@@ -21,6 +21,11 @@ env:
 jobs:
   test:
     name: test on ${{ matrix.os }}
+    # A hung job otherwise holds a runner until the GitHub default of six
+    # hours. Every number here is well above what the job takes today: the
+    # matrix runs in about a minute, the race detector took 148 s when it was
+    # measured, and fuzzing is given 5 minutes a target by its own loop.
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
@@ -73,9 +78,22 @@ jobs:
       - name: build the command line binary
         run: go build ./cmd/tfg
 
+      - name: build the window binary
+        # Nothing built this, so it could stop compiling and no run would say
+        # so. The package is a stub today and that is exactly why it is cheap
+        # to keep honest - it costs a second now and a bisect later.
+        #
+        # CGO_ENABLED is 0 for this whole job, which is the point: the window
+        # binary has to keep building without a C toolchain for as long as the
+        # toolkit is not wired in. The day it is, this step needs a compiler
+        # and moves to a job that has one, and finding that out here is better
+        # than finding it out when the release does not build.
+        run: go build ./cmd/tfg-gui
+
   govulncheck:
     name: known vulnerabilities
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
 
@@ -99,6 +117,7 @@ jobs:
   staticcheck:
     name: staticcheck
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
 
@@ -126,6 +145,7 @@ jobs:
   race:
     name: race detector
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       # The one thing in this project that needs a C toolchain. Linux runners
       # ship one, so this job carries the cost and the matrix above stays on
@@ -156,6 +176,7 @@ jobs:
   coverage:
     name: coverage gate
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     env:
       CGO_ENABLED: "0"
     steps:
@@ -205,6 +226,8 @@ jobs:
     # searching.
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    # Four targets at five minutes each, plus the build and the baseline pass.
+    timeout-minutes: 45
     env:
       CGO_ENABLED: "0"
     steps:
 
@@ -88,6 +88,23 @@ because it turns other people's test suites red.
 
 ### Changed
 
+- **A size is written the way a person writes it.** `--size 1e5` quietly meant
+  100000 bytes, while a recipe refuses `1_000` and `0x10` outright on the
+  grounds that a spelling is never guessed at. The flag now applies the same
+  rule. `1.5gib` and every other decimal are untouched.
+- **`tfg recipe fmt -w` replaces a file in one step**, through a temporary name,
+  so a process ending mid write no longer leaves the recipe at half its length.
+  Generated files and the manifest already worked this way.
+- **The command recorded in the manifest can be run again.** It was built by
+  joining the arguments with spaces, so `--name "my file.txt"` came back as two
+  arguments and described a different run.
+- **A run refuses to write through a name something else already occupies.**
+  Only the final name was checked, and the temporary one is created in a way
+  that truncates - so a file already sitting under it lost its contents without
+  a word. A run killed outright leaves exactly that shape behind.
+- **`tfg generate --json` reports a manifest that could not be delivered.**
+  Piping into a command that closes early left the run reporting success with
+  nothing on standard output.
 - **`tfg recipe fmt` says what it does not check.** It settles the layout of a
   file and never claimed otherwise in `--help`, but the text implied more than
   it did. A recipe with a key nobody recognises still has a settled shape and
 
@@ -230,7 +230,28 @@ func (p propertyFlag) Set(v string) error {
 	return nil
 }
 
+// args2 rebuilds the command as it would have to be typed to run again.
+//
+// It goes into the manifest, where its whole job is to be re-runnable, and it
+// was assembled by joining the arguments with spaces. An argument holding a
+// space then arrived as two - "--name my file.txt" reads as a name of "my" and
+// a stray word - so the recorded command produced a different run, or none.
+//
+// Quoted only where it is needed, so the common line stays readable. Single
+// quotes are avoided because the shells this tool is aimed at disagree about
+// them, and double quotes with escaping work in all of them.
 func args2(args []string) []string {
-	out := []string{"generate"}
-	return append(out, args...)
+	out := make([]string, 0, len(args)+1)
+	out = append(out, "generate")
+	for _, a := range args {
+		out = append(out, quoteArg(a))
+	}
+	return out
+}
+
+func quoteArg(a string) string {
+	if a != "" && !strings.ContainsAny(a, " \t\"\\") {
+		return a
+	}
+	return `"` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(a) + `"`
 }
@@ -151,6 +151,15 @@ func classify(err error) int {
 	if errors.Is(err, context.Canceled) {
 		return ExitInterrupted
 	}
+	// A deadline running out is the same ending as a signal that says time is
+	// up, and the frozen table tells that apart from somebody cancelling.
+	// Nothing in the command line sets a deadline today - it is reachable only
+	// through a caller that does, which the window will be - so this is here
+	// before it is needed rather than after it has been reported as the tool
+	// crashing. Without it the ending falls through to RUNTIME.
+	if errors.Is(err, context.DeadlineExceeded) {
+		return ExitTerminated
+	}
 	var pathErr *os.PathError
 	if errors.As(err, &pathErr) {
 		return ExitIO
 
@@ -395,7 +395,14 @@ func produce(ctx context.Context, targets []engine.Target, opt engine.Options, g
 			fmt.Fprintf(errOut, "tfg: cannot render the manifest: %s\n", describeError(err))
 			return ExitRuntime
 		}
-		out.Write(buf.Bytes())
+		// The error is read rather than dropped. A closed pipe is the ordinary
+		// way this fails - "tfg generate --json | head" - and a run that could
+		// not deliver what was asked for has not succeeded, whatever happened
+		// on the disk.
+		if _, err := out.Write(buf.Bytes()); err != nil {
+			fmt.Fprintf(errOut, "tfg: the files were written and the manifest could not be sent to standard output: %s\n", describeError(err))
+			return ExitIO
+		}
 	}
 
 	if res.Failures > 0 {
 
@@ -4,6 +4,7 @@ package cli
 import (
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"strings"
 	"time"
@@ -92,9 +93,19 @@ func (p *progressBar) remaining(pr engine.Progress) string {
 	return "  " + roughly(left) + " left"
 }
 
+// percent divides before multiplying where it has to, so a very large run does
+// not wrap on the way to a number between nought and a hundred.
+//
+// done*100 leaves the range of an int64 above about 92 PB. No disk holds that
+// today, and the arithmetic that produces it is free to be right anyway.
 func percent(done, total int64) int {
-	if total <= 0 {
+	switch {
+	case total <= 0:
+		return 100
+	case done >= total:
 		return 100
+	case done > math.MaxInt64/100:
+		return int(done / (total / 100))
 	}
 	return int(done * 100 / total)
 }
 
@@ -52,6 +52,32 @@ func loadRecipe(path string, errOut io.Writer) (*recipe.Recipe, string, int) {
 	return rec, hash, ExitOK
 }
 
+// replaceFile puts new content in place of a file in one step.
+//
+// "recipe fmt -w" is the only command here that writes over a file somebody
+// wrote by hand, and it was the least careful write in the tool: os.WriteFile
+// truncates first and fills afterwards, so a process ending in between leaves
+// the recipe half its length and no copy of what it was.
+//
+// Every generated file has gone through a temporary name and a rename since
+// the beginning, for exactly this reason, and so does the manifest since
+// earlier today. This is the same thing for the one file that is not ours.
+//
+// The temporary file sits beside the target rather than in the system
+// temporary directory, because a rename across volumes is not one operation
+// and this whole function exists to have one.
+func replaceFile(path string, content []byte) error {
+	tmp := path + ".tfg-writing"
+	if err := os.WriteFile(tmp, content, 0o644); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	return nil
+}
+
 // validate runs the checks a run would run and writes nothing at all, so it
 // suits a pre commit hook.
 func validate(args []string, out, errOut io.Writer) int {
@@ -272,7 +298,7 @@ Flags:
 			fmt.Fprintf(errOut, "%s was already settled and was not touched.\n", path)
 			return ExitOK
 		}
-		if err := os.WriteFile(path, canon, 0o644); err != nil {
+		if err := replaceFile(path, canon); err != nil {
 			fmt.Fprintf(errOut, "tfg: cannot write %s: %s\n", path, describeError(err))
 			return ExitIO
 		}
 
@@ -79,6 +79,15 @@ func FillRecords(ctx context.Context, w io.Writer, rng *rand.Rand, remaining int
 
 		mark := len(buf)
 		buf = rec.Append(buf, rng)
+		// A record that adds nothing would leave remaining untouched and the
+		// buffer never reaching the chunk size, so this loop would spin without
+		// end and without growing - the one failure shape a size guard cannot
+		// see, because no file is ever produced to measure. No builder does it
+		// today and the interface does not forbid it, so it is named here
+		// rather than left to a hang somebody has to interrupt.
+		if len(buf) == mark {
+			return fmt.Errorf("core: a record of this format added no bytes, so the file could never be filled")
+		}
 		// Stop while what is left still fits a whole closing record. That is
 		// what keeps the last one from being a stub.
 		if remaining-int64(len(buf)-mark) < shortest {
@@ -133,6 +142,13 @@ func AppendFiller(dst []byte, words []string, n int64, separator func(i int) str
 		// FillRecords turns that into an error rather than a wrong size.
 		return dst
 	}
+	if len(words) == 0 {
+		// The loop below indexes words modulo its length, so an empty
+		// vocabulary divides by zero. No caller passes one today and none
+		// should: a format with nothing to say cannot pad to a length. Saying
+		// which mistake it is beats a runtime panic with no name on it.
+		panic("core: AppendFiller was given no words to pad with")
+	}
 
 	start := len(dst)
 	for i := 0; int64(len(dst)-start) < n; i++ {
 
@@ -67,6 +67,22 @@ func ParseSize(s string) (int64, error) {
 		return n * multiplier, nil
 	}
 
+	// Only the spellings a person writes. ParseFloat also takes exponents, hex
+	// floats and the words for infinity, and none of those describes a file.
+	//
+	// Measured on 2026-08-03: "--size 1e5" quietly meant 100000 bytes, while
+	// the recipe refuses "1_000" and "0x10" outright, with the reasoning that
+	// guessing at a spelling is the behaviour that type was written to remove.
+	// Two doors into one idea applying opposite rules, and the difference was
+	// nobody's decision - it fell out of ParseFloat being permissive. In a size
+	// field, "1e5" is far likelier to be a typo than an intention.
+	//
+	// The decimal point stays, because 1.5gib is a real thing people write.
+	if !plainDecimal(digits) {
+		return 0, fmt.Errorf(
+			"size %q is not a plain number: write the digits out, as 10mb, 1.5gib or 1048576. Spellings such as 1e5, 0x10 or 1_000 are refused rather than guessed at, the same as in a recipe", s)
+	}
+
 	f, err := strconv.ParseFloat(digits, 64)
 	if err != nil {
 		return 0, fmt.Errorf("size %q is not a number: write something like 10mb, 1.5gib or 1048576", s)
@@ -96,6 +112,30 @@ func ParseSize(s string) (int64, error) {
 	return n, nil
 }
 
+// plainDecimal reports whether the text is digits, with at most one decimal
+// point and an optional leading sign. Nothing else counts as a number here.
+//
+// Leading zeros are allowed and mean nothing, which matches how the recipe
+// reads a number: 010 is ten because that is what it looks like.
+func plainDecimal(s string) bool {
+	s = strings.TrimPrefix(strings.TrimPrefix(s, "+"), "-")
+	if s == "" {
+		return false
+	}
+	dot, digits := false, 0
+	for _, r := range s {
+		switch {
+		case r >= '0' && r <= '9':
+			digits++
+		case r == '.' && !dot:
+			dot = true
+		default:
+			return false
+		}
+	}
+	return digits > 0
+}
+
 func unitBytes(unit string) (int64, bool) {
 	const (
 		ki = 1024
 
@@ -425,14 +425,32 @@ func preflight(files []PlannedFile, opt Options) error {
 	// Nothing else is written over either. This tool runs in directories that
 	// belong to the user, so destroying their work is the one failure that
 	// cannot be undone by running again.
+	//
+	// The temporary name is checked as well as the final one. It is created
+	// with os.Create, which truncates, so a file already sitting under that
+	// name lost its contents without a word - and the collision check only
+	// ever looked at the name the file ends up with. It is an unlikely name to
+	// meet by accident and an easy one to leave behind: a run killed outright
+	// leaves exactly this, and the next run into the same directory would eat
+	// it silently.
 	for _, f := range files {
 		if path := filepath.Join(opt.OutDir, f.Name); exists(path) {
 			return &CollisionError{Path: path}
 		}
+		if path := tempPathFor(opt.OutDir, f.Name); exists(path) {
+			return &CollisionError{Path: path}
+		}
 	}
 	return nil
 }
 
+// tempPathFor is the name a file is written under before it is renamed into
+// place. One definition, used by the check above and by the write below, so
+// the two cannot disagree about what is being protected.
+func tempPathFor(outDir, name string) string {
+	return fmt.Sprintf("%s%s%d", filepath.Join(outDir, name), core.PartialMarker, os.Getpid())
+}
+
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
@@ -499,7 +517,12 @@ func Run(ctx context.Context, files []PlannedFile, opt Options) (*Result, error)
 		}
 
 		sum, err := writeOne(ctx, f, opt.OutDir, report)
-		bytesDone += f.Plan.Bytes
+		if err == nil {
+			// Only what reached the disk. Counting a file that failed would
+			// have the bar claim bytes nobody can find, and on a run where
+			// several fail the total would arrive before the files do.
+			bytesDone += f.Plan.Bytes
+		}
 		if opt.OnProgress != nil {
 			opt.OnProgress(Progress{
 				FilesDone: i + 1, FilesTotal: len(files),
@@ -532,7 +555,7 @@ func writeOne(ctx context.Context, f PlannedFile, outDir string, report func(int
 	// not produce, and the bytes of the other had already gone through the same
 	// handle. The name never survives the run, so nothing about it has to be
 	// repeatable - and the file it becomes is settled by the plan, not by this.
-	tmp := fmt.Sprintf("%s%s%d", final, core.PartialMarker, os.Getpid())
+	tmp := tempPathFor(outDir, f.Name)
 
 	fh, err := os.Create(tmp)
 	if err != nil {