@@ -23,7 +23,7 @@ existing patterns and not introduce new abstractions unless the same problem exi
 
 Find every file that belongs to the feature. Don't stop at the obvious View/ViewModel — most bugs and
 inconsistencies hide in the integration points (settings, profiles, group settings, export, command line,
-documentation). [references/integration-map.md](references/integration-map.md) lists where a tool lives and
+run command, "open in other tool" navigation, documentation). [references/integration-map.md](references/integration-map.md) lists where a tool lives and
 how to find all touch points (`git grep -l "<ApplicationName>" -- Source Website` is a good start).
 
 ### 2. Understand how it works
@@ -38,6 +38,8 @@ Read the code in this order: model (business logic) → view model (state, comma
   view hide/visible, app close
 - Integrations: which settings it reads, which profile/group fields it uses, history lists, export formats,
   admin rights requirement, external dependencies (PowerShell, WebView2, external processes, APIs)
+- Entry points: how the tool is opened with a target or profile (run command `Ctrl+Shift+P`, `NavigationManager.Open`
+  from other tools, profile panel, command line) and which other tools it sends data to
 
 This section matters on its own: it lets the user verify that the reviewer understood the feature, and
 it is the basis for spotting what is missing. If something is unclear after reading the code, say so
@@ -62,10 +64,12 @@ Go through these areas. Skip an area if it doesn't apply, but say so in one line
 1. **Bugs and logic errors** — wrong results, unhandled exceptions, race conditions (async commands that can
    overlap, refresh vs. modify), cancellation that doesn't stop work, state flags that can get stuck
    (set without `try/finally`), stale data after an action, edge cases (empty input, IPv6, very large
-   ranges, invalid/duplicate entries, no network adapter, no admin rights), wrong disposal / event handlers
-   that are never unsubscribed (static events!).
+   ranges, invalid/duplicate/overlapping entries, no network adapter, no admin rights), wrong disposal / event handlers
+   that are never unsubscribed (static events!), status messages overwritten by a later event (e.g. a completion
+   event after cancel or after an input error), exceptions in fire-and-forget `async Task` methods (`_ = Start()`)
+   that leave flags set.
 2. **Consistency within the feature** — the same action behaving differently depending on where it is
-   triggered (button vs. context menu vs. keyboard shortcut vs. profile), single vs. multi selection,
+   triggered (button vs. context menu vs. keyboard shortcut vs. profile vs. run command / other tool), single vs. multi selection,
    texts/terms that differ inside the feature.
 3. **Consistency across the application** — compare with the features from step 3 and the conventions:
    layout and spacing, icons, button placement, header/status texts, context menu items and order,
@@ -75,12 +79,16 @@ Go through these areas. Skip an area if it doesn't apply, but say so in one line
    allocations in hot paths, repeated PowerShell/process calls) *and* in the UI (UI thread blocked, too many
    `Dispatcher.Invoke` calls per result, large collections updated item by item, `CanExecute` doing
    expensive work, missing virtualization in large grids, timers that keep running when the view is hidden).
-   The UI has to stay smooth while a scan runs.
+   The UI has to stay smooth while a scan runs. Estimate the worst-case duration with the default settings for a
+   typical input (e.g. an empty /24): rounds per item (items ÷ concurrency) × timeout, for every probe — the slowest
+   probe decides when a result and the progress appear. Also check synchronous work on the UI thread after the action
+   (export, sorting, large `Clear`/`Add` loops).
 5. **Missing essentials** — functions a user would expect for this kind of tool, especially ones that
    similar tools in the app already have (export, copy, history, cancel, profile support, search/filter,
    multi-select actions, refresh, keyboard shortcuts). Separate small gaps (fix directly) from larger
    features (write an issue draft, see below).
-6. **Robustness and security** — input passed to PowerShell/command lines/processes without escaping,
+6. **Robustness and security** — input passed to PowerShell/command lines/processes without escaping (also values
+   received from the network, e.g. hostnames in custom commands),
    credentials in logs or plain text, unvalidated input, behaviour without admin rights, behaviour when
    an external dependency (PuTTY, WebView2, API) is missing or fails.
 7. **Localization and texts** — hard-coded user-visible strings, strings used for multiple meanings,
@@ -144,7 +152,15 @@ the motivation, a proposed behaviour (UI + logic), and which existing feature it
 
 ### 7. After the report
 
-Don't change code during the review. Ask the user which findings to fix. When fixing:
+Don't change code during the review. Ask the user which findings to fix.
+
+When the user wants the work handed over (to another agent or for later), write the result to
+`.claude/reviews/<feature>.md` (kebab-case, e.g. `ip-scanner.md`; the folder is not committed). Write it as an
+implementation plan, not as a report: verified findings with `path:line`, the concrete fix, the work packages / PR
+order, decisions taken and still open, and what must be tested on Windows. Read existing files in `.claude/reviews/`
+and `.claude/plans/` for the area first — they record earlier decisions.
+
+When fixing:
 
 - Follow the conventions and keep the change minimal; extract shared helpers only when the same code
   already exists in two or more places.
 
@@ -17,6 +17,7 @@ report that too.
 - Layout
 - Export and history
 - Settings and profiles
+- Navigation and run command
 - PowerShell and external processes
 - Strings, docs and changelog
 
@@ -98,6 +99,12 @@ Reference: `HostsFileEditorView.xaml`, `FirewallView.xaml`.
   `ICollectionView.DeferRefresh()` — the DataGrid accesses the view (selection / current item) while the
   items change, which throws "Cannot change or check the contents or Current position of CollectionView
   while Refresh is being deferred". Reference: `FirewallViewModel.Refresh`.
+  Other users: `RunCommandViewModel.Suggestions`. Not yet used (same `Clear()` + `ForEach(Results.Add)` pattern on every
+  refresh / auto refresh): `ConnectionsViewModel`, `ListenersViewModel`, `NeighborTableViewModel`,
+  `HostsFileEditorViewModel` — report as a performance finding when reviewing them.
+- Don't use a `Reset` for results that are *appended* while a scan runs (IP Scanner, Port Scanner, Traceroute): with a
+  sorted view every `Reset` re-sorts the whole list and the grid loses its selection / scroll position. Those tools buffer
+  results and flush them with a `DispatcherTimer` (reference: `IPScannerViewModel.FlushResultsBuffer`).
 
 ## Dialogs and confirmations
 
@@ -147,6 +154,25 @@ Reference: `HostsFileEditorView.xaml`, `FirewallView.xaml`.
   profile → group → settings. The same option should have the same label, default and validation in the
   settings page, the profile dialog and the group dialog.
 
+## Navigation and run command
+
+Reference: `NavigationManager`, `ApplicationRequest`, `IPScannerHostView.Open`, `RunCommandManager`.
+
+- "Open in <other tool>" (context menus, buttons) calls `NavigationManager.Open(new ApplicationRequest(app) { Target = ... })`
+  or a derived request with the tool's extra options (`PortScannerRequest.Ports`, `DNSLookupRequest`, `RDAPRequest`,
+  `WakeOnLANRequest`, ...). Don't reference other view models or views directly.
+- The main window switches to the tool and calls `IApplicationRequestHandler.Open(request)` on its view; host views
+  turn it into `AddTab(target or profile, start: request.Start)`. `Start = false` only fills in the input (the user can
+  adjust options first). A request for a hidden application shows an error.
+- Every tool that accepts a target has a run command (`RunCommandManager.CreateCommands`: lowercase English command +
+  aliases, translated syntax). The target is validated with the **same validator** as the tool's input field and the
+  profile dialog (`ValidateTarget`); drift between these is a finding (see `.claude/reviews/run-command.md`).
+- A new tool option that is useful from the keyboard can become a run command argument/type (and a property on a derived
+  request); update the command table in `Website/docs/run-command.md` and `TargetApplications` (suggestions for a target
+  without a command) when the accepted targets change.
+- Values passed to another tool come from the result (e.g. hostname from DNS/NetBIOS). Pass a value the other tool can
+  actually use (e.g. the IP address when the name is not resolvable by the app's DNS client).
+
 ## PowerShell and external processes
 
 Reference: `Source/NETworkManager.Models/Firewall/Firewall.cs`.
@@ -161,6 +187,10 @@ Reference: `Source/NETworkManager.Models/Firewall/Firewall.cs`.
 - Cmdlet parameters like `-Name` / `-DisplayName` of the `*-NetFirewallRule` cmdlets accept wildcards. IDs and names
   not created by the application (e.g. Windows rules with `[x64]` in the name) must be matched exactly
   (e.g. `Get-NetFirewallRule | Where-Object Name -eq ...`), otherwise a different or no item is changed.
+- Custom commands (`CustomCommandInfo`, `PlaceholderHelper`, e.g. IP Scanner `{{IPAddress}}` / `{{Hostname}}`) insert
+  values into a process command line. Values received from the network (DNS PTR, NetBIOS name, SNMP, HTTP) are
+  untrusted: with `cmd.exe /c ...` characters like `&` or `|` run other commands. Only insert values that match the
+  expected format (IP address, hostname regex).
 
 ## Strings, docs and changelog
 
 
@@ -16,7 +16,8 @@ sort the hits into the categories below. Some names differ between places (e.g.
 | Area | Location | What to check there |
 |---|---|---|
 | Registration | `Source/NETworkManager.Models/ApplicationName.cs`, `ApplicationManager.cs` (name, icon, default visibility) | Icon matches the one used elsewhere for the tool |
-| Main window | `Source/NETworkManager/MainWindow.xaml.cs` — view creation (`case ApplicationName.X`), `OnViewHide`/`OnViewVisible`, `AddTab(...)` for "open in other tool" | View lifecycle: what keeps running when hidden |
+| Main window | `Source/NETworkManager/MainWindow.xaml.cs` — view creation (`case ApplicationName.X`), `OnViewHide`/`OnViewVisible`, `NavigationManager_ApplicationRequested` (passes requests to the view) | View lifecycle: what keeps running when hidden |
+| Navigation ("open in other tool") | `Source/NETworkManager/NavigationManager.cs` (`Open(request)`, `OpenSettings()`), `ApplicationRequest.cs` (`Target`, `Profile`, `Start` + derived requests like `PortScannerRequest`, `WakeOnLANRequest`), `IApplicationRequestHandler` implemented by `<Tool>HostView.xaml.cs` (`Open(request)` → `AddTab(...)`) | Tool accepts target **and** profile, honours `Start = false` (fill in only), context menu items of other tools use `NavigationManager.Open` |
 | Business logic | `Source/NETworkManager.Models/<Tool>/` or `Source/NETworkManager.Models/Network/<Tool>*.cs` (+ `*Options`, `*Info`, `*Args`) | Bugs, performance, cancellation, events |
 | View model | `Source/NETworkManager/ViewModels/<Tool>ViewModel.cs`, `<Tool>HostViewModel.cs` (tabs + profiles), `<Tool>SettingsViewModel.cs`, dialog view models | Commands, `CanExecute`, state flags, threading |
 | View | `Source/NETworkManager/Views/<Tool>View.xaml(.cs)`, `<Tool>HostView.xaml`, `<Tool>SettingsView.xaml`, `*ChildWindow.xaml` | Layout, context menus, bindings, shortcuts |
@@ -26,8 +27,8 @@ sort the hits into the categories below. Some names differ between places (e.g.
 | Profiles | `Source/NETworkManager.Profiles/ProfileInfo.cs` (`<Tool>_*` fields), `ProfileName.cs`, `ProfileViewManager.cs`, `Application/<Tool>.cs` (build session info from profile + group), `GroupInfo.cs` / `GroupViewName.cs` (group-level settings) | Profile field ↔ group inheritance ↔ settings fallback |
 | Profile UI | `Source/NETworkManager/ViewModels/ProfileViewModel.cs`, `Views/ProfileChildWindow.xaml` (tool tab), `Views/GroupChildWindow.xaml`, `ProfileDialogManager.cs` | Same fields, labels and validation in profile, group and settings |
 | Export | `Source/NETworkManager.Models/Export/ExportManager.<Tool>*.cs`, `ExportChildWindow` | Same columns/formats as similar tools |
-| Run command | `Source/NETworkManager/RunCommandManager.cs` | Arguments/placeholder accepted |
-| Documentation | `Source/NETworkManager.Documentation/DocumentationManager.cs` (help links), `Website/docs/application/<tool>.md`, `Website/docs/settings/*.md`, `Website/docs/commandline-arguments.md` | Docs match behaviour, defaults and shortcuts |
+| Run command | `Source/NETworkManager/RunCommandManager.cs` (command/aliases in `CreateCommands`, suggested apps per target kind in `TargetApplications`, target/argument validators in `ValidateTarget`, request in `CreateRequest`), parser in `Source/NETworkManager.Models/RunCommand/`, dialog `RunCommandViewModel` / `RunCommandChildWindow`, docs `Website/docs/run-command.md` | Same validator as the tool's input field and profile dialog; new options of the tool (e.g. a new input) are reachable via argument/type or deliberately not; command table in the docs matches |
+| Documentation | `Source/NETworkManager.Documentation/DocumentationManager.cs` (help links), `Website/docs/application/<tool>.md`, `Website/docs/settings/*.md`, `Website/docs/commandline-arguments.md`, `Website/docs/run-command.md` | Docs match behaviour, defaults and shortcuts |
 | Strings | `Source/NETworkManager.Localization/Resources/Strings.resx` (+ `Strings.Designer.cs`) | Only `Strings.resx` (English) is edited; other languages come from Transifex |
 | Styles | `Source/NETworkManager/Resources/Styles/*.xaml` (buttons, text blocks, tooltips, rectangles) | Shared styles used instead of local ones |
 | Helpers | `Source/NETworkManager.Utilities/`, `Source/NETworkManager.Utilities.WPF/`, `Source/NETworkManager.Converters/`, `Source/NETworkManager.Validators/`, `Source/NETworkManager/DialogHelper.cs` | Existing helper not reused / duplicated logic |
@@ -63,8 +64,10 @@ Cross-cutting areas:
 
 - **Profiles and groups**: `NETworkManager.Profiles`, `ProfilesView`, `ProfileChildWindow`, `GroupChildWindow`,
   profile files, encryption (`Credentials*ChildWindow`), import (CSV/AD), filter/tags, profile panel in host views
-- **Main window and navigation**: `MainWindow.xaml(.cs)`, application list, run command (`CommandLineWindow`,
-  `RunCommandManager`), tray, hotkeys, `StatusWindow`, `NotificationWindow`, welcome/upgrade dialogs
+- **Main window and navigation**: `MainWindow.xaml(.cs)`, application list, `NavigationManager` / `ApplicationRequest`,
+  tray, hotkeys, `StatusWindow`, `NotificationWindow`, welcome/upgrade dialogs
+- **Run command** (`Ctrl+Shift+P`, global hotkey): `RunCommandManager`, `Models/RunCommand/` (parser), `RunCommandViewModel`,
+  `RunCommandChildWindow`, docs `run-command.md`; open items and earlier decisions in `.claude/reviews/run-command*.md`
 - **Export and dialogs**: `ExportManager`, `ExportChildWindow`, `DialogHelper`, message/confirmation child windows
 - **Settings infrastructure**: `SettingsManager` (load/save/upgrade), `LocalSettingsManager`, policies
   (`PolicyManager`, `config.json.example`: settings managed by administrator)
@@ -425,8 +425,12 @@ git diff
 3. Add the tool to `ApplicationName` and `ApplicationManager` (`Source/NETworkManager.Models/`), and show/hide it
    in `MainWindow.xaml.cs` (`OnApplicationViewVisible` / `OnApplicationViewHide`)
 4. Add it to the application list for existing users in `SettingsManager` (upgrade step)
-5. Add documentation in `Website/docs/application/` and map it in `DocumentationManager`
-6. Add localization strings and a changelog entry
+5. If the tool accepts a target or profile: implement `IApplicationRequestHandler` in its (host) view and add a run
+   command in `RunCommandManager` (command, aliases, validator = the one of the input field; suggestions in
+   `TargetApplications`), see [Navigation and Run Command](#navigation-and-run-command)
+6. Add documentation in `Website/docs/application/` (and the command table in `Website/docs/run-command.md`) and map it
+   in `DocumentationManager`
+7. Add localization strings and a changelog entry
 
 ### Adding a New Setting
 
@@ -486,6 +490,23 @@ git diff
 - **Groups**: Hierarchical organization
 - **Import/Export**: Profile sharing capabilities
 
+### Navigation and Run Command
+
+- **Open a tool from code**: `NavigationManager.Open(new ApplicationRequest(ApplicationName.X) { Target = ... })` or a
+  derived request with extra options (`ApplicationRequest.cs`: `PortScannerRequest`, `DNSLookupRequest`, `RDAPRequest`,
+  `WakeOnLANRequest`, `SubnetCalculatorRequest`, `LookupRequest`). Used for "open in other tool" context menus
+  (e.g. IP Scanner, Traceroute, Network Interface) and the run command. `Profile` runs a profile, `Start = false` only fills in the input.
+- **MainWindow** switches to the tool and calls `IApplicationRequestHandler.Open(request)` on its view (host views call
+  `AddTab(...)`). Don't reference other tools' views or view models directly.
+- **Run command** (`Ctrl+Shift+P`, title bar box, optional global hotkey): parser in
+  `Source/NETworkManager.Models/RunCommand/`, commands, validation and requests in `Source/NETworkManager/RunCommandManager.cs`,
+  dialog in `RunCommandViewModel` / `RunCommandChildWindow`, docs in `Website/docs/run-command.md`. The run command must
+  validate a target with the same validator as the tool's input field and profile dialog.
+- **Large lists**: `ObservableRangeCollection<T>.ReplaceAll(items)` (`Source/NETworkManager.Controls/`) replaces all items
+  with a single `Reset` notification. Use it for lists that are reloaded completely (e.g. Firewall rules, run command
+  suggestions); not for results that are appended while a scan runs (those are buffered and flushed by a timer, see
+  `IPScannerViewModel`).
+
 ### Embedded Tools Integration
 
 - **Remote Desktop**: Native RDP using `AxMSTSCLib`, `AxMsRdpClient10NotSafeForScripting` and `WindowsFormsHost`
@@ -508,7 +529,10 @@ git diff
 11. **Check CI Status**: Both AppVeyor (main build) and GitHub Actions (CodeQL, website) must pass
 12. **Dependency Updates**: Dependabot automatically creates PRs for dependency updates
 13. **Conventions and reviews**: Read `.claude/skills/feature-review/references/conventions.md` before changing UI or ViewModel code; use the `feature-review` skill to review a whole tool
-14. **Windows only**: The solution can't be built on Linux/macOS (WPF, CsWinRT) — say so when changes couldn't be compiled, and list what needs to be tested on Windows
+14. **Plans and reviews**: Local (not committed) plans and review results are in `.claude/plans/` and `.claude/reviews/`
+    (e.g. `.claude/reviews/ip-scanner.md`). Read the file for the area you work on first — it lists verified findings,
+    decisions and open items
+15. **Windows only**: The solution can't be built on Linux/macOS (WPF, CsWinRT) — say so when changes couldn't be compiled, and list what needs to be tested on Windows
 
 ## Glossary