     }
 
@@ -113,16 +113,11 @@ export class DeviceSection {
      *
      * @param {object} menu The submenu to fill.
      * @param {object} node A normalized node.
-     * @param {object} state A snapshot.
      */
-    _renderDeviceActions(menu, node, state) {
+    _renderDeviceActions(menu, node) {
         const { _ } = this._i18n;
 
         const address = node.ips.at(0) ?? '';
-        const fqdn =
-            node.name && state.magicDNSSuffix
-                ? `${node.name}.${state.magicDNSSuffix}`
-                : node.name;
 
         if (address === '') {
             addDisabledRow(menu, _('No address'));
@@ -147,12 +142,12 @@ export class DeviceSection {
             this,
         );
 
-        if (fqdn && fqdn !== node.name) {
+        if (node.dnsName) {
             addRow(
                 menu,
                 _('Copy DNS name'),
                 'edit-copy-symbolic',
-                () => copyText(fqdn, this._gicon, this._i18n),
+                () => copyText(node.dnsName, this._gicon, this._i18n),
                 this,
             );
         }
@@ -228,12 +223,10 @@ export class DeviceSection {
 function formatPing(result, { _ }) {
     const latency = String(result.latencyMs);
 
-    if (result.route === ROUTE.DIRECT) return _('%s ms, direct').replace('%s', latency);
+    if (result.route === ROUTE.DIRECT) return fill(_('%s ms, direct'), latency);
     if (result.route === ROUTE.RELAY && result.relay)
-        return _('%s ms, relayed via %s')
-            .replace('%s', latency)
-            .replace('%s', result.relay);
-    if (result.route === ROUTE.RELAY) return _('%s ms, relayed').replace('%s', latency);
+        return fill(_('%s ms, relayed via %s'), latency, result.relay);
+    if (result.route === ROUTE.RELAY) return fill(_('%s ms, relayed'), latency);
 
-    return _('%s ms').replace('%s', latency);
+    return fill(_('%s ms'), latency);
 }
diff --git a/modules/errors.js b/modules/errors.js
index 1ee569a..50a74d2 100644
--- a/modules/errors.js
+++ b/modules/errors.js
@@ -1,11 +1,16 @@
 // What went wrong talking to tailscaled, as a value rather than a string.
 //
-// This file imports nothing. modules/io.js is the only place that can tell a
-// Gio.IOErrorEnum apart from an HTTP status, because it is the only place with
-// Gio in scope, so it does that translation and throws one of these. Everything
-// downstream — the reducer, the menu, the tests — reasons about the symbol.
+// This file imports nothing but modules/text.js, which imports nothing
+// either. modules/io.js is the only place with Gio and Soup in scope, so it
+// reads the code off a GError, or the status off an answer, and hands it
+// here, with Gio.IOErrorEnum passed in rather than imported; the reason is
+// decided here and io.js throws it. Everything downstream — the reducer, the
+// menu, the tests — reasons about the symbol.
 //
-// The division is deliberate: io.js knows Gio, this file knows what to say.
+// The division is deliberate: io.js knows Gio and Soup, this file knows what
+// they mean.
+
+import { fill } from './text.js';
 
 /**
  * Why a request failed.
@@ -18,12 +23,18 @@ export const REASON = Object.freeze({
     SOCKET_MISSING: 'socket-missing',
     /** The socket exists but nothing is listening. The daemon is stopped. */
     CONNECTION_REFUSED: 'connection-refused',
-    /** The socket refused us. Almost always the operator is not set. */
+    /**
+     * The daemon answered 401 or 403, or the socket itself refused us. Almost
+     * always the operator is not set: without it the daemon refuses every
+     * change with a 403.
+     */
     PERMISSION_DENIED: 'permission-denied',
     /** The daemon answered, with a status we cannot use. */
     HTTP: 'http',
     /** The daemon answered with something that is not what it claimed to be. */
     PROTOCOL: 'protocol',
+    /** A file here could not be written: a full disk, an unwritable directory. */
+    LOCAL_FILE: 'local-file',
     /** Anything else. */
     UNKNOWN: 'unknown',
 });
@@ -60,39 +71,81 @@ export function reasonOf(error) {
     return error?.name === 'TransportError' ? error.reason : REASON.UNKNOWN;
 }
 
-/** The one command that fixes a permission failure. */
-const OPERATOR_COMMAND = 'sudo tailscale set --operator=$USER';
-
 /**
- * What to tell the user, untranslated.
+ * The reason to report for a failed Gio operation.
  *
- * Untranslated because this file may not import gettext — the same rule that
- * keeps it importable from Vitest. modules/panel.js runs the result through _().
+ * A socket and a file fail with the same codes and mean different things by
+ * them. NOT_FOUND is no daemon on the one and no download directory on the
+ * other; PERMISSION_DENIED is a missing operator on the one and a directory
+ * this user cannot write on the other. Only the caller knows which it was
+ * talking to, so it says.
  *
- * PERMISSION_DENIED is the one that earns its place. The daemon returns 403 to
- * a user who is not the tailscale operator, and an empty, apparently
- * disconnected menu would leave no way to discover that one command fixes it.
+ * Gio.IOErrorEnum is passed in, as prefs.js passes its Gtk values to
+ * modules/shortcuts.js, so this stays importable on plain Node.
  *
- * @param {string} reason One of {@link REASON}.
- * @returns {string} A sentence for the menu.
+ * @param {number|null} code The GError's code, or null when the error is not
+ *   one of Gio.IOErrorEnum's.
+ * @param {object} IOErrorEnum Gio.IOErrorEnum.
+ * @param {object} [where] What the failed operation touched.
+ * @param {boolean} [where.local] A file on this machine.
+ * @param {boolean} [where.remote] The daemon: its socket, or a stream from it.
+ * @returns {string} One of {@link REASON}.
  */
-export function messageFor(reason) {
-    switch (reason) {
-        case REASON.SOCKET_MISSING:
-            return 'Tailscale is not installed, or has never been started.';
-        case REASON.CONNECTION_REFUSED:
-            return 'The Tailscale daemon is not running.';
-        case REASON.PERMISSION_DENIED:
-            return `Not permitted. Run: ${OPERATOR_COMMAND}`;
-        case REASON.HTTP:
-            return 'The Tailscale daemon refused the request.';
-        case REASON.PROTOCOL:
-            return 'The Tailscale daemon sent an unexpected response.';
+export function reasonForIoError(
+    code,
+    IOErrorEnum,
+    { local = false, remote = true } = {},
+) {
+    // Creating a file touches nothing else, so whatever failed, it was the file.
+    if (local && !remote) return REASON.LOCAL_FILE;
+
+    // A copy from the daemon's stream into a file. The connection is already
+    // open by then, so these can only be the file's; the rest are the stream's.
+    const fileSystem = [
+        IOErrorEnum.NO_SPACE,
+        IOErrorEnum.READ_ONLY,
+        IOErrorEnum.PERMISSION_DENIED,
+        IOErrorEnum.NOT_FOUND,
+    ];
+    if (local && fileSystem.includes(code)) return REASON.LOCAL_FILE;
+
+    switch (code) {
+        case IOErrorEnum.NOT_FOUND:
+            return REASON.SOCKET_MISSING;
+        case IOErrorEnum.CONNECTION_REFUSED:
+            return REASON.CONNECTION_REFUSED;
+        case IOErrorEnum.PERMISSION_DENIED:
+            return REASON.PERMISSION_DENIED;
         default:
-            return 'Could not reach the Tailscale daemon.';
+            return REASON.UNKNOWN;
     }
 }
 
+const UNAUTHORIZED = 401;
+const FORBIDDEN = 403;
+
+/**
+ * The reason to report for an HTTP status the daemon answered with.
+ *
+ * 403 is the interesting one: it is what tailscaled returns to a user who is
+ * not the tailscale operator, and it is the single most common reason this
+ * extension appears to do nothing at all.
+ *
+ * @param {number} status The HTTP status.
+ * @returns {string|null} One of {@link REASON}, or null for a 2xx, which is
+ *   an answer to use rather than a failure.
+ */
+export function reasonForStatus(status) {
+    if (status >= 200 && status < 300) return null;
+
+    return status === UNAUTHORIZED || status === FORBIDDEN
+        ? REASON.PERMISSION_DENIED
+        : REASON.HTTP;
+}
+
+/** The one command that fixes a permission failure. */
+const OPERATOR_COMMAND = 'sudo tailscale set --operator=$USER';
+
 /**
  * Whether the reason is something the user can act on.
  *
@@ -111,7 +164,7 @@ export function isActionable(reason) {
  * The shell command that fixes the reason, if one does.
  *
  * The command is data, so it is returned as data. It used to be recovered in
- * modules/panel.js by running a regular expression over the prose above —
+ * modules/panel.js by running a regular expression over the message prose —
  * which meant a reason whose message names no command (SOCKET_MISSING is
  * actionable and names none) copied a whole English sentence to the clipboard,
  * and rewording a message here broke the clipboard silently.
@@ -122,3 +175,42 @@ export function isActionable(reason) {
 export function commandFor(reason) {
     return reason === REASON.PERMISSION_DENIED ? OPERATOR_COMMAND : '';
 }
+
+/**
+ * The sentence for a failure, translated.
+ *
+ * The wording is chosen here, a whole literal sentence per case inside its own
+ * `_()`, where xgettext can see every one of them. Handing gettext a sentence
+ * composed at run time asks it for a msgid no translator was ever given.
+ *
+ * gettext is passed in rather than imported, which keeps this file importable
+ * on plain Node and from prefs.js, which cannot reach the Shell's modules — so
+ * the preferences window words a failure exactly as the menu does.
+ *
+ * PERMISSION_DENIED is the one that earns its place. The daemon refuses every
+ * change with a 403 from a user who is not the tailscale operator, and a
+ * switch that just flips back would leave no way to discover that one command
+ * fixes it.
+ *
+ * @param {string} reason One of {@link REASON}.
+ * @param {Function} _ gettext.
+ * @returns {string} A sentence for the menu.
+ */
+export function problemMessage(reason, _) {
+    switch (reason) {
+        case REASON.SOCKET_MISSING:
+            return _('Tailscale is not installed, or has never been started.');
+        case REASON.CONNECTION_REFUSED:
+            return _('The Tailscale daemon is not running.');
+        case REASON.PERMISSION_DENIED:
+            return fill(_('Not permitted. Run: %s'), commandFor(reason));
+        case REASON.HTTP:
+            return _('The Tailscale daemon refused the request.');
+        case REASON.PROTOCOL:
+            return _('The Tailscale daemon sent an unexpected response.');
+        case REASON.LOCAL_FILE:
+            return _('Could not save the file.');
+        default:
+            return _('Could not reach the Tailscale daemon.');
+    }
+}
diff --git a/modules/exit-node-section.js b/modules/exit-node-section.js
index 619d676..92ccd34 100644
--- a/modules/exit-node-section.js
+++ b/modules/exit-node-section.js
@@ -10,6 +10,7 @@ import { cityOf, groupByCountry, partitionMullvad } from './mullvad.js';
 import { KEYS } from './settings.js';
 import { ActionMenuItem, addRow } from './menu-items.js';
 import { NavigableSection } from './navigable-section.js';
+import { fill } from './text.js';
 
 /** The exit node submenu. */
 export class ExitNodeSection {
@@ -108,7 +109,7 @@ export class ExitNodeSection {
         if (this._suggestion && !state.exitNodeId) {
             addRow(
                 menu,
-                _('Suggested: %s').replace('%s', this._suggestion.name),
+                fill(_('Suggested: %s'), this._suggestion.name),
                 'starred-symbolic',
                 () => void this._model.setExitNode(this._suggestion.id),
                 this,
@@ -223,7 +224,7 @@ export class ExitNodeSection {
  * @returns {string} A label.
  */
 function exitNodeLabel(state, { _ }) {
-    if (state.exitNodeName) return _('Exit node: %s').replace('%s', state.exitNodeName);
+    if (state.exitNodeName) return fill(_('Exit node: %s'), state.exitNodeName);
 
     return state.exitNodeId ? _('Exit node: automatic') : _('Exit node');
 }
diff --git a/modules/health.js b/modules/health.js
index f0b28d0..a00887a 100644
--- a/modules/health.js
+++ b/modules/health.js
@@ -14,7 +14,7 @@
 //
 // This file imports only other pure modules.
 
-import { REASON, commandFor, isActionable, messageFor } from './errors.js';
+import { REASON, commandFor, isActionable } from './errors.js';
 import { BACKEND } from './state.js';
 
 /** How many health warnings to show before summarizing the rest. */
@@ -153,16 +153,16 @@ export function summaryOf(state) {
 /**
  * The message for an unreachable daemon, and whether it is worth a row of its own.
  *
- * A permission failure is the one worth interrupting for: tailscaled answers
- * 403 to anyone who is not the tailscale operator, and one command fixes it —
- * a command nobody would otherwise discover from an empty menu.
+ * A permission failure is the one worth interrupting for: tailscaled refuses
+ * every change with a 403 from anyone who is not the tailscale operator, and
+ * one command fixes it — a command nobody would otherwise discover from a
+ * switch that just flips back.
  *
  * @param {object} state A snapshot.
- * @returns {{reason: string, message: string, command: string, actionable: boolean}|null}
+ * @returns {{reason: string, command: string, actionable: boolean}|null}
  *   `reason` is untranslated, a REASON from modules/errors.js — the key
- *   modules/menu-items.js's problemMessage switches on to translate it.
- *   `message` is messageFor(reason)'s own composed English. The command that
- *   fixes it if there is one, or null if the daemon is reachable.
+ *   modules/errors.js's problemMessage switches on to translate it. The
+ *   command that fixes it if there is one, or null if the daemon is reachable.
  */
 export function problemOf(state) {
     if (state.reachable) return null;
@@ -171,7 +171,6 @@ export function problemOf(state) {
 
     return {
         reason,
-        message: messageFor(reason),
         command: commandFor(reason),
         actionable: isActionable(reason),
     };
diff --git a/modules/io.js b/modules/io.js
index a5242bb..52a6c4e 100644
--- a/modules/io.js
+++ b/modules/io.js
@@ -5,9 +5,14 @@
 // tailscaled, with no compositor in the loop — the only check that catches
 // Tailscale changing its JSON.
 //
-// It makes no decisions. Every path, body, delay and retry is computed by a
-// pure module and handed here to be carried out. If a branch worth testing ever
-// appears below, it belongs in modules/localapi.js, modules/timing.js or
+// It makes no decisions of its own. Every path and body, whether an answer is
+// JSON, what a Gio error or an HTTP status means, every delay and every retry
+// is computed by a pure module and handed here to be carried out. What is left
+// is the Soup and Gio calls, reading back what they report, and naming the few
+// failures only this file can see: no socket, a file name the sender should
+// not have chosen, a body that is not the JSON it claimed to be, no free file
+// name. If a branch worth testing ever appears below, it belongs in
+// modules/localapi.js, modules/errors.js, modules/timing.js or
 // modules/reconnect.js instead — which is also why this file is excluded from
 // coverage, with the reasoning recorded in vitest.config.js.
 
@@ -16,9 +21,15 @@ import GLib from 'gi://GLib';
 import Soup from 'gi://Soup?version=3.0';
 
 import { CanceledError } from './cancel.js';
-import { REASON, TransportError } from './errors.js';
+import { REASON, TransportError, reasonForIoError, reasonForStatus } from './errors.js';
 import { candidateNames, isSafeFileName } from './inbox.js';
-import { HOST, SOCKET_PATHS, pickSocket } from './localapi.js';
+import {
+    HOST,
+    JSON_TYPE,
+    SOCKET_PATHS,
+    isJsonContentType,
+    pickSocket,
+} from './localapi.js';
 
 // Promisified once, at module scope, because gnome-shell caches ESM modules for
 // the life of the session — so this runs exactly once however many times the
@@ -35,8 +46,6 @@ Gio._promisify(Gio.OutputStream.prototype, 'splice_async', 'splice_finish');
 const decoder = new TextDecoder();
 const encoder = new TextEncoder();
 
-const JSON_TYPE = 'application/json';
-
 const PORTAL_BUS = 'org.freedesktop.portal.Desktop';
 const PORTAL_PATH = '/org/freedesktop/portal/desktop';
 const FILE_CHOOSER = 'org.freedesktop.portal.FileChooser';
@@ -49,25 +58,26 @@ const REQUEST = 'org.freedesktop.portal.Request';
  * is also where a canceled operation stops looking like a failure. Getting
  * that wrong would make every disable() log an error.
  *
+ * Which reason a Gio code stands for is modules/errors.js's reasonForIoError;
+ * this only reads the code off the GError.
+ *
  * @param {unknown} error Caught value.
+ * @param {{local?: boolean, remote?: boolean}} [where] What the failed
+ *   operation touched, as reasonForIoError takes it. The daemon by default.
  * @returns {Error} A CanceledError or a TransportError.
  */
-function translate(error) {
+function translate(error, where = {}) {
     if (error?.name === 'CanceledError' || error?.name === 'TransportError')
         return error;
 
-    if (error instanceof Gio.IOErrorEnum || typeof error?.matches === 'function') {
-        if (error.matches?.(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED))
-            return new CanceledError();
-        if (error.matches?.(Gio.IOErrorEnum, Gio.IOErrorEnum.NOT_FOUND))
-            return transportError(REASON.SOCKET_MISSING, error);
-        if (error.matches?.(Gio.IOErrorEnum, Gio.IOErrorEnum.CONNECTION_REFUSED))
-            return transportError(REASON.CONNECTION_REFUSED, error);
-        if (error.matches?.(Gio.IOErrorEnum, Gio.IOErrorEnum.PERMISSION_DENIED))
-            return transportError(REASON.PERMISSION_DENIED, error);
-    }
+    // GJS gives every Error a matches(), which is false for anything but a
+    // GError of that domain — so a plain exception gets no code at all.
+    if (error?.matches?.(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED))
+        return new CanceledError();
+
+    const code = error?.matches?.(Gio.IOErrorEnum, error.code) ? error.code : null;
 
-    return transportError(REASON.UNKNOWN, error);
+    return transportError(reasonForIoError(code, Gio.IOErrorEnum, where), error);
 }
 
 /**
@@ -108,21 +118,15 @@ function describeError(error) {
 /**
  * Turn a non-2xx answer into an error carrying a reason.
  *
- * 403 is the interesting one: it is what tailscaled returns to a user who is
- * not the tailscale operator, and it is the single most common reason this
- * extension appears to do nothing at all.
+ * Which reason is modules/errors.js's reasonForStatus.
  *
  * @param {Soup.Message} message Message that has been sent.
  * @returns {TransportError|null} An error, or null if the answer was usable.
  */
 function statusError(message) {
     const status = message.get_status();
-    if (status >= 200 && status < 300) return null;
-
-    const reason =
-        status === Soup.Status.FORBIDDEN || status === Soup.Status.UNAUTHORIZED
-            ? REASON.PERMISSION_DENIED
-            : REASON.HTTP;
+    const reason = reasonForStatus(status);
+    if (reason === null) return null;
 
     return new TransportError(reason, `HTTP ${status} ${message.get_reason_phrase()}`, {
         status,
@@ -132,6 +136,8 @@ function statusError(message) {
 /**
  * Decode a response body according to what the daemon said it is.
  *
+ * Whether that is JSON is modules/localapi.js's isJsonContentType.
+ *
  * @param {Soup.Message} message Message that has been sent.
  * @param {Uint8Array} bytes Raw body.
  * @returns {unknown} Parsed JSON, or the text.
@@ -139,13 +145,8 @@ function statusError(message) {
 function decode(message, bytes) {
     const text = decoder.decode(bytes);
 
-    // Prefix, not equality: a Content-Type may carry parameters, and
-    // "application/json; charset=utf-8" compared for equality would make every
-    // response decode as a raw string. The reducer would then read undefined
-    // off it everywhere and the menu would go blank while still reporting
-    // itself reachable, with nothing logged.
-    const contentType = message.response_headers.get_one('Content-Type') ?? '';
-    if (!contentType.split(';', 1)[0].trim().startsWith(JSON_TYPE)) return text;
+    if (!isJsonContentType(message.response_headers.get_one('Content-Type')))
+        return text;
 
     try {
         return JSON.parse(text);
@@ -272,6 +273,13 @@ export function createIo({ token }) {
             // Either timeout would tear it down on a quiet tailnet.
             timeout: 0,
             'idle-timeout': 0,
+            // libsoup allows two connections per host by default, and the
+            // bus holds one for as long as the extension is enabled. One
+            // more long request — a Taildrop send, a slow ping — then took
+            // the other, and every read queued behind it. There is only one
+            // host, the socket, so both limits are the same number.
+            'max-conns-per-host': 8,
+            'max-conns': 8,
         });
         return session;
     };
@@ -614,22 +622,30 @@ export function createIo({ token }) {
                         );
                         break;
                     } catch (error) {
+                        // Only the file was involved, so any other failure
+                        // is the file's, never the daemon's.
                         if (!error?.matches?.(Gio.IOErrorEnum, Gio.IOErrorEnum.EXISTS))
-                            throw error;
+                            throw translate(error, { local: true, remote: false });
                         file = null;
                     }
                 }
 
                 if (!output)
-                    throw new TransportError(REASON.UNKNOWN, 'no free file name');
+                    throw new TransportError(REASON.LOCAL_FILE, 'no free file name');
 
-                await output.splice_async(
-                    input,
-                    Gio.OutputStreamSpliceFlags.CLOSE_SOURCE |
-                        Gio.OutputStreamSpliceFlags.CLOSE_TARGET,
-                    GLib.PRIORITY_DEFAULT,
-                    cancellable,
-                );
+                // From the daemon's stream into the file, so a failure may be
+                // either's; reasonForIoError tells them apart by the code.
+                try {
+                    await output.splice_async(
+                        input,
+                        Gio.OutputStreamSpliceFlags.CLOSE_SOURCE |
+                            Gio.OutputStreamSpliceFlags.CLOSE_TARGET,
+                        GLib.PRIORITY_DEFAULT,
+                        cancellable,
+                    );
+                } catch (error) {
+                    throw translate(error, { local: true });
+                }
 
                 return file.get_path();
             } catch (error) {
diff --git a/modules/localapi.js b/modules/localapi.js
index 1c969d1..5316c3b 100644
--- a/modules/localapi.js
+++ b/modules/localapi.js
@@ -26,6 +26,9 @@ export const SOCKET_PATHS = Object.freeze([
 
 const BASE = '/localapi/v0';
 
+/** The media type the daemon answers in, and QuickTS sends a body in. */
+export const JSON_TYPE = 'application/json';
+
 /**
  * The first socket path that exists.
  *
@@ -37,6 +40,22 @@ export function pickSocket(paths, exists) {
     return paths.find(path => exists(path)) ?? null;
 }
 
+/**
+ * Whether an answer's Content-Type says its body is JSON.
+ *
+ * A prefix, not equality: a Content-Type may carry parameters, and
+ * "application/json; charset=utf-8" compared for equality would make every
+ * response decode as a raw string. The reducer would then read undefined off
+ * it everywhere and the menu would go blank while still reporting itself
+ * reachable, with nothing logged.
+ *
+ * @param {string|null} contentType The Content-Type header, or null if none.
+ * @returns {boolean} True if the body should be parsed as JSON.
+ */
+export function isJsonContentType(contentType) {
+    return (contentType ?? '').split(';', 1)[0].trim().startsWith(JSON_TYPE);
+}
+
 /**
  * Percent-encode one path segment.
  *
diff --git a/modules/menu-items.js b/modules/menu-items.js
index 530a6ad..b6cdd4c 100644
--- a/modules/menu-items.js
+++ b/modules/menu-items.js
@@ -12,9 +12,14 @@ import St from 'gi://St';
 import * as Main from 'resource:///org/gnome/shell/ui/main.js';
 import * as PopupMenu from 'resource:///org/gnome/shell/ui/popupMenu.js';
 
-import { REASON, commandFor } from './errors.js';
+import { fill } from './text.js';
 import { describeWarning } from './warnings.js';
 
+// The sentence for a daemon problem lives in modules/errors.js, where prefs.js
+// can reach it too; it is offered from here with the rest of what the menu
+// sections build their rows from.
+export { problemMessage } from './errors.js';
+
 /**
  * A row that acts without closing the menu.
  *
@@ -105,38 +110,7 @@ export function copyText(text, gicon, { _ }) {
     clipboard.set_text(St.ClipboardType.CLIPBOARD, text);
     clipboard.set_text(St.ClipboardType.PRIMARY, text);
 
-    showOsd(gicon, _('Copied %s').replace('%s', text));
-}
-
-/**
- * The sentence for a daemon problem, translated.
- *
- * modules/errors.js decides the reason; the wording is chosen here, next to
- * gettext, where a translator sees a whole, literal sentence per case.
- * Passing modules/errors.js's own messageFor(reason) straight to `_()` — what
- * this replaced, in modules/panel.js and modules/taildrop-section.js — asks
- * gettext to translate a sentence composed at run time, which is never a
- * literal in the source and so is invisible to xgettext.
- *
- * @param {string} reason One of REASON from modules/errors.js.
- * @param {Function} _ gettext.
- * @returns {string} A sentence for the menu.
- */
-export function problemMessage(reason, _) {
-    switch (reason) {
-        case REASON.SOCKET_MISSING:
-            return _('Tailscale is not installed, or has never been started.');
-        case REASON.CONNECTION_REFUSED:
-            return _('The Tailscale daemon is not running.');
-        case REASON.PERMISSION_DENIED:
-            return _('Not permitted. Run: %s').replace('%s', commandFor(reason));
-        case REASON.HTTP:
-            return _('The Tailscale daemon refused the request.');
-        case REASON.PROTOCOL:
-            return _('The Tailscale daemon sent an unexpected response.');
-        default:
-            return _('Could not reach the Tailscale daemon.');
-    }
+    showOsd(gicon, fill(_('Copied %s'), text));
 }
 
 /**
diff --git a/modules/model.js b/modules/model.js
index 4ab5b2b..b1473dc 100644
--- a/modules/model.js
+++ b/modules/model.js
@@ -38,9 +38,11 @@ import {
 } from './localapi.js';
 import { runWithReconnect } from './reconnect.js';
 import {
+    applyChangeError,
     applyError,
     applyPrefs,
     applyProfiles,
+    applyRefusal,
     applyStatus,
     changed,
     initialState,
@@ -56,6 +58,22 @@ import { backoffDelay, flushDelay } from './timing.js';
 /** How long a peer list may go unread while the menu is closed. */
 export const PEERS_STALE_MS = 60000;
 
+/**
+ * The reasons a failed change still marks the daemon unreachable.
+ *
+ * Any other reason means the daemon answered: it refused the change, or said
+ * something unusable about it, and is plainly still there. PERMISSION_DENIED
+ * is answered too, but it is the missing operator, and the operator row that
+ * only an unreachable daemon shows is how anyone finds the command that fixes
+ * it.
+ */
+const UNREACHABLE = new Set([
+    REASON.SOCKET_MISSING,
+    REASON.CONNECTION_REFUSED,
+    REASON.UNKNOWN,
+    REASON.PERMISSION_DENIED,
+]);
+
 /** The store. One per enable/disable lifetime. */
 export class TailscaleModel {
     #client;
@@ -385,27 +403,27 @@ export class TailscaleModel {
 
     // ---- commands ---------------------------------------------------------
 
-    /** @param {boolean} value Whether the tailnet should be up. @returns {Promise<void>} Done. */
+    /** @param {boolean} value Whether the tailnet should be up. @returns {Promise<{error: string}>} See #patch. */
     setRunning(value) {
         return this.#patch({ WantRunning: Boolean(value) });
     }
 
-    /** @param {boolean} value Accept subnet routes. @returns {Promise<void>} Done. */
+    /** @param {boolean} value Accept subnet routes. @returns {Promise<{error: string}>} See #patch. */
     setAcceptRoutes(value) {
         return this.#patch({ RouteAll: Boolean(value) });
     }
 
-    /** @param {boolean} value Use the tailnet's DNS. @returns {Promise<void>} Done. */
+    /** @param {boolean} value Use the tailnet's DNS. @returns {Promise<{error: string}>} See #patch. */
     setAcceptDNS(value) {
         return this.#patch({ CorpDNS: Boolean(value) });
     }
 
-    /** @param {boolean} value Reach the LAN while using an exit node. @returns {Promise<void>} Done. */
+    /** @param {boolean} value Reach the LAN while using an exit node. @returns {Promise<{error: string}>} See #patch. */
     setAllowLanAccess(value) {
         return this.#patch({ ExitNodeAllowLANAccess: Boolean(value) });
     }
 
-    /** @param {boolean} value Block incoming connections. @returns {Promise<void>} Done. */
+    /** @param {boolean} value Block incoming connections. @returns {Promise<{error: string}>} See #patch. */
     setShieldsUp(value) {
         return this.#patch({ ShieldsUp: Boolean(value) });
     }
@@ -419,7 +437,7 @@ export class TailscaleModel {
      * withdraw a subnet this machine is routing for.
      *
      * @param {boolean} value Whether to advertise as an exit node.
-     * @returns {Promise<void>} Done.
+     * @returns {Promise<{error: string}>} See #patch.
      */
     setRunExitNode(value) {
         return this.#patch({
@@ -427,7 +445,7 @@ export class TailscaleModel {
         });
     }
 
-    /** @param {boolean} value Run the Tailscale SSH server. @returns {Promise<void>} Done. */
+    /** @param {boolean} value Run the Tailscale SSH server. @returns {Promise<{error: string}>} See #patch. */
     setSsh(value) {
         return this.#patch({ RunSSH: Boolean(value) });
     }
@@ -436,7 +454,7 @@ export class TailscaleModel {
      * Route through a peer, or stop doing so.
      *
      * @param {string} id Node id, or '' to use no exit node.
-     * @returns {Promise<void>} Done.
+     * @returns {Promise<{error: string}>} See #patch.
      */
     setExitNode(id) {
         return this.#patch({ ExitNodeID: id ?? '' });
@@ -497,17 +515,37 @@ export class TailscaleModel {
      * is also why a user-initiated change has no bus latency: the round trip
      * that applies it is the same one that reports it.
      *
+     * A change the daemon answered and refused leaves it reachable: one
+     * refused change is not evidence that the daemon has gone. It is recorded
+     * with applyRefusal instead; any other failure marks the daemon
+     * unreachable, through applyChangeError. Both count the failed change,
+     * and that count is what sets a switch the user flipped back to the
+     * preference that still holds — even when nothing else in the state
+     * moved, as when the daemon was already unreachable for the same reason.
+     *
      * @param {Record<string, unknown>} changes Preferences to set.
-     * @returns {Promise<void>} Done.
+     * @returns {Promise<{error: string}>} '' once applied, or canceled;
+     *   otherwise the REASON it failed with.
      */
     async #patch(changes) {
-        if (this.#disposed) return;
+        if (this.#disposed) return { error: '' };
 
         try {
             const prefs = await this.#request(patchPrefsRequest(changes));
             this.#commit(applyPrefs(this.#state, prefs));
+
+            return { error: '' };
         } catch (error) {
-            this.#fail(error);
+            if (isCanceled(error)) return { error: '' };
+
+            const reason = reasonOf(error);
+            this.#commit(
+                UNREACHABLE.has(reason)
+                    ? applyChangeError(this.#state, reason)
+                    : applyRefusal(this.#state, reason),
+            );
+
+            return { error: reason };
         }
     }
 
diff --git a/modules/panel.js b/modules/panel.js
index 20eca16..3f88993 100644
--- a/modules/panel.js
+++ b/modules/panel.js
@@ -48,6 +48,7 @@ import {
 import { ExitNodeSection } from './exit-node-section.js';
 import { DeviceSection } from './device-section.js';
 import { InboxSection, SendSection } from './taildrop-section.js';
+import { fill } from './text.js';
 
 /** The tile's own icon, next to the clock. */
 const QuickTSIndicator = GObject.registerClass(
@@ -124,6 +125,11 @@ const QuickTSToggle = GObject.registerClass(
                 (_menu, open) => this._onOpenStateChanged(open),
                 this,
             );
+
+            // A plain connect, as ButtonBox does: connectObject with this as
+            // its own owner could be released by the destroy it is meant to
+            // handle.
+            this.connect('destroy', () => this._onDestroy());
         }
 
         /** Build the sections once; their contents are refilled on each change. */
@@ -227,7 +233,10 @@ const QuickTSToggle = GObject.registerClass(
 
                 // The switch reports what the user asked for; the daemon's
                 // answer comes back through the model and is what finally
-                // sets the state. A refused change therefore reverts.
+                // sets the state. A refused change therefore reverts: the
+                // model counts every failed change, so even one that moves
+                // nothing else is a change, and _syncOptions sets the switch
+                // back from the preferences that still hold.
                 item.connectObject(
                     'toggled',
                     (_item, value) => void apply(value),
@@ -260,9 +269,18 @@ const QuickTSToggle = GObject.registerClass(
             this.subtitle = subtitleFor(state, this._i18n);
             this.menu.setHeader(this._gicon, _('Tailscale'), this.subtitle);
 
+            // A login asked for is over once none is needed, however it went
+            // through. Left set, the next AuthURL for any reason at all — a
+            // reauth hours later — opens a browser nobody asked for.
+            if (!needsLogin(state)) this._loginRequested = false;
             this._maybeOpenAuthUrl(state);
 
-            if (moved('reachable') || moved('errorReason') || moved('backendState'))
+            if (
+                moved('reachable') ||
+                moved('errorReason') ||
+                moved('refusedReason') ||
+                moved('backendState')
+            )
                 this._syncProblems(state);
 
             if (moved('health')) this._syncWarnings(state);
@@ -326,6 +344,10 @@ const QuickTSToggle = GObject.registerClass(
                 else item.setSensitive(false);
 
                 this._problems.addMenuItem(item);
+            } else if (state.refusedReason) {
+                // A change the daemon answered and refused. The switch has
+                // already been set back by _syncOptions; this says why.
+                addDisabledRow(this._problems, problemMessage(state.refusedReason, _));
             }
 
             if (needsLogin(state)) {
@@ -355,9 +377,9 @@ const QuickTSToggle = GObject.registerClass(
             this._warnings.visible = total > 0;
             if (total === 0) return;
 
-            this._warnings.label.text = _n('%d warning', '%d warnings', total).replace(
-                '%d',
-                String(total),
+            this._warnings.label.text = fill(
+                _n('%d warning', '%d warnings', total),
+                total,
             );
 
             for (const line of lines) this._warnings.menu.addMenuItem(warningRow(line));
@@ -368,7 +390,7 @@ const QuickTSToggle = GObject.registerClass(
             if (hidden > 0)
                 addDisabledRow(
                     this._warnings.menu,
-                    _n('%d more', '%d more', hidden).replace('%d', String(hidden)),
+                    fill(_n('%d more', '%d more', hidden), hidden),
                 );
         }
 
@@ -549,7 +571,9 @@ const QuickTSToggle = GObject.registerClass(
             this._laterId = 0;
         }
 
-        destroy() {
+        // From the destroy signal rather than a destroy() override, which an
+        // actor destroyed from C never calls.
+        _onDestroy() {
             // Invalidates any async handler still waiting — a ping, a Taildrop
             // listing — so it cannot write into the rows about to be torn down.
             this._deviceSection.destroy();
@@ -577,7 +601,6 @@ const QuickTSToggle = GObject.registerClass(
             // open-state-changed closure that still reaches this toggle, the
             // model and the transport.
             this.menu.destroy();
-            super.destroy();
         }
     },
 );
@@ -734,11 +757,9 @@ function subtitleFor(state, { _, _n }) {
             return _('Off');
         case SUMMARY.EXIT_NODE:
             // An automatic exit node has an id but no name to show.
-            return value
-                ? _('via %s').replace('%s', String(value))
-                : _('via an exit node');
+            return value ? fill(_('via %s'), value) : _('via an exit node');
         case SUMMARY.WARNINGS:
-            return _n('%d warning', '%d warnings', value).replace('%d', String(value));
+            return fill(_n('%d warning', '%d warnings', value), value);
         default:
             return String(value ?? '');
     }
diff --git a/modules/peers.js b/modules/peers.js
index f3bd8e6..9e74360 100644
--- a/modules/peers.js
+++ b/modules/peers.js
@@ -122,6 +122,12 @@ export function normalizePeer(peer, { exitNodeId = '', magicDNSSuffix = '' } = {
         isMullvad: isMullvad(peer),
         location: peer?.Location ?? null,
 
+        // The daemon's own name for the node, for copying. Not rebuilt from
+        // the display name and this tailnet's suffix: a node shared in from
+        // another tailnet, or one of Mullvad's, lives under a suffix of its
+        // own. Empty when the daemon gives none.
+        dnsName: String(peer?.DNSName ?? '').replace(/\.$/, ''),
+
         // Carried through as the daemon's own number; modules/taildrop.js is
         // where it becomes a decision and a reason.
         taildropTarget:
diff --git a/modules/settings.js b/modules/settings.js
index a6debd9..7127615 100644
--- a/modules/settings.js
+++ b/modules/settings.js
@@ -27,39 +27,64 @@ export const SHORTCUT_KEYS = Object.freeze({
 });
 
 /**
- * Every key in the schema, with its type and an untranslated label.
+ * Every key in the schema, with its type.
  *
- * The labels live here rather than in prefs.js so that this file remains the
- * one place a key is described; prefs.js builds every row from this list and
- * applies gettext at row-build time. Spelling a title out again in prefs.js
- * is how the two drifted apart before.
+ * tests/settings.test.js checks this list against the gschema, and that
+ * settingText() has words for every key in it.
  */
 export const SETTINGS = Object.freeze([
-    Object.freeze({
-        key: KEYS.SHOW_OFFLINE_NODES,
-        type: 'b',
-        label: 'Show offline devices',
-        detail: 'List devices that are not currently reachable.',
-    }),
-    Object.freeze({
-        key: KEYS.SHOW_MULLVAD,
-        type: 'b',
-        label: 'Show Mullvad exit nodes',
-        detail: 'Grouped by country. A tailnet with Mullvad has thousands.',
-    }),
-    Object.freeze({
-        key: KEYS.MAX_MENU_HEIGHT,
-        type: 'i',
-        label: 'Maximum height',
-        detail: 'Pixels. Zero uses whatever room the screen leaves below it.',
-    }),
-    Object.freeze({
-        key: SHORTCUT_KEYS.OPEN_MENU,
-        type: 'as',
-        label: 'Open the menu',
-        detail: 'Unbound by default, so it cannot collide with a GNOME shortcut.',
-    }),
+    Object.freeze({ key: KEYS.SHOW_OFFLINE_NODES, type: 'b' }),
+    Object.freeze({ key: KEYS.SHOW_MULLVAD, type: 'b' }),
+    Object.freeze({ key: KEYS.MAX_MENU_HEIGHT, type: 'i' }),
+    Object.freeze({ key: SHORTCUT_KEYS.OPEN_MENU, type: 'as' }),
 ]);
 
 /** Just the keys, in schema order. */
 export const ALL_KEYS = Object.freeze(SETTINGS.map(setting => setting.key));
+
+/**
+ * What the preferences window calls a key, translated.
+ *
+ * The wording lives here rather than in prefs.js so that this file remains the
+ * one place a key is described; spelling a title out again in prefs.js is how
+ * the two drifted apart before. Each string is a literal inside its own `_()`,
+ * the same pattern as modules/errors.js's problemMessage: prefs.js used to
+ * pass this list's own English to `_()`, and xgettext never sees a variable.
+ *
+ * gettext is passed in, so this file still imports nothing.
+ *
+ * @param {string} key A key from KEYS or SHORTCUT_KEYS.
+ * @param {Function} _ gettext.
+ * @returns {{label: string, detail: string}} The row's title and subtitle,
+ *   both empty for a key this file does not know.
+ */
+export function settingText(key, _) {
+    switch (key) {
+        case KEYS.SHOW_OFFLINE_NODES:
+            return {
+                label: _('Show offline devices'),
+                detail: _('List devices that are not currently reachable.'),
+            };
+        case KEYS.SHOW_MULLVAD:
+            return {
+                label: _('Show Mullvad exit nodes'),
+                detail: _('Grouped by country. A tailnet with Mullvad has thousands.'),
+            };
+        case KEYS.MAX_MENU_HEIGHT:
+            return {
+                label: _('Maximum height'),
+                detail: _(
+                    'Pixels. Zero uses whatever room the screen leaves below it.',
+                ),
+            };
+        case SHORTCUT_KEYS.OPEN_MENU:
+            return {
+                label: _('Open the menu'),
+                detail: _(
+                    'Unbound by default, so it cannot collide with a GNOME shortcut.',
+                ),
+            };
+        default:
+            return { label: '', detail: '' };
+    }
+}
diff --git a/modules/shortcuts.js b/modules/shortcuts.js
index c7dc0f4..63db194 100644
--- a/modules/shortcuts.js
+++ b/modules/shortcuts.js
@@ -23,19 +23,41 @@ export const CAPTURE_IGNORE = 'ignore';
 /** Bind the combination and close. */
 export const CAPTURE_ASSIGN = 'assign';
 
+/**
+ * Whether a key's own code point types something visible.
+ *
+ * Control characters (Tab, Return, Delete, and the function keys, which carry
+ * no code point at all) type nothing, which is what makes Shift+F5 bindable
+ * where Shift+A is not: Shift+A is how a capital A is typed.
+ *
+ * @param {number} codePoint The character the key types on its own, as
+ *   Gdk.keyval_to_unicode gives it; 0 or negative for none.
+ * @returns {boolean} True if the key types a visible character.
+ */
+function typesVisibly(codePoint) {
+    return codePoint > 0 && !/\p{Cc}/u.test(String.fromCodePoint(codePoint));
+}
+
 /**
  * Whether a captured combination may be bound as a global shortcut.
  *
- * A bare key would steal it from every application, and Shift alone just types
- * a capital letter.
+ * A bare key would steal it from every application. Shift alone is bindable
+ * only when the key types nothing on its own, close to GNOME Settings' rule.
  *
  * @param {number} mask Modifier mask, already reduced to the default mod mask.
  * @param {number} keyval Key value.
- * @param {{shiftMask: number, acceleratorValid: Function}} gtk Gdk/Gtk values.
+ * @param {{shiftMask: number, acceleratorValid: Function, codePoint: number}} gtk
+ *   Gdk/Gtk values. codePoint is the character the key types on its own, as
+ *   Gdk.keyval_to_unicode gives it.
  * @returns {boolean} True if the combination may be bound.
  */
-export function isValidBinding(mask, keyval, { shiftMask, acceleratorValid }) {
-    if (mask === 0 || mask === shiftMask) return false;
+export function isValidBinding(
+    mask,
+    keyval,
+    { shiftMask, acceleratorValid, codePoint },
+) {
+    if (mask === 0) return false;
+    if (mask === shiftMask && typesVisibly(codePoint)) return false;
 
     return acceleratorValid(keyval, mask);
 }
@@ -49,7 +71,7 @@ export function isValidBinding(mask, keyval, { shiftMask, acceleratorValid }) {
  * @param {number} keyval Key value.
  * @param {number} mask Modifier mask, reduced to the default mod mask.
  * @param {object} gtk Gdk/Gtk values: escapeKey, backspaceKey, shiftMask,
- *   acceleratorValid.
+ *   acceleratorValid, and the key's codePoint.
  * @returns {string} One of the CAPTURE_* outcomes.
  */
 export function captureOutcome(keyval, mask, gtk) {
diff --git a/modules/state.js b/modules/state.js
index dfbc433..f8e0623 100644
--- a/modules/state.js
+++ b/modules/state.js
@@ -28,6 +28,14 @@ export function initialState() {
         reachable: false,
         errorReason: '',
 
+        // Why the daemon, reachable, last refused a change. Set only for a
+        // refusal; an unreachable daemon is errorReason's to report.
+        refusedReason: '',
+        // Every change that failed, refused or unreachable alike. The count is
+        // what makes a failure that leaves every other field as it was a
+        // change of its own; see applyRefusal() and applyChangeError().
+        refusedCount: 0,
+
         // From /status.
         backendState: BACKEND.NO_STATE,
         authUrl: '',
@@ -85,8 +93,14 @@ function derive(state) {
             : { ...node, isExitNode: node.id !== '' && node.id === state.exitNodeId },
     );
 
-    // Re-sorted because the exit node sorts first, and it may have moved.
-    const nodes = sortNodes(marked);
+    // Re-sorted because the exit node sorts first, and it may have moved —
+    // but only if a node was re-marked. The nodes arrive sorted, from
+    // normalizePeers or from the last derive, and nothing else here moves
+    // one, so an unchanged list is kept as the same array: no sort, and
+    // changed() can settle 'nodes' by identity.
+    const nodes = marked.every((node, index) => node === state.nodes.at(index))
+        ? state.nodes
+        : sortNodes(marked);
 
     return Object.freeze({
         ...state,
@@ -147,6 +161,8 @@ export function applyPrefs(state, prefs) {
         ...state,
         reachable: true,
         errorReason: '',
+        // The daemon's current answer; a refusal before it is no longer news.
+        refusedReason: '',
 
         running: prefs?.WantRunning === true,
         acceptRoutes: prefs?.RouteAll === true,
@@ -217,6 +233,54 @@ export function applyError(state, reason) {
         ...state,
         reachable: false,
         errorReason: reason || REASON.UNKNOWN,
+        // A refusal from before contact was lost is stale; kept, it would
+        // come back with the first status read after reconnecting.
+        refusedReason: '',
+    });
+}
+
+/**
+ * Record that the daemon refused a change.
+ *
+ * It answered, so it is still reachable and everything already read still
+ * holds; the change just did not happen. The menu sets a flipped switch back
+ * from the unchanged preferences whenever it is told something moved, so the
+ * count moves on every failed change: a second refusal with the same reason
+ * would otherwise change nothing, tell nobody, and leave the switch showing
+ * what the daemon refused.
+ *
+ * @param {object} state Current state.
+ * @param {string} reason One of {@link REASON}.
+ * @returns {object} A new state.
+ */
+export function applyRefusal(state, reason) {
+    return derive({
+        ...state,
+        refusedReason: reason || REASON.UNKNOWN,
+        refusedCount: state.refusedCount + 1,
+    });
+}
+
+/**
+ * Record a change that failed because the daemon could not be reached.
+ *
+ * applyError, with the change counted as applyRefusal counts one, in a single
+ * snapshot so subscribers hear about it once. The count matters most when the
+ * daemon was already unreachable for the same reason — a stopped tailscaled,
+ * a user who is not the operator — because then nothing else moves, and
+ * without it the switch that was flipped would stay flipped.
+ *
+ * @param {object} state Current state.
+ * @param {string} reason One of {@link REASON}.
+ * @returns {object} A new state.
+ */
+export function applyChangeError(state, reason) {
+    return derive({
+        ...state,
+        reachable: false,
+        errorReason: reason || REASON.UNKNOWN,
+        refusedReason: '',
+        refusedCount: state.refusedCount + 1,
     });
 }
 
@@ -253,6 +317,8 @@ export function changed(previous, next) {
 const SCALARS = Object.freeze([
     ['reachable', s => s.reachable],
     ['errorReason', s => s.errorReason],
+    ['refusedReason', s => s.refusedReason],
+    ['refusedCount', s => s.refusedCount],
     ['backendState', s => s.backendState],
     ['authUrl', s => s.authUrl],
     ['magicDNSSuffix', s => s.magicDNSSuffix],
@@ -268,10 +334,12 @@ const SCALARS = Object.freeze([
     ['currentProfileId', s => s.currentProfileId],
 ]);
 
-// All three list comparisons are the same shape — equal lengths, then
-// element-wise — so only the per-element test is written out.
+// All three list comparisons are the same shape — the same array, or equal
+// lengths and then element-wise — so only the per-element test is written
+// out.
 const sameBy = (a, b, equal) =>
-    a.length === b.length && a.every((value, index) => equal(value, b.at(index)));
+    a === b ||
+    (a.length === b.length && a.every((value, index) => equal(value, b.at(index))));
 
 const sameStrings = (a, b) => sameBy(a, b, (value, other) => value === other);
 
@@ -280,7 +348,8 @@ const sameStrings = (a, b) => sameBy(a, b, (value, other) => value === other);
 // CountryCode off the second to label and group the country list. Leaving
 // them out meant a node moving city, or gaining the Mullvad tag, produced no
 // 'nodes' field and so no redraw — a menu left quietly stale with nothing
-// logged.
+// logged. dnsName likewise: it decides whether "Copy DNS name" is offered and
+// what it copies.
 const sameNodes = (a, b) =>
     sameBy(
         a,
@@ -296,7 +365,8 @@ const sameNodes = (a, b) =>
             node.isMullvad === other.isMullvad &&
             node.location?.City === other.location?.City &&
             node.location?.CountryCode === other.location?.CountryCode &&
-            node.ips.at(0) === other.ips.at(0),
+            node.ips.at(0) === other.ips.at(0) &&
+            node.dnsName === other.dnsName,
     );
 
 const sameProfiles = (a, b) =>
diff --git a/modules/taildrop-section.js b/modules/taildrop-section.js
index 18a8d7e..df4fc4f 100644
--- a/modules/taildrop-section.js
+++ b/modules/taildrop-section.js
@@ -17,6 +17,7 @@ import {
     unlistedReason,
 } from './taildrop.js';
 import { ActionMenuItem, problemMessage, showOsd } from './menu-items.js';
+import { fill } from './text.js';
 
 /**
  * Why a node cannot receive a file, translated.
@@ -149,7 +150,7 @@ export class SendSection {
         // first means nobody picks files for a send that cannot happen.
         if (!isListedTarget(await this._model.fileTargets(), node.id)) {
             Main.notify(
-                _('Cannot send to %s').replace('%s', node.name),
+                fill(_('Cannot send to %s'), node.name),
                 _('Tailscale does not list it as able to receive files right now.'),
             );
             return;
@@ -158,7 +159,7 @@ export class SendSection {
         let uris;
         try {
             uris = await this._chooseFiles({
-                title: _('Send to %s').replace('%s', node.name),
+                title: fill(_('Send to %s'), node.name),
             });
         } catch (error) {
             // The portal rejects when xdg-desktop-portal is not installed
@@ -179,19 +180,21 @@ export class SendSection {
         if (sent > 0)
             showOsd(
                 this._gicon,
-                _n('Sent %d file to %s', 'Sent %d files to %s', sent)
-                    .replace('%d', String(sent))
-                    .replace('%s', node.name),
+                fill(
+                    // Translators: the placeholders are filled in order, the
+                    // count first and then the device name, so keep %d
+                    // before %s.
+                    _n('Sent %d file to %s', 'Sent %d files to %s', sent),
+                    sent,
+                    node.name,
+                ),
             );
 
         // Main.notify, not Main.notifyError: notifyError also copies its
         // text to the journal, and a node name and file names are
         // exactly what SECURITY.md promises stay out of it.
         if (failed.length > 0)
-            Main.notify(
-                _('Could not send to %s').replace('%s', node.name),
-                failed.join(', '),
-            );
+            Main.notify(fill(_('Could not send to %s'), node.name), failed.join(', '));
     }
 }
 
@@ -251,11 +254,10 @@ export class InboxSection {
         this.item.visible = files.length > 0;
         if (!this.item.visible) return;
 
-        this.item.label.text = _n(
-            '%d received file',
-            '%d received files',
+        this.item.label.text = fill(
+            _n('%d received file', '%d received files', files.length),
             files.length,
-        ).replace('%d', String(files.length));
+        );
 
         for (const file of files)
             this.item.menu.addMenuItem(
@@ -281,7 +283,7 @@ export class InboxSection {
         const { _ } = this._i18n;
 
         const generation = this._generation;
-        row.label.text = _('Saving %s…').replace('%s', file.name);
+        row.label.text = fill(_('Saving %s…'), file.name);
         row.setSensitive(false);
 
         const { path, error } = await this._model.saveFile(file.name);
@@ -293,7 +295,7 @@ export class InboxSection {
             return;
         }
 
-        row.label.text = _('Saved to %s').replace('%s', path);
-        showOsd(this._gicon, _('Saved %s').replace('%s', file.name));
+        row.label.text = fill(_('Saved to %s'), path);
+        showOsd(this._gicon, fill(_('Saved %s'), file.name));
     }
 }
diff --git a/modules/text.js b/modules/text.js
new file mode 100644
index 0000000..f52e23e
--- /dev/null
+++ b/modules/text.js
@@ -0,0 +1,26 @@
+// Filling a translated sentence with the values it names.
+//
+// This file imports nothing, so modules/errors.js can use it and still import
+// nothing else, and prefs.js can reach it without the Shell's modules.
+
+/**
+ * Fill a translated template's "%s" and "%d" placeholders, in order.
+ *
+ * Not String.prototype.replace with a string: that reads "$&", "$`" and "$'"
+ * in a value as replacement patterns, and a node or file name is data. A
+ * function replacer inserts each value as it is, and one pass over the
+ * template never rescans a value that itself contains "%s". Each placeholder
+ * past the last value is left as it is.
+ *
+ * The body is the same as QuickClip's and QuickMusic's copies; keep them so.
+ *
+ * @param {string} template Text with zero or more "%s"/"%d" placeholders.
+ * @param {...*} values One value per placeholder, in order.
+ * @returns {string} The filled template.
+ */
+export function fill(template, ...values) {
+    let next = 0;
+    return template.replace(/%[sd]/g, match =>
+        next < values.length ? String(values[next++]) : match,
+    );
+}
diff --git a/prefs.js b/prefs.js
index 7dac6d5..7009ff8 100644
--- a/prefs.js
+++ b/prefs.js
@@ -19,27 +19,18 @@ import {
 } from 'resource:///org/gnome/Shell/Extensions/js/extensions/prefs.js';
 
 import { CancelToken } from './modules/cancel.js';
-import { messageFor, reasonOf } from './modules/errors.js';
+import { problemMessage, reasonOf } from './modules/errors.js';
 import { createIo } from './modules/io.js';
 import { patchPrefsRequest, prefsRequest } from './modules/localapi.js';
 import { parseRoutes, subnetRoutes, withSubnets } from './modules/routes.js';
-import { KEYS, SETTINGS, SHORTCUT_KEYS } from './modules/settings.js';
+import { KEYS, SHORTCUT_KEYS, settingText } from './modules/settings.js';
 import {
     CAPTURE_ASSIGN,
     CAPTURE_CANCEL,
     CAPTURE_CLEAR,
     captureOutcome,
 } from './modules/shortcuts.js';
-
-/**
- * How modules/settings.js describes one key.
- *
- * @param {string} key A key from KEYS or SHORTCUT_KEYS.
- * @returns {{label: string, detail: string}} Its untranslated wording.
- */
-function describe(key) {
-    return SETTINGS.find(setting => setting.key === key);
-}
+import { fill } from './modules/text.js';
 
 // The Gdk and Gtk values modules/shortcuts.js needs. Passed in rather than
 // imported there, so the rules themselves stay testable on plain Node.
@@ -56,31 +47,6 @@ const GTK_BINDING = {
     acceleratorValid: (keyval, mask) => Gtk.accelerator_valid(keyval, mask),
 };
 
-/**
- * Stop GNOME acting on its own shortcuts while one is being captured, so a
- * combination like Super or Print SysRq reaches the capture dialog and can be
- * refused there, instead of opening the overview or taking a screenshot out
- * from under it. gnome-control-center does the same; the Shell may ask the
- * user first the first time an extension asks for this.
- *
- * Same approach as quickclip's prefs.js.
- *
- * @param {Gtk.Widget} widget Any widget belonging to the surface to inhibit —
- *   the capture dialog itself, once presented.
- * @returns {Function} Call once, on every way out, to give the shortcuts back.
- */
-function inhibitSystemShortcuts(widget) {
-    const surface = widget.get_native()?.get_surface();
-    // Only a Gdk.Toplevel surface has these; never let prefs throw without.
-    if (
-        typeof surface?.inhibit_system_shortcuts !== 'function' ||
-        typeof surface.restore_system_shortcuts !== 'function'
-    )
-        return () => {};
-    surface.inhibit_system_shortcuts(null);
-    return () => surface.restore_system_shortcuts();
-}
-
 const ShortcutRow = GObject.registerClass(
     class QuickTSShortcutRow extends Adw.ActionRow {
         /**
@@ -137,10 +103,14 @@ const ShortcutRow = GObject.registerClass(
             const controller = new Gtk.EventControllerKey();
             controller.connect('key-pressed', (_controller, keyval, keycode, state) => {
                 const mask = state & Gtk.accelerator_get_default_mod_mask();
+                const codePoint = Gdk.keyval_to_unicode(keyval);
 
                 // The decision lives in modules/shortcuts.js and is tested
                 // there; this only carries it out on the widgets.
-                const outcome = captureOutcome(keyval, mask, GTK_BINDING);
+                const outcome = captureOutcome(keyval, mask, {
+                    ...GTK_BINDING,
+                    codePoint,
+                });
 
                 if (outcome === CAPTURE_CANCEL) {
                     dialog.close();
@@ -163,13 +133,31 @@ const ShortcutRow = GObject.registerClass(
             });
             dialog.add_controller(controller);
 
-            dialog.present();
+            // Stop GNOME acting on its own shortcuts while one is being
+            // captured, so a combination like Super or Print SysRq reaches
+            // this dialog and can be refused or bound here, instead of opening
+            // the overview or taking a screenshot out from under it. Mutter
+            // runs global keybindings before a focused client sees the key
+            // unless that client's surface inhibits them. gnome-control-center
+            // does the same; the Shell may ask the user first the first time
+            // an extension asks for this.
+            //
+            // Inhibited on map rather than right after present(), because the
+            // surface exists only once the window is realized, and restored on
+            // unmap, so that every way out — Escape, Backspace, an assigned
+            // key, the window's own close button — gives the shortcuts back.
+            // The same timing as QuickTiler's prefs.js.
+            dialog.connect('map', () => {
+                const surface = dialog.get_surface();
+                if (surface instanceof Gdk.Toplevel)
+                    surface.inhibit_system_shortcuts(null);
+            });
+            dialog.connect('unmap', () => {
+                const surface = dialog.get_surface();
+                if (surface instanceof Gdk.Toplevel) surface.restore_system_shortcuts();
+            });
 
-            // 'close-request' fires on every way out: Escape, Backspace and
-            // an assigned key all call dialog.close() above, and so does the
-            // window's own close button.
-            const restore = inhibitSystemShortcuts(dialog);
-            dialog.connect('close-request', () => restore());
+            dialog.present();
         }
     },
 );
@@ -216,7 +204,7 @@ const RoutesRow = GObject.registerClass(
                 this.text = subnetRoutes(prefs.AdvertiseRoutes).join(', ');
             } catch (error) {
                 this.sensitive = false;
-                this._say(_(messageFor(reasonOf(error))));
+                this._say(problemMessage(reasonOf(error), _));
                 console.warn(`[quickts] could not read routes: ${error}`);
             }
         }
@@ -229,7 +217,7 @@ const RoutesRow = GObject.registerClass(
                 // Reported rather than dropped: silently discarding a typo
                 // would leave someone believing a subnet is advertised.
                 this.add_css_class('error');
-                this._say(_('Not a subnet: %s').replace('%s', invalid.join(', ')));
+                this._say(fill(_('Not a subnet: %s'), invalid.join(', ')));
                 return;
             }
 
@@ -247,7 +235,7 @@ const RoutesRow = GObject.registerClass(
                 );
                 this._say(_('Advertised subnets updated'));
             } catch (error) {
-                this._say(_(messageFor(reasonOf(error))));
+                this._say(problemMessage(reasonOf(error), _));
                 console.warn(`[quickts] could not set routes: ${error}`);
             }
         }
@@ -270,10 +258,10 @@ export default class QuickTSPreferences extends ExtensionPreferences {
         // Titled from modules/settings.js, which is where a key is described,
         // and bound the one way every row is bound.
         const addRow = (group, key, row, property) => {
-            const { label, detail } = describe(key);
+            const { label, detail } = settingText(key, _);
 
-            row.title = _(label);
-            row.subtitle = _(detail);
+            row.title = label;
+            row.subtitle = detail;
             settings.bind(key, row, property, Gio.SettingsBindFlags.DEFAULT);
             group.add(row);
         };
@@ -324,12 +312,13 @@ export default class QuickTSPreferences extends ExtensionPreferences {
         page.add(routing);
 
         const shortcut = new Adw.PreferencesGroup({ title: _('Keyboard shortcut') });
+        const openMenu = settingText(SHORTCUT_KEYS.OPEN_MENU, _);
         shortcut.add(
             new ShortcutRow(
                 settings,
                 SHORTCUT_KEYS.OPEN_MENU,
-                _(describe(SHORTCUT_KEYS.OPEN_MENU).label),
-                _(describe(SHORTCUT_KEYS.OPEN_MENU).detail),
+                openMenu.label,
+                openMenu.detail,
             ),
         );
         page.add(shortcut);
diff --git a/scripts/localapi-check.js b/scripts/localapi-check.js
index 6abaceb..c74824c 100644
--- a/scripts/localapi-check.js
+++ b/scripts/localapi-check.js
@@ -268,6 +268,70 @@ async function checkStreamCancels(io, token) {
     }
 }
 
+/**
+ * Wait for a promise, but no longer than `ms`.
+ *
+ * @param {Promise<unknown>} promise What to wait for.
+ * @param {number} ms Milliseconds to allow.
+ * @returns {Promise<{timedOut?: boolean, error?: unknown}>} How it settled.
+ */
+function settleWithin(promise, ms) {
+    return new Promise(resolve => {
+        let id = GLib.timeout_add(GLib.PRIORITY_DEFAULT, ms, () => {
+            id = 0;
+            resolve({ timedOut: true });
+            return GLib.SOURCE_REMOVE;
+        });
+        // After a timeout the promise may still settle, canceled; the source
+        // is gone by then and must not be removed a second time.
+        const settle = outcome => {
+            if (id) GLib.Source.remove(id);
+            id = 0;
+            resolve(outcome);
+        };
+        promise.then(
+            () => settle({}),
+            error => settle({ error }),
+        );
+    });
+}
+
+// The bus holds its connection for as long as the extension is enabled, and
+// libsoup allows two per host by default. One more long request beside it —
+// a Taildrop send, a ping to a peer that never answers — took the other, and
+// every /status behind it waited until that finished. A second bus stands in
+// for that request here, so the check needs no peer and no file.
+async function checkRequestsBesideLongPolls() {
+    const PARALLEL = 4;
+    const token = new CancelToken();
+    const io = createIo({ token });
+
+    const streams = [
+        io.client.stream(watchBusRequest()),
+        io.client.stream(watchBusRequest()),
+    ];
+    // Each holds its connection once the daemon has answered the first line.
+    for (const stream of streams) await stream.next();
+
+    const requests = Promise.all(
+        Array.from({ length: PARALLEL }, () =>
+            io.client.request(statusRequest({ peers: false })),
+        ),
+    );
+    const { timedOut, error } = await settleWithin(requests, 5000);
+    check(
+        !timedOut && !error,
+        `${PARALLEL} parallel /status requests answer beside two open long polls` +
+            (timedOut ? ' (timed out after 5000ms)' : error ? ` (${error})` : ''),
+    );
+
+    // Cancels whatever is still waiting, then lets each stream close its own
+    // input.
+    token.cancel();
+    for (const stream of streams) await stream.return();
+    io.dispose();
+}
+
 // The regression this whole design exists for. Removing the GLib source from
 // disable() while a reconnect loop is awaiting that very timeout means the
 // callback never runs and the promise never settles: the loop, its generator,
@@ -323,6 +387,7 @@ async function main() {
     await checkStreamCancels(io, token);
     io.dispose();
 
+    await checkRequestsBesideLongPolls();
     await checkDelaySettlesOnCancel();
 
     if (failures > 0) {
diff --git a/sonar-project.properties b/sonar-project.properties
index affe365..e423aa4 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -7,6 +7,7 @@ sonar.exclusions=node_modules/**,coverage/**
 
 sonar.javascript.lcov.reportPaths=coverage/lcov.info
 
-# Kept identical to coverage.exclude in vitest.config.js, which carries the
-# reasoning for both.
+# The same two files as coverage.exclude in vitest.config.js, which carries
+# the reasoning for both. That list also has tests/**, which needs no entry
+# here: sonar.sources above leaves it out.
 sonar.coverage.exclusions=prefs.js,modules/io.js
diff --git a/tests/device-section.test.js b/tests/device-section.test.js
index e35b064..9184259 100644
--- a/tests/device-section.test.js
+++ b/tests/device-section.test.js
@@ -153,6 +153,50 @@ describe('devices', () => {
         expect(clipboard.CLIPBOARD).toBe(`laptop.${SUFFIX}`);
     });
 
+    // Rebuilding the name from the display name and this tailnet's suffix
+    // copied a name that resolves nowhere for a node that does not live under
+    // this tailnet's suffix.
+    it.each([
+        [
+            'a node shared in from another tailnet',
+            'laptop.other-tailnet.ts.net.',
+            'laptop.other-tailnet',
+            'laptop.other-tailnet.ts.net',
+        ],
+        [
+            'a Mullvad node',
+            'se-sto-wg-001.mullvad.ts.net.',
+            'se-sto-wg-001.mullvad',
+            'se-sto-wg-001.mullvad.ts.net',
+        ],
+    ])(
+        'copies the DNS name of %s as the daemon gives it',
+        async (_reason, DNSName, name, copied) => {
+            const { panel, model, daemon } = setup();
+            daemon.responses.status.Peer = rawPeerMap(rawPeer({ DNSName }));
+            panel.enable();
+            await model.start();
+            await settle();
+
+            deviceActions(name)
+                .find(item => item.text === 'Copy DNS name')
+                .activate();
+
+            expect(clipboard.CLIPBOARD).toBe(copied);
+        },
+    );
+
+    // Named from its HostName instead, which is no DNS name at all.
+    it('does not offer Copy DNS name for a peer without one', async () => {
+        const { panel, model, daemon } = setup();
+        daemon.responses.status.Peer = rawPeerMap(rawPeer({ DNSName: '' }));
+        panel.enable();
+        await model.start();
+        await settle();
+
+        expect(labelsOf(deviceActions())).not.toContain('Copy DNS name');
+    });
+
     it('does not offer Send files to a device that cannot receive', async () => {
         const { panel, model, daemon } = setup();
         daemon.responses.status.Peer = rawPeerMap(rawPeer({ TaildropTarget: 5 }));
@@ -288,7 +332,7 @@ describe('devices', () => {
         });
 
         // modules/model.js's ping() used to hand this row modules/errors.js's
-        // already-composed English (messageFor(reasonOf(error))), and
+        // already-composed English, and
         // _(result.error) then asked gettext to translate a sentence it can
         // never see when the .pot file is built — only a literal string
         // reaches xgettext. REASON.PERMISSION_DENIED is the one reason whose
diff --git a/tests/errors.test.js b/tests/errors.test.js
index b077abb..b6410c7 100644
--- a/tests/errors.test.js
+++ b/tests/errors.test.js
@@ -3,11 +3,27 @@ import { describe, expect, it } from 'vitest';
 import {
     REASON,
     TransportError,
+    commandFor,
     isActionable,
-    messageFor,
+    problemMessage,
+    reasonForIoError,
+    reasonForStatus,
     reasonOf,
 } from '../modules/errors.js';
 
+// Stand-ins for the Gio.IOErrorEnum codes modules/io.js passes in, with the
+// values GIO gives them.
+const IO = Object.freeze({
+    FAILED: 0,
+    NOT_FOUND: 1,
+    FILENAME_TOO_LONG: 9,
+    NO_SPACE: 12,
+    PERMISSION_DENIED: 14,
+    READ_ONLY: 21,
+    CONNECTION_REFUSED: 39,
+    CONNECTION_CLOSED: 44,
+});
+
 describe('TransportError', () => {
     it('carries its reason and status', () => {
         const error = new TransportError(REASON.HTTP, 'HTTP 500', { status: 500 });
@@ -51,24 +67,40 @@ describe('reasonOf', () => {
     });
 });
 
-describe('messageFor', () => {
-    it('gives every reason a sentence', () => {
-        for (const reason of Object.values(REASON))
-            expect(messageFor(reason)).toMatch(/\S/);
+// Every branch, through a literal _() call per case. Here rather than in
+// modules/menu-items.js so prefs.js, which cannot import the Shell's modules,
+// words a failure the same way the menu does.
+describe('problemMessage', () => {
+    const untranslated = message => message;
+
+    it.each(Object.values(REASON))('says something for %s', reason => {
+        expect(problemMessage(reason, untranslated)).toMatch(/\S/);
     });
 
     // The whole point of classifying at all. tailscaled answers 403 to anyone
     // who is not the operator, and the extension QuickTS replaces logged that
     // to the journal and drew an empty menu — leaving no way to find out that
     // one command fixes it.
-    it('names the command that fixes a permission failure', () => {
-        expect(messageFor(REASON.PERMISSION_DENIED)).toContain(
-            'tailscale set --operator=',
+    it('names the fix-it command for a permission failure', () => {
+        expect(problemMessage(REASON.PERMISSION_DENIED, untranslated)).toContain(
+            commandFor(REASON.PERMISSION_DENIED),
         );
     });
 
-    it('falls back rather than returning nothing for an unknown reason', () => {
-        expect(messageFor('something-new')).toBe(messageFor(REASON.UNKNOWN));
+    it('falls back to the same text as an unrecognized reason', () => {
+        expect(problemMessage('something-new', untranslated)).toBe(
+            problemMessage(REASON.UNKNOWN, untranslated),
+        );
+    });
+
+    it('asks gettext to translate a literal, not the composed sentence', () => {
+        const asked = [];
+        problemMessage(
+            REASON.PERMISSION_DENIED,
+            message => (asked.push(message), message),
+        );
+
+        expect(asked).toEqual(['Not permitted. Run: %s']);
     });
 });
 
@@ -82,10 +114,112 @@ describe('isActionable', () => {
 
     // Telling someone the daemon is unreachable is noise; it belongs in a
     // subtitle, not a row of its own.
-    it.each([[REASON.CONNECTION_REFUSED], [REASON.HTTP], [REASON.UNKNOWN]])(
-        '%s is not',
-        reason => {
-            expect(isActionable(reason)).toBe(false);
-        },
-    );
+    it.each([
+        [REASON.CONNECTION_REFUSED],
+        [REASON.HTTP],
+        [REASON.UNKNOWN],
+        [REASON.LOCAL_FILE],
+    ])('%s is not', reason => {
+        expect(isActionable(reason)).toBe(false);
+    });
+});
+
+describe('commandFor', () => {
+    // No command fixes a full disk or a download directory that is not
+    // writable, and the operator command would be the wrong advice.
+    it('names no command for a local file failure', () => {
+        expect(commandFor(REASON.LOCAL_FILE)).toBe('');
+    });
+});
+
+describe('reasonForIoError', () => {
+    describe('talking to the daemon', () => {
+        it.each([
+            { name: 'NOT_FOUND', code: IO.NOT_FOUND, reason: REASON.SOCKET_MISSING },
+            {
+                name: 'CONNECTION_REFUSED',
+                code: IO.CONNECTION_REFUSED,
+                reason: REASON.CONNECTION_REFUSED,
+            },
+            {
+                name: 'PERMISSION_DENIED',
+                code: IO.PERMISSION_DENIED,
+                reason: REASON.PERMISSION_DENIED,
+            },
+            {
+                name: 'CONNECTION_CLOSED',
+                code: IO.CONNECTION_CLOSED,
+                reason: REASON.UNKNOWN,
+            },
+            { name: 'FAILED', code: IO.FAILED, reason: REASON.UNKNOWN },
+        ])('reports $name as $reason', ({ code, reason }) => {
+            expect(reasonForIoError(code, IO)).toBe(reason);
+        });
+
+        it('reports something that is not an I/O error as unknown', () => {
+            expect(reasonForIoError(null, IO)).toBe(REASON.UNKNOWN);
+        });
+    });
+
+    // Only the file was involved, so whatever went wrong went wrong with the
+    // file. A name too long for the file system is not the daemon missing.
+    describe('creating a local file', () => {
+        it.each([
+            { name: 'NOT_FOUND', code: IO.NOT_FOUND },
+            { name: 'PERMISSION_DENIED', code: IO.PERMISSION_DENIED },
+            { name: 'NO_SPACE', code: IO.NO_SPACE },
+            { name: 'READ_ONLY', code: IO.READ_ONLY },
+            { name: 'FILENAME_TOO_LONG', code: IO.FILENAME_TOO_LONG },
+            { name: 'FAILED', code: IO.FAILED },
+        ])('reports $name as the file', ({ code }) => {
+            expect(reasonForIoError(code, IO, { local: true, remote: false })).toBe(
+                REASON.LOCAL_FILE,
+            );
+        });
+    });
+
+    // A copy from the daemon's stream into the file: the codes only a file
+    // system reports are the file's, and the rest are the stream's.
+    describe('copying from the daemon into a local file', () => {
+        it.each([
+            { name: 'NO_SPACE', code: IO.NO_SPACE },
+            { name: 'READ_ONLY', code: IO.READ_ONLY },
+            { name: 'PERMISSION_DENIED', code: IO.PERMISSION_DENIED },
+            { name: 'NOT_FOUND', code: IO.NOT_FOUND },
+        ])('reports $name as the file, not the daemon', ({ code }) => {
+            expect(reasonForIoError(code, IO, { local: true })).toBe(REASON.LOCAL_FILE);
+        });
+
+        it.each([
+            {
+                name: 'CONNECTION_CLOSED',
+                code: IO.CONNECTION_CLOSED,
+                reason: REASON.UNKNOWN,
+            },
+            {
+                name: 'CONNECTION_REFUSED',
+                code: IO.CONNECTION_REFUSED,
+                reason: REASON.CONNECTION_REFUSED,
+            },
+            { name: 'FAILED', code: IO.FAILED, reason: REASON.UNKNOWN },
+        ])('reports $name as $reason', ({ code, reason }) => {
+            expect(reasonForIoError(code, IO, { local: true })).toBe(reason);
+        });
+    });
+});
+
+describe('reasonForStatus', () => {
+    it.each([200, 204, 299])('takes %i as success', status => {
+        expect(reasonForStatus(status)).toBeNull();
+    });
+
+    // What tailscaled answers a user who is not the operator, and the single
+    // most common reason this extension appears to do nothing at all.
+    it.each([401, 403])('reports %i as a permission failure', status => {
+        expect(reasonForStatus(status)).toBe(REASON.PERMISSION_DENIED);
+    });
+
+    it.each([199, 304, 400, 404, 500, 503])('reports %i as a refusal', status => {
+        expect(reasonForStatus(status)).toBe(REASON.HTTP);
+    });
 });
diff --git a/tests/exit-node-section.test.js b/tests/exit-node-section.test.js
index 87febe7..831fa96 100644
--- a/tests/exit-node-section.test.js
+++ b/tests/exit-node-section.test.js
@@ -1,5 +1,6 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
+import { REASON } from '../modules/errors.js';
 import { KEYS } from '../modules/settings.js';
 import { rawPeer, rawPeerMap, SUFFIX } from './fixtures/peers.js';
 import * as Main from './stubs/shell-main.js';
@@ -101,6 +102,97 @@ describe('the exit node picker', () => {
         expect(daemon.patches.at(-1)).toMatchObject({ ExitNodeID: '' });
     });
 
+    // The row is ticked from the daemon's answer, not from the click, so a
+    // refused choice leaves the node actually in use ticked — and the menu
+    // says why rather than calling the daemon unreachable.
+    describe('a refused choice', () => {
+        const refuse = daemon =>
+            daemon.failures.set('/localapi/v0/prefs', {
+                name: 'TransportError',
+                reason: REASON.HTTP,
+            });
+        const rows = () => toggleOf()._exitNode.menu.items;
+        const choose = name =>
+            rows()
+                .find(item => item.text === name)
+                .activate();
+
+        it('keeps the node in use ticked, and says why', async () => {
+            const { panel, model, daemon } = setup({ seed: withGateway() });
+            panel.enable();
+            await model.start();
+            await settle();
+            refuse(daemon);
+
+            choose('gateway');
+            await settle();
+
+            expect(daemon.patches.at(-1)).toMatchObject({ ExitNodeID: 'nGATE' });
+            expect(rows().find(item => item.text === 'None').icon).toBe(
+                'object-select-symbolic',
+            );
+            expect(rows().find(item => item.text === 'gateway').icon).not.toBe(
+                'object-select-symbolic',
+            );
+            expect(toggleOf()._exitNode.label.text).toBe('Exit node');
+            expect(model.state.reachable).toBe(true);
+            expect(labelsOf(toggleOf()._problems.items)).toEqual([
+                'The Tailscale daemon refused the request.',
+            ]);
+        });
+
+        it('still does after a second identical refusal', async () => {
+            const { panel, model, daemon } = setup({ seed: withGateway() });
+            daemon.responses.prefs.ExitNodeID = 'nGATE';
+            panel.enable();
+            await model.start();
+            await settle();
+            refuse(daemon);
+
+            choose('gateway');
+            await settle();
+            choose('None');
+            await settle();
+
+            expect(daemon.patches).toHaveLength(2);
+            expect(rows().find(item => item.text === 'gateway').icon).toBe(
+                'object-select-symbolic',
+            );
+            expect(toggleOf()._exitNode.label.text).toBe('Exit node: gateway');
+            expect(toggleOf().subtitle).toBe('via gateway');
+            expect(model.state.reachable).toBe(true);
+        });
+
+        // With the daemon already gone, the failure changes nothing but the
+        // count. The menu is still told, and redraws from the node in use.
+        it('re-syncs from the node in use when the daemon is already unreachable', async () => {
+            const { panel, model, daemon } = setup({ seed: withGateway() });
+            daemon.responses.prefs.ExitNodeID = 'nGATE';
+            panel.enable();
+            await model.start();
+            await settle();
+            daemon.failures.set('/localapi/v0/', {
+                name: 'TransportError',
+                reason: REASON.CONNECTION_REFUSED,
+            });
+            await model.refresh();
+            await settle();
+            const sync = vi.spyOn(toggleOf(), 'sync');
+
+            choose('None');
+            await settle();
+
+            expect(daemon.patches.at(-1)).toMatchObject({ ExitNodeID: '' });
+            expect(sync).toHaveBeenCalledTimes(1);
+            expect(sync.mock.calls[0][1]).toEqual(['refusedCount']);
+            expect(rows().find(item => item.text === 'gateway').icon).toBe(
+                'object-select-symbolic',
+            );
+            expect(rows().find(item => item.text === 'None').icon).toBe('');
+            expect(toggleOf()._exitNode.label.text).toBe('Exit node: gateway');
+        });
+    });
+
     describe('Mullvad', () => {
         const mullvadPeer = (id, name, country, code, city) =>
             rawPeer({
diff --git a/tests/health.test.js b/tests/health.test.js
index 745a9b8..d564c64 100644
--- a/tests/health.test.js
+++ b/tests/health.test.js
@@ -208,7 +208,7 @@ describe('problemOf', () => {
         );
 
         expect(problem.actionable).toBe(true);
-        expect(problem.message).toContain('tailscale set --operator=');
+        expect(problem.command).toContain('tailscale set --operator=');
     });
 
     it('does not make noise of an unreachable daemon', () => {
@@ -218,14 +218,9 @@ describe('problemOf', () => {
         ).toBe(false);
     });
 
-    it('still says something with no reason recorded', () => {
-        expect(problemOf(up({ reachable: false, errorReason: '' })).message).toMatch(
-            /\S/,
-        );
-    });
-
-    // modules/menu-items.js's problemMessage switches on this, not on
-    // `message`, to translate the problem row and subtitle.
+    // modules/errors.js's problemMessage switches on this to translate the
+    // problem row and subtitle, and falls back to its own wording for
+    // UNKNOWN, so a problem with no reason recorded still says something.
     it('carries the untranslated reason for a caller to translate itself', () => {
         expect(
             problemOf(up({ reachable: false, errorReason: REASON.PERMISSION_DENIED }))
diff --git a/tests/i18n.test.js b/tests/i18n.test.js
index c03dfbe..2012a9a 100644
--- a/tests/i18n.test.js
+++ b/tests/i18n.test.js
@@ -11,15 +11,18 @@ import { nonLiteralGettextCalls } from './support/i18n.js';
 // from the same wording — would pass those tests even with the bug back:
 // `_(reason)` and `taildropReason(status, _)` show identical text under
 // `gettext: message => message`. Only reading the source tells them apart.
-describe('gettext calls under modules/', () => {
+// prefs.js among them: no test runs it, so this is the only check its strings
+// get, and it used to hand gettext settings labels and composed error
+// sentences that xgettext never sees.
+describe('gettext calls under modules/, prefs.js and extension.js', () => {
     it('never takes a variable, property or template as its message', () => {
         expect(nonLiteralGettextCalls()).toEqual([]);
     });
 });
 
-// A scratch probe over synthetic sources, not modules/ — the scenario above
-// can only prove today's code is clean; it says nothing about whether the
-// checker would catch a regression. `_n()`'s plural argument is pulled out by
+// A scratch probe over synthetic sources, not the shipped files — the
+// scenario above can only prove today's code is clean; it says nothing about
+// whether the checker would catch a regression. `_n()`'s plural argument is pulled out by
 // xgettext (-k_n:1,2) exactly like its first, so a variable there is exactly
 // as invisible, and a checker that only ever looked at the first argument
 // would pass a file with the bug back in it.
diff --git a/tests/localapi.test.js b/tests/localapi.test.js
index 3446cf2..81fafee 100644
--- a/tests/localapi.test.js
+++ b/tests/localapi.test.js
@@ -8,6 +8,7 @@ import {
     currentProfileRequest,
     filePutRequest,
     fileTargetsRequest,
+    isJsonContentType,
     loginRequest,
     patchPrefsRequest,
     pickSocket,
@@ -217,3 +218,23 @@ describe('HOST', () => {
         expect(HOST).toBe('local-tailscaled.sock');
     });
 });
+
+describe('isJsonContentType', () => {
+    // A prefix, not equality: compared whole, a Content-Type with parameters
+    // decoded every response as a raw string, and the menu went blank while
+    // still reporting itself reachable.
+    it.each([
+        'application/json',
+        'application/json; charset=utf-8',
+        ' application/json',
+    ])('reads %j as JSON', contentType => {
+        expect(isJsonContentType(contentType)).toBe(true);
+    });
+
+    it.each(['text/plain; charset=utf-8', 'application/octet-stream', '', null])(
+        'reads %j as text',
+        contentType => {
+            expect(isJsonContentType(contentType)).toBe(false);
+        },
+    );
+});
diff --git a/tests/menu-items.test.js b/tests/menu-items.test.js
index 7579b61..58d8742 100644
--- a/tests/menu-items.test.js
+++ b/tests/menu-items.test.js
@@ -1,35 +1,13 @@
 import { describe, expect, it } from 'vitest';
 
-import { REASON, commandFor } from '../modules/errors.js';
+import { problemMessage as wordedInErrors } from '../modules/errors.js';
 import { problemMessage } from '../modules/menu-items.js';
 
-// Every branch, the same way tests/errors.test.js exercises messageFor's:
-// problemMessage mirrors it, but through a literal _() call per case rather
-// than translating messageFor's own composed English.
+// The wording lives in modules/errors.js, where prefs.js can reach it too, and
+// is tested there. The menu sections take it from here with the rest of what
+// builds their rows, so it has to be the same function, not a second copy.
 describe('problemMessage', () => {
-    it.each(Object.values(REASON))('says something for %s', reason => {
-        expect(problemMessage(reason, message => message)).toMatch(/\S/);
-    });
-
-    it('names the fix-it command for a permission failure', () => {
-        expect(problemMessage(REASON.PERMISSION_DENIED, message => message)).toContain(
-            commandFor(REASON.PERMISSION_DENIED),
-        );
-    });
-
-    it('falls back to the same text as an unrecognized reason', () => {
-        expect(problemMessage('something-new', message => message)).toBe(
-            problemMessage(REASON.UNKNOWN, message => message),
-        );
-    });
-
-    it('asks gettext to translate a literal, not the composed sentence', () => {
-        const asked = [];
-        problemMessage(
-            REASON.PERMISSION_DENIED,
-            message => (asked.push(message), message),
-        );
-
-        expect(asked).toEqual(['Not permitted. Run: %s']);
+    it('is the one modules/errors.js words failures with', () => {
+        expect(problemMessage).toBe(wordedInErrors);
     });
 });
diff --git a/tests/model.test.js b/tests/model.test.js
index 5acc2d5..eaff084 100644
--- a/tests/model.test.js
+++ b/tests/model.test.js
@@ -262,6 +262,8 @@ describe('commands', () => {
         expect(model.state.errorReason).toBe(REASON.HTTP);
     });
 
+    // A 403 is the missing operator, and the operator row is how anyone
+    // finds out, so it still marks the daemon unreachable.
     it('reports a failed command instead of throwing', async () => {
         const { model, daemon } = setup();
         await model.start();
@@ -270,10 +272,130 @@ describe('commands', () => {
             new TransportError(REASON.PERMISSION_DENIED, '403'),
         );
 
-        await expect(model.setRunning(false)).resolves.toBeUndefined();
+        await expect(model.setRunning(false)).resolves.toEqual({
+            error: REASON.PERMISSION_DENIED,
+        });
+        expect(model.state.reachable).toBe(false);
         expect(model.state.errorReason).toBe(REASON.PERMISSION_DENIED);
     });
 
+    it('reports an applied command with no error', async () => {
+        const { model } = setup();
+        await model.start();
+
+        await expect(model.setShieldsUp(true)).resolves.toEqual({ error: '' });
+    });
+
+    // The daemon answered and said no. One refused change is not evidence
+    // that the daemon has gone, and saying so would put "the daemon refused
+    // the request" in place of a menu that is otherwise working.
+    it.each([REASON.HTTP, REASON.PROTOCOL])(
+        'keeps the daemon reachable when a change is refused with %s',
+        async reason => {
+            const { model, daemon } = setup();
+            await model.start();
+            daemon.failures.set('/localapi/v0/prefs', new TransportError(reason, 'no'));
+
+            await expect(model.setShieldsUp(true)).resolves.toEqual({ error: reason });
+            expect(model.state.reachable).toBe(true);
+            expect(model.state.errorReason).toBe('');
+            expect(model.state.refusedReason).toBe(reason);
+            expect(model.state.shieldsUp).toBe(false);
+        },
+    );
+
+    // What sets a flipped switch back is a change the menu hears about. The
+    // second refusal, identical to the first, has to be one too.
+    it('tells subscribers about every refusal, not just the first', async () => {
+        const { model, daemon } = setup();
+        await model.start();
+        daemon.failures.set(
+            '/localapi/v0/prefs',
+            new TransportError(REASON.HTTP, '500'),
+        );
+        const listener = vi.fn();
+        model.subscribe(listener);
+
+        await model.setShieldsUp(true);
+        await model.setShieldsUp(true);
+
+        expect(listener).toHaveBeenCalledTimes(2);
+    });
+
+    // Already unreachable for the same reason, a failed change leaves every
+    // other field as it was. Only its being counted tells the menu to look
+    // again and set back the switch that was flipped.
+    it.each([REASON.CONNECTION_REFUSED, REASON.PERMISSION_DENIED])(
+        'tells subscribers about a change that fails with %s, already recorded',
+        async reason => {
+            const { model, daemon } = setup();
+            await model.start();
+            daemon.failures.set('/localapi/v0/', new TransportError(reason, 'no'));
+            await model.refresh();
+            expect(model.state.errorReason).toBe(reason);
+            const before = model.state.refusedCount;
+            const listener = vi.fn();
+            model.subscribe(listener);
+
+            await expect(model.setShieldsUp(true)).resolves.toEqual({ error: reason });
+
+            expect(listener).toHaveBeenCalledTimes(1);
+            expect(listener.mock.calls[0][1]).toEqual(['refusedCount']);
+            expect(model.state.refusedCount).toBe(before + 1);
+            expect(model.state.reachable).toBe(false);
+            expect(model.state.errorReason).toBe(reason);
+            expect(model.state.refusedReason).toBe('');
+        },
+    );
+
+    // One notification, not two: the error and the count land together.
+    it('tells subscribers once about a change that finds the daemon gone', async () => {
+        const { model, daemon } = setup();
+        await model.start();
+        daemon.failures.set(
+            '/localapi/v0/prefs',
+            new TransportError(REASON.CONNECTION_REFUSED, 'refused'),
+        );
+        const listener = vi.fn();
+        model.subscribe(listener);
+
+        await model.setShieldsUp(true);
+
+        expect(listener).toHaveBeenCalledTimes(1);
+        expect(listener.mock.calls[0][1]).toEqual(
+            expect.arrayContaining(['reachable', 'errorReason', 'refusedCount']),
+        );
+    });
+
+    // A disable in the middle of a change is teardown, not a refusal.
+    it('reports nothing for a change canceled in flight', async () => {
+        const { model, daemon } = setup();
+        await model.start();
+        daemon.failures.set('/localapi/v0/prefs', new CanceledError());
+        const listener = vi.fn();
+        model.subscribe(listener);
+
+        await expect(model.setShieldsUp(true)).resolves.toEqual({ error: '' });
+        expect(listener).not.toHaveBeenCalled();
+        expect(model.state.refusedReason).toBe('');
+    });
+
+    it('clears the refusal once a change goes through', async () => {
+        const { model, daemon } = setup();
+        await model.start();
+        daemon.failures.set(
+            '/localapi/v0/prefs',
+            new TransportError(REASON.HTTP, '500'),
+        );
+        await model.setShieldsUp(true);
+
+        daemon.failures.clear();
+        await model.setShieldsUp(true);
+
+        expect(model.state.refusedReason).toBe('');
+        expect(model.state.shieldsUp).toBe(true);
+    });
+
     it('reads status after a login so the auth URL can arrive', async () => {
         const { model, daemon } = setup();
         await model.start();
@@ -992,12 +1114,30 @@ describe('waiting files', () => {
 
         const result = await model.saveFile('a.txt');
 
-        // Same: the REASON the daemon failure carried, not messageFor's
-        // composed English.
+        // Same: the REASON the daemon failure carried, not composed English.
         expect(result.error).toBe(REASON.HTTP);
         expect(daemon.deleted).toEqual([]);
     });
 
+    // A full disk or an unwritable download directory is not the daemon's
+    // fault, and saying the daemon could not be reached sends someone to
+    // restart a service that is working.
+    it('reports a file it could not write here as a local failure', async () => {
+        const { model, daemon } = setup();
+        await model.start();
+        daemon.failures.set(
+            '/localapi/v0/files/a.txt',
+            new TransportError(REASON.LOCAL_FILE, 'No space left on device'),
+        );
+
+        const result = await model.saveFile('a.txt');
+
+        expect(Object.values(REASON)).toContain(result.error);
+        expect(result.error).toBe(REASON.LOCAL_FILE);
+        expect(daemon.deleted).toEqual([]);
+        expect(model.state.reachable).toBe(true);
+    });
+
     it('reports an unreadable list as nothing waiting', async () => {
         const { model, daemon } = setup();
         await model.start();
diff --git a/tests/panel.test.js b/tests/panel.test.js
index fd16cb7..19bdea8 100644
--- a/tests/panel.test.js
+++ b/tests/panel.test.js
@@ -333,8 +333,8 @@ describe('problems and warnings', () => {
         expect(toggleOf()._problems.items.map(item => item.text)).toContain('Log in…');
     });
 
-    // The problem row and the subtitle both word an unreachable daemon from
-    // modules/errors.js's already-composed English (messageFor), and passing
+    // The problem row and the subtitle both used to word an unreachable
+    // daemon from modules/errors.js's already-composed English, and passing
     // that straight to _() asks gettext to translate a sentence it can never
     // see when the .pot file is built — only a literal string reaches
     // xgettext. Every message this scenario hands to gettext must be one.
@@ -441,6 +441,131 @@ describe('the settings switches', () => {
         expect(rowsNamed(toggleOf(), 'Accept routes').at(0)).toBe(before);
         expect(before._wasDestroyed).toBe(false);
     });
+
+    // A switch moves the moment it is flipped, before the daemon has said
+    // anything. A refused change has to set it back, and say why, without
+    // calling a daemon that answered unreachable.
+    it('set themselves back when the daemon refuses the change', async () => {
+        const { panel, model, daemon } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        const subtitle = toggleOf().subtitle;
+        daemon.failures.set('/localapi/v0/prefs', {
+            name: 'TransportError',
+            reason: REASON.HTTP,
+        });
+
+        const routes = rowsNamed(toggleOf(), 'Accept routes').at(0);
+        routes.toggle();
+        await settle();
+
+        expect(routes.state).toBe(false);
+        expect(model.state.reachable).toBe(true);
+        expect(toggleOf().subtitle).toBe(subtitle);
+        expect(labelsOf(toggleOf()._problems.items)).toEqual([
+            'The Tailscale daemon refused the request.',
+        ]);
+    });
+
+    // The second refusal leaves every preference exactly as the first did.
+    // Only its being counted tells the menu to look again.
+    it('set themselves back after a second identical refusal', async () => {
+        const { panel, model, daemon } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        daemon.failures.set('/localapi/v0/prefs', {
+            name: 'TransportError',
+            reason: REASON.HTTP,
+        });
+
+        const routes = rowsNamed(toggleOf(), 'Accept routes').at(0);
+        routes.toggle();
+        await settle();
+        routes.toggle();
+        await settle();
+
+        expect(daemon.patches).toHaveLength(2);
+        expect(routes.state).toBe(false);
+        expect(labelsOf(toggleOf()._problems.items)).toEqual([
+            'The Tailscale daemon refused the request.',
+        ]);
+    });
+
+    // With the daemon already gone, the failure changes nothing but the
+    // count — and that has to be enough to set the switch back.
+    it('set themselves back when the daemon is already unreachable', async () => {
+        const { panel, model, daemon } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        daemon.failures.set('/localapi/v0/', {
+            name: 'TransportError',
+            reason: REASON.CONNECTION_REFUSED,
+        });
+        await model.refresh();
+        await settle();
+        expect(model.state.errorReason).toBe(REASON.CONNECTION_REFUSED);
+
+        const routes = rowsNamed(toggleOf(), 'Accept routes').at(0);
+        routes.toggle();
+        await settle();
+
+        expect(daemon.patches).toHaveLength(1);
+        expect(routes.state).toBe(false);
+        expect(labelsOf(toggleOf()._problems.items)).toEqual([
+            'The Tailscale daemon is not running.',
+        ]);
+    });
+
+    // Someone who is not the operator gets a 403 for every change. The
+    // second is identical to the first, and has to set the switch back too.
+    it('set themselves back after a second 403', async () => {
+        const { panel, model, daemon } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        daemon.failures.set('/localapi/v0/prefs', {
+            name: 'TransportError',
+            reason: REASON.PERMISSION_DENIED,
+        });
+
+        const routes = rowsNamed(toggleOf(), 'Accept routes').at(0);
+        routes.toggle();
+        await settle();
+        routes.toggle();
+        await settle();
+
+        expect(daemon.patches).toHaveLength(2);
+        expect(routes.state).toBe(false);
+        expect(
+            toggleOf()._problems.items.some(item =>
+                item.text?.includes('tailscale set --operator='),
+            ),
+        ).toBe(true);
+    });
+
+    it('drop the refusal once a change goes through', async () => {
+        const { panel, model, daemon } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        daemon.failures.set('/localapi/v0/prefs', {
+            name: 'TransportError',
+            reason: REASON.HTTP,
+        });
+        const routes = rowsNamed(toggleOf(), 'Accept routes').at(0);
+        routes.toggle();
+        await settle();
+
+        daemon.failures.clear();
+        routes.toggle();
+        await settle();
+
+        expect(routes.state).toBe(true);
+        expect(toggleOf()._problems.items).toEqual([]);
+    });
 });
 
 describe('running as an exit node', () => {
@@ -496,6 +621,27 @@ describe('running as an exit node', () => {
 
         expect(daemon.patches.at(-1).AdvertiseRoutes).toEqual(['192.168.1.0/24']);
     });
+
+    it('turns itself back off when the daemon refuses, every time', async () => {
+        const { panel, model, daemon } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        daemon.failures.set('/localapi/v0/prefs', {
+            name: 'TransportError',
+            reason: REASON.HTTP,
+        });
+
+        const exitNode = rowsNamed(toggleOf(), 'Run as exit node').at(0);
+        exitNode.activate();
+        await settle();
+        expect(exitNode.state).toBe(false);
+
+        exitNode.activate();
+        await settle();
+        expect(exitNode.state).toBe(false);
+        expect(model.state.reachable).toBe(true);
+    });
 });
 
 describe('profiles', () => {
@@ -1225,6 +1371,29 @@ describe('teardown', () => {
         expect(menu._wasDestroyed).toBe(true);
     });
 
+    // Clutter can destroy an actor straight from C, through its own dispose,
+    // which never calls back into an overridden JS destroy() — only the
+    // 'destroy' signal, which every actor emits either way. The model
+    // subscription and the settings handlers are the Panel's, released by
+    // disable() as the tests above check; this is everything the toggle holds.
+    it('releases what the toggle holds when the Shell destroys it directly', async () => {
+        const { panel, model } = setup();
+        panel.enable();
+        await model.start();
+        await settle();
+        Main.press(SHORTCUT_KEYS.OPEN_MENU);
+        const toggle = toggleOf();
+        const menu = toggle.menu;
+        menu.actor.emit('notify::allocation');
+
+        toggle.emit('destroy');
+
+        expect(menu._wasDestroyed).toBe(true);
+        expect(laters.size).toBe(0);
+        // Clutter drops the handlers on the actor itself along with it.
+        expect([...liveHandlers].filter(id => !toggle.handlers.has(id))).toEqual([]);
+    });
+
     it('leaves no layout handler or later behind', async () => {
         const { panel, model } = setup();
         panel.enable();
@@ -1336,6 +1505,33 @@ describe('login', () => {
         expect(launchedUris).toEqual([]);
     });
 
+    // A login that went through without its URL ever reaching the menu — the
+    // browser was opened some other way, or someone ran `tailscale up` —
+    // left the flag set, and the next AuthURL, a reauth hours later, opened a
+    // browser nobody asked for.
+    it('does not stay armed once no login is needed', async () => {
+        const { panel, model, daemon } = setup();
+        loggedOut(daemon);
+        daemon.responses.status.AuthURL = '';
+        panel.enable();
+        await model.start();
+        await settle();
+
+        rowsNamed(toggleOf(), 'Log in…').at(0).activate();
+        await settle();
+
+        daemon.responses.status.BackendState = BACKEND.RUNNING;
+        await model.refresh();
+        await settle();
+
+        daemon.responses.status.BackendState = BACKEND.NEEDS_LOGIN;
+        daemon.responses.status.AuthURL = 'https://login.tailscale.com/a/later';
+        await model.refresh();
+        await settle();
+
+        expect(launchedUris).toEqual([]);
+    });
+
     // The URL comes from whatever control server the profile points at.
     it('refuses a login URL that is not http', async () => {
         const { panel, model, daemon } = setup();
diff --git a/tests/peers.test.js b/tests/peers.test.js
index f4d5e84..338d4b0 100644
--- a/tests/peers.test.js
+++ b/tests/peers.test.js
@@ -135,10 +135,34 @@ describe('normalizePeer', () => {
             canBeExitNode: false,
             isMullvad: false,
             icon: 'computer-symbolic',
+            dnsName: `laptop.${SUFFIX}`,
         });
         expect(node.ips).toEqual(['100.64.0.1', 'fd7a:115c:a1e0::1']);
     });
 
+    // The name to copy is the daemon's own, not one rebuilt from the display
+    // name and this tailnet's suffix: a node shared in from another tailnet,
+    // or one of Mullvad's, does not live under this tailnet's suffix.
+    it.each([
+        ['a node of this tailnet', `laptop.${SUFFIX}.`, `laptop.${SUFFIX}`],
+        [
+            'a node shared in from another tailnet',
+            'laptop.other-tailnet.ts.net.',
+            'laptop.other-tailnet.ts.net',
+        ],
+        [
+            'a Mullvad node',
+            'se-sto-wg-001.mullvad.ts.net.',
+            'se-sto-wg-001.mullvad.ts.net',
+        ],
+        ['a peer with no DNS name', '', ''],
+        ['a peer whose DNS name is absent', undefined, ''],
+    ])('keeps the DNS name of %s', (_reason, DNSName, dnsName) => {
+        const node = normalizePeer(rawPeer({ DNSName }), { magicDNSSuffix: SUFFIX });
+
+        expect(node.dnsName).toBe(dnsName);
+    });
+
     // The preference is what flips the instant the user clicks; the peer's own
     // ExitNode field lags until the route change takes effect.
     it('marks the exit node from the preference, not the peer', () => {
diff --git a/tests/settings.test.js b/tests/settings.test.js
index 8c668d2..6b60721 100644
--- a/tests/settings.test.js
+++ b/tests/settings.test.js
@@ -3,7 +3,14 @@ import { fileURLToPath } from 'node:url';
 
 import { describe, expect, it } from 'vitest';
 
-import { ALL_KEYS, KEYS, SETTINGS, SHORTCUT_KEYS } from '../modules/settings.js';
+import {
+    ALL_KEYS,
+    KEYS,
+    SETTINGS,
+    SHORTCUT_KEYS,
+    settingText,
+} from '../modules/settings.js';
+import { extractableMsgids } from './support/i18n.js';
 
 const SCHEMA = fileURLToPath(
     new URL(
@@ -40,11 +47,35 @@ describe('the settings list and the gschema', () => {
     });
 
     it('describes every key it names', () => {
-        for (const setting of SETTINGS) {
-            expect(setting.label).toMatch(/\S/);
-            expect(setting.detail).toMatch(/\S/);
+        for (const { key } of SETTINGS) {
+            const { label, detail } = settingText(key, message => message);
+
+            expect(label, key).toMatch(/\S/);
+            expect(detail, key).toMatch(/\S/);
         }
     });
+
+    // Empty rather than a guess, so the check above is what catches a key
+    // added to SETTINGS without words of its own.
+    it('has no words for a key it does not know', () => {
+        expect(settingText('no-such-key', message => message)).toEqual({
+            label: '',
+            detail: '',
+        });
+    });
+
+    // prefs.js used to hand this list's own English to _(), which xgettext
+    // never sees: a variable is not a msgid. Every string it is given now has
+    // to be a literal a translator is shown.
+    it('words every key only in strings a translator is given', () => {
+        const asked = [];
+        for (const { key } of SETTINGS)
+            settingText(key, message => (asked.push(message), message));
+
+        expect(asked).toHaveLength(SETTINGS.length * 2);
+        const known = extractableMsgids();
+        for (const message of asked) expect(known, message).toContain(message);
+    });
 });
 
 describe('the schema itself', () => {
diff --git a/tests/shortcuts.test.js b/tests/shortcuts.test.js
index 86dbf7f..50ae92c 100644
--- a/tests/shortcuts.test.js
+++ b/tests/shortcuts.test.js
@@ -14,12 +14,17 @@ const SHIFT = 1;
 const CONTROL = 4;
 const ESCAPE = 0xff1b;
 const BACKSPACE = 0xff08;
+const F5 = 0xffc2;
+const TAB = 0xff09;
 
 const gtk = {
     escapeKey: ESCAPE,
     backspaceKey: BACKSPACE,
     shiftMask: SHIFT,
     acceleratorValid: () => true,
+    // What Gdk.keyval_to_unicode gives for the key: 0x61 is 'a', which types
+    // something on its own.
+    codePoint: 0x61,
 };
 
 describe('isValidBinding', () => {
@@ -27,13 +32,25 @@ describe('isValidBinding', () => {
         expect(isValidBinding(CONTROL, 0x61, gtk)).toBe(true);
     });
 
-    // A bare key would steal it from every application, and Shift alone just
-    // types a capital letter.
+    // A bare key would steal it from every application, F5 included, and
+    // Shift with a letter is how a capital letter is typed.
     it.each([
-        ['no modifier', 0],
-        ['Shift alone', SHIFT],
-    ])('rejects %s', (_reason, mask) => {
-        expect(isValidBinding(mask, 0x61, gtk)).toBe(false);
+        ['no modifier', 0, 0x61, 0x61],
+        ['a bare F5', 0, F5, 0],
+        ['Shift+a', SHIFT, 0x61, 0x61],
+        ['Shift+A', SHIFT, 0x41, 0x41],
+    ])('rejects %s', (_reason, mask, keyval, codePoint) => {
+        expect(isValidBinding(mask, keyval, { ...gtk, codePoint })).toBe(false);
+    });
+
+    // Close to GNOME Settings' rule: Shift alone is enough for a key that types
+    // nothing on its own — a function key has no code point, and Tab's is a
+    // control character.
+    it.each([
+        ['Shift+F5', F5, 0],
+        ['Shift+Tab', TAB, 0x09],
+    ])('accepts %s', (_reason, keyval, codePoint) => {
+        expect(isValidBinding(SHIFT, keyval, { ...gtk, codePoint })).toBe(true);
     });
 
     it('defers to Gtk on what is a valid accelerator', () => {
@@ -71,4 +88,10 @@ describe('captureOutcome', () => {
     it('swallows a combination that cannot be bound', () => {
         expect(captureOutcome(0x61, 0, gtk)).toBe(CAPTURE_IGNORE);
     });
+
+    it('assigns Shift with a key that types nothing', () => {
+        expect(captureOutcome(F5, SHIFT, { ...gtk, codePoint: 0 })).toBe(
+            CAPTURE_ASSIGN,
+        );
+    });
 });
diff --git a/tests/state.test.js b/tests/state.test.js
index 800349c..b72a049 100644
--- a/tests/state.test.js
+++ b/tests/state.test.js
@@ -3,9 +3,11 @@ import { describe, expect, it } from 'vitest';
 import { REASON } from '../modules/errors.js';
 import {
     BACKEND,
+    applyChangeError,
     applyError,
     applyPrefs,
     applyProfiles,
+    applyRefusal,
     applyStatus,
     changed,
     initialState,
@@ -219,6 +221,18 @@ describe('exitNodeName', () => {
 
         expect(state.nodes.at(0).id).toBe('nLAP');
     });
+
+    // Every preferences read went through a sort that could change nothing.
+    // Keeping the same array also lets changed() settle 'nodes' by identity.
+    it('keeps the very same nodes when the exit node did not move', () => {
+        const before = applyPrefs(withPeers(), prefs({ ExitNodeID: 'nGATE' }));
+        const after = applyPrefs(
+            before,
+            prefs({ ExitNodeID: 'nGATE', ShieldsUp: true }),
+        );
+
+        expect(after.nodes).toBe(before.nodes);
+    });
 });
 
 describe('applyProfiles', () => {
@@ -286,6 +300,128 @@ describe('applyError', () => {
     it('falls back to unknown for an empty reason', () => {
         expect(applyError(initialState(), '').errorReason).toBe(REASON.UNKNOWN);
     });
+
+    // Losing contact makes a refusal from before it stale. Kept, the "refused
+    // the request" row came back with the first status read after
+    // reconnecting, for a change nobody had made since.
+    it('drops a refusal from before the daemon was lost', () => {
+        const refused = applyRefusal(
+            applyStatus(initialState(), status()),
+            REASON.HTTP,
+        );
+        const back = applyStatus(
+            applyError(refused, REASON.CONNECTION_REFUSED),
+            status(),
+        );
+
+        expect(back.refusedReason).toBe('');
+    });
+});
+
+describe('applyRefusal', () => {
+    // The daemon answered, so it is still there and what was read is still
+    // true. Only the change did not happen.
+    it('keeps the daemon reachable and what was already known', () => {
+        const loaded = applyPrefs(applyStatus(initialState(), status()), prefs());
+        const refused = applyRefusal(loaded, REASON.HTTP);
+
+        expect(refused.reachable).toBe(true);
+        expect(refused.errorReason).toBe('');
+        expect(refused.running).toBe(true);
+        expect(refused.nodes).toHaveLength(1);
+    });
+
+    it('records why, and counts it', () => {
+        const refused = applyRefusal(initialState(), REASON.PROTOCOL);
+
+        expect(refused.refusedReason).toBe(REASON.PROTOCOL);
+        expect(refused.refusedCount).toBe(initialState().refusedCount + 1);
+    });
+
+    it('falls back to unknown for an empty reason', () => {
+        expect(applyRefusal(initialState(), '').refusedReason).toBe(REASON.UNKNOWN);
+    });
+
+    it('starts with nothing refused', () => {
+        expect(initialState().refusedReason).toBe('');
+        expect(initialState().refusedCount).toBe(0);
+    });
+
+    it('is frozen', () => {
+        expect(Object.isFrozen(applyRefusal(initialState(), REASON.HTTP))).toBe(true);
+    });
+
+    // A switch the user flipped is set back from the unchanged preferences
+    // only when a change tells the menu to look. Two refusals in a row with
+    // the same reason would otherwise look like nothing happened the second
+    // time, and leave the switch showing what the daemon refused.
+    it('registers a second identical refusal as a change', () => {
+        const once = applyRefusal(applyPrefs(initialState(), prefs()), REASON.HTTP);
+        const twice = applyRefusal(once, REASON.HTTP);
+
+        expect(changed(once, twice)).toEqual(['refusedCount']);
+    });
+
+    // The next successful read or change is the daemon's current answer, and
+    // the refusal it follows is no longer news.
+    it('is cleared by the next preferences read', () => {
+        const refused = applyRefusal(applyPrefs(initialState(), prefs()), REASON.HTTP);
+        const read = applyPrefs(refused, prefs());
+
+        expect(read.refusedReason).toBe('');
+        expect(changed(refused, read)).toEqual(['refusedReason']);
+    });
+});
+
+describe('applyChangeError', () => {
+    it('marks the daemon unreachable, as applyError does', () => {
+        const loaded = applyPrefs(applyStatus(initialState(), status()), prefs());
+        const failed = applyChangeError(loaded, REASON.CONNECTION_REFUSED);
+
+        expect(failed.reachable).toBe(false);
+        expect(failed.errorReason).toBe(REASON.CONNECTION_REFUSED);
+        expect(failed.nodes).toHaveLength(1);
+        expect(failed.running).toBe(true);
+    });
+
+    // A refusal's message is the daemon answering; this is the daemon gone.
+    it('counts the change without calling it a refusal', () => {
+        const failed = applyChangeError(initialState(), REASON.PERMISSION_DENIED);
+
+        expect(failed.refusedCount).toBe(initialState().refusedCount + 1);
+        expect(failed.refusedReason).toBe('');
+    });
+
+    it('falls back to unknown for an empty reason', () => {
+        expect(applyChangeError(initialState(), '').errorReason).toBe(REASON.UNKNOWN);
+    });
+
+    it('drops a refusal from before the daemon was lost', () => {
+        const refused = applyRefusal(
+            applyStatus(initialState(), status()),
+            REASON.HTTP,
+        );
+        const back = applyStatus(
+            applyChangeError(refused, REASON.CONNECTION_REFUSED),
+            status(),
+        );
+
+        expect(back.refusedReason).toBe('');
+    });
+
+    // Already unreachable for the same reason — a stopped daemon, a user who
+    // is not the operator — the count is the only thing that moves, and it
+    // has to be enough for the menu to set a flipped switch back.
+    it('registers a failure identical to the recorded one as a change', () => {
+        const down = applyError(
+            applyPrefs(initialState(), prefs()),
+            REASON.PERMISSION_DENIED,
+        );
+
+        expect(changed(down, applyChangeError(down, REASON.PERMISSION_DENIED))).toEqual(
+            ['refusedCount'],
+        );
+    });
 });
 
 describe('changed', () => {
@@ -332,6 +468,18 @@ describe('changed', () => {
         expect(changed(before, after)).toContain('nodes');
     });
 
+    // A peer named from its HostName until its DNS name arrives keeps the
+    // same name throughout, so only the name to copy moves.
+    it("notices a peer's DNS name changing when its name does not", () => {
+        const before = applyStatus(
+            initialState(),
+            status({ Peer: rawPeerMap(rawPeer({ DNSName: '' })) }),
+        );
+        const after = applyStatus(before, status());
+
+        expect(changed(before, after)).toEqual(['nodes']);
+    });
+
     it('notices health changing', () => {
         const before = applyStatus(initialState(), status());
         const after = applyStatus(before, status({ Health: ['something'] }));
diff --git a/tests/support/i18n.js b/tests/support/i18n.js
index cb607d3..cb894b4 100644
--- a/tests/support/i18n.js
+++ b/tests/support/i18n.js
@@ -1,9 +1,9 @@
-// Every msgid xgettext can actually pull out of modules/: a string literal as
-// the whole first argument of _(), or the first two arguments of _n()
-// (xgettext -k_ -k_n:1,2). A variable, a template, or a composed sentence
-// there is invisible to it — the extension would enable, look right under
-// `gettext: message => message`, and ship with a msgid no translator was ever
-// given.
+// Every msgid xgettext can actually pull out of modules/, prefs.js and
+// extension.js: a string literal as the whole first argument of _(), or the
+// first two arguments of _n() (xgettext -k_ -k_n:1,2). A variable, a
+// template, or a composed sentence there is invisible to it — the extension
+// would enable, look right under `gettext: message => message`, and ship with
+// a msgid no translator was ever given.
 
 import { readdirSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -19,24 +19,39 @@ const PLURAL = new RegExp(`(?<![\\w.$])_n\\(\\s*${STRING}\\s*,\\s*${STRING}\\s*,
 const CALL_START = /(?<![\w.$])_n?\(/g;
 
 /**
- * @returns {{name: string, source: string}[]} Every module file's name and
- *   contents, under modules/.
+ * The two entry points, which gettext is imported into rather than handed. No
+ * test runs prefs.js at all, so reading its source is the only check its
+ * strings get.
+ */
+const ENTRY_POINTS = ['prefs.js', 'extension.js'];
+
+/**
+ * @returns {{name: string, source: string}[]} The name and contents of every
+ *   file under modules/, then of each entry point.
  */
 function moduleFiles() {
-    const dir = fileURLToPath(new URL('../../modules/', import.meta.url));
+    const root = fileURLToPath(new URL('../../', import.meta.url));
+    const dir = `${root}modules/`;
     // A module-relative constant directory and the files in it, not input.
     // eslint-disable-next-line security/detect-non-literal-fs-filename
     const names = readdirSync(dir).filter(name => name.endsWith('.js'));
-    return names.map(name => ({
-        name,
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        source: readFileSync(dir + name, 'utf8'),
-    }));
+    return [
+        ...names.map(name => ({
+            name,
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            source: readFileSync(dir + name, 'utf8'),
+        })),
+        ...ENTRY_POINTS.map(name => ({
+            name,
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            source: readFileSync(root + name, 'utf8'),
+        })),
+    ];
 }
 
 /**
  * @returns {Set<string>} Every literal a translator would actually be shown,
- *   from every _() and _n() call anywhere under modules/.
+ *   from every _() and _n() call under modules/ and in either entry point.
  */
 export function extractableMsgids() {
     const ids = new Set();
@@ -58,18 +73,19 @@ export function extractableMsgids() {
 const LITERAL_ARG = /^(?:'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*")/;
 
 /**
- * Every _()/_n() call under modules/ whose first argument — or, for _n(),
- * whose second (plural) argument — is not a string literal, as far as a
- * regex can tell — the same authority extractableMsgids already relies on.
- * `_(variable)`, `_(a.b)` and `` _(`template`) `` are all invisible to
- * xgettext exactly the same way, and so is `_n('one', pluralVar, n)`: the
- * PLURAL regex above pulls its msgid_plural from the same position, and a
- * variable there is just as silently dropped. This is how a test catches one
- * before it ships rather than after a translator asks where a string's msgid
- * went.
+ * Every _()/_n() call under modules/, prefs.js or extension.js whose first
+ * argument — or, for _n(), whose second (plural) argument — is not a string
+ * literal, as far as a regex can tell — the same authority extractableMsgids
+ * already relies on. `_(variable)`, `_(a.b)` and `` _(`template`) `` are all
+ * invisible to xgettext exactly the same way, and so is
+ * `_n('one', pluralVar, n)`: the PLURAL regex above pulls its msgid_plural
+ * from the same position, and a variable there is just as silently dropped.
+ * This is how a test catches one before it ships rather than after a
+ * translator asks where a string's msgid went.
  *
  * @param {{name: string, source: string}[]} [files] Files to check; defaults
- *   to every module file, and is otherwise only ever overridden by a test.
+ *   to every file moduleFiles() reads, and is otherwise only ever
+ *   overridden by a test.
  * @returns {string[]} One line per offending call: "file:line: what follows".
  */
 export function nonLiteralGettextCalls(files = moduleFiles()) {
diff --git a/tests/taildrop-section.test.js b/tests/taildrop-section.test.js
index fcd1734..95f898d 100644
--- a/tests/taildrop-section.test.js
+++ b/tests/taildrop-section.test.js
@@ -83,6 +83,25 @@ describe('received files', () => {
         expect(Main.osdMessages).toHaveLength(1);
     });
 
+    // The sender chose the name. As a replacement string, its $' would pull in
+    // the rest of the sentence around it.
+    it('reports a saved file by the name it was sent with', async () => {
+        const { panel, model, daemon } = setup();
+        daemon.responses.files = [{ Name: "draft$'s.txt", Size: 12 }];
+        panel.enable();
+        await model.start();
+        await settle();
+        toggleOf().menu.open();
+        await settle();
+
+        const row = toggleOf()._inbox.menu.items.at(0);
+        row.activate();
+        await settle();
+
+        expect(row.text).toBe("Saved to /home/someone/Downloads/draft$'s.txt");
+        expect(Main.osdMessages.at(-1).label).toBe("Saved draft$'s.txt");
+    });
+
     // In that order: deleting first loses the file if the write fails.
     it('forgets the file only after saving it', async () => {
         const { panel, model, daemon } = setup();
@@ -123,8 +142,33 @@ describe('received files', () => {
         expect(row.text).toMatch(/\S/);
     });
 
+    // Not "Could not reach the Tailscale daemon": the daemon handed the file
+    // over, and it was the write here that failed.
+    it('says the file could not be saved when the write here fails', async () => {
+        const { panel, model, daemon } = setup();
+        withFiles(daemon);
+        panel.enable();
+        await model.start();
+        await settle();
+        toggleOf().menu.open();
+        await settle();
+
+        daemon.failures.set('/localapi/v0/files/report.pdf', {
+            name: 'TransportError',
+            reason: REASON.LOCAL_FILE,
+        });
+
+        const row = toggleOf()._inbox.menu.items.at(0);
+        row.activate();
+        await settle();
+
+        expect(row.text).toBe('Could not save the file.');
+        expect(row.sensitive).toBe(true);
+        expect(daemon.deleted).toEqual([]);
+    });
+
     // modules/model.js's saveFile used to hand this row modules/errors.js's
-    // already-composed English (messageFor), and _(error) then asked gettext
+    // already-composed English, and _(error) then asked gettext
     // to translate a sentence it can never see when the .pot file is built —
     // only a literal string reaches xgettext.
     // REASON.PERMISSION_DENIED, not REASON.HTTP: its composed message
diff --git a/tests/text.test.js b/tests/text.test.js
new file mode 100644
index 0000000..f210996
--- /dev/null
+++ b/tests/text.test.js
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { fill } from '../modules/text.js';
+
+describe('fill', () => {
+    // A replacement string reads $&, $` and $' as patterns, but a node or file
+    // name is data, and a translated sentence has to show it as it is.
+    it.each(['$&', '$`', "$'"])('does not read %s in a value as a pattern', pattern => {
+        expect(fill('Saved %s here', `a${pattern}b`)).toBe(`Saved a${pattern}b here`);
+    });
+
+    it('does not fill a placeholder that a value brought in', () => {
+        expect(fill('%s ms, relayed via %s', '%s', 'lhr')).toBe(
+            '%s ms, relayed via lhr',
+        );
+    });
+
+    it('fills every placeholder in order, %s and %d alike', () => {
+        expect(fill('Sent %d files to %s', 2, 'laptop')).toBe('Sent 2 files to laptop');
+    });
+
+    it('leaves a placeholder past the last value untouched', () => {
+        expect(fill('%s and %s', 'only')).toBe('only and %s');
+    });
+
+    it('does not let a later $ pattern read an earlier value', () => {
+        expect(fill('%s then %s', '$&', '$1')).toBe('$& then $1');
+    });
+});
diff --git a/vitest.config.js b/vitest.config.js
index df8dd3a..c1eeb36 100644
--- a/vitest.config.js
+++ b/vitest.config.js
@@ -23,20 +23,24 @@ export default defineConfig({
             //   prefs.js       Adw and Gtk widget building. The rules it used
             //                  to hold live in modules/shortcuts.js.
             //   modules/io.js  Soup and Gio plumbing. Every URL, body, delay
-            //                  and retry decision lives in modules/localapi.js,
+            //                  and retry decision, whether an answer is JSON
+            //                  and what a Gio error or an HTTP status means,
+            //                  lives in modules/localapi.js, modules/errors.js,
             //                  modules/timing.js and modules/reconnect.js and
             //                  is tested there. io.js is covered instead by
             //                  scripts/localapi-check.sh, which runs it under
             //                  plain gjs against the real tailscaled — the only
             //                  check that catches Tailscale changing its JSON.
             //
-            // Kept identical to sonar.coverage.exclusions so the two agree.
+            // Those two files are exactly sonar.coverage.exclusions, so the
+            // two tools agree on what counts.
             //
-            // tests/** is listed because the `include` above did not keep a
-            // dynamically imported stub out of the report: extension.test.js
-            // pulls tests/stubs/shell-extension.js in through vi.doMock, and
-            // it turned up as production code. A stub counted either way is a
-            // number that means nothing.
+            // tests/** is listed here and not there. Sonar never counts it,
+            // because sonar.sources leaves it out, but the `include` above did
+            // not keep a dynamically imported stub out of this report:
+            // extension.test.js pulls tests/stubs/shell-extension.js in
+            // through vi.doMock, and it turned up as production code. A stub
+            // counted either way is a number that means nothing.
             exclude: ['prefs.js', 'modules/io.js', 'tests/**'],
         },
     },