@@ -2111,8 +2111,12 @@ def _command_toolbar_context(self) -> Iterator[None]:
             yield
         finally:
             with self.sigint_protection:
-                toolbar.stop()
-                self._command_toolbar = None
+                try:
+                    toolbar.stop()
+                finally:
+                    # Always forget a toolbar that has been torn down. Keeping a failed
+                    # one would disable the toolbar for the rest of the session.
+                    self._command_toolbar = None
 
     def get_rprompt(self) -> AnyFormattedText:
         """Provide text to populate the prompt-toolkit right prompt.
@@ -3374,37 +3378,50 @@ def _redirect_output(self, statement: Statement) -> utils.RedirectionSavedState:
                 if shell:
                     kwargs["executable"] = shell
 
-            # Capture subprocess output when it must pass through a Python stream,
-            # including the toolbar proxy which prints above the running display.
-            proc = subprocess.Popen(  # noqa: S602
-                statement.redirect_to,
-                stdin=subproc_stdin,
-                stdout=subprocess.PIPE
-                if isinstance(self.stdout, (utils.StdSim, command_toolbar.ToolbarStream))  # type: ignore[unreachable]
-                else self.stdout,
-                stderr=subprocess.PIPE
-                if isinstance(sys.stderr, (utils.StdSim, command_toolbar.ToolbarStream))
-                else sys.stderr,
-                shell=True,
-                **kwargs,
+            # Hand the pipe process the real terminal when there is one to inherit, since it
+            # may be interactive. Otherwise capture its output so it can pass through a Python
+            # stream, including the toolbar proxy which prints above the running display.
+            pipe_stdout = (
+                None
+                if isinstance(self.stdout, utils.StdSim)  # type: ignore[unreachable]
+                else command_toolbar.pipe_target(self.stdout)
             )
+            pipe_stderr = None if isinstance(sys.stderr, utils.StdSim) else command_toolbar.pipe_target(sys.stderr)
+
+            with contextlib.ExitStack() as terminal_stack:
+                # The toolbar can neither draw nor hold the keyboard while a pipe process owns
+                # the terminal, so step aside until that process has finished.
+                if pipe_stdout is not None or pipe_stderr is not None:
+                    terminal_stack.enter_context(self.suspend_bottom_toolbar())
+
+                proc = subprocess.Popen(  # noqa: S602
+                    statement.redirect_to,
+                    stdin=subproc_stdin,
+                    stdout=subprocess.PIPE if pipe_stdout is None else pipe_stdout,
+                    stderr=subprocess.PIPE if pipe_stderr is None else pipe_stderr,
+                    shell=True,
+                    **kwargs,
+                )
 
-            # Popen was called with shell=True so the user can chain pipe commands and redirect their output
-            # like: !ls -l | grep user | wc -l > out.txt. But this makes it difficult to know if the pipe process
-            # started OK, since the shell itself always starts. Therefore, we will wait a short time and check
-            # if the pipe process is still running.
-            with contextlib.suppress(subprocess.TimeoutExpired):
-                proc.wait(0.2)
+                # Popen was called with shell=True so the user can chain pipe commands and redirect their output
+                # like: !ls -l | grep user | wc -l > out.txt. But this makes it difficult to know if the pipe process
+                # started OK, since the shell itself always starts. Therefore, we will wait a short time and check
+                # if the pipe process is still running.
+                with contextlib.suppress(subprocess.TimeoutExpired):
+                    proc.wait(0.2)
+
+                # Check if the pipe process already exited
+                if proc.returncode is not None:
+                    subproc_stdin.close()
+                    new_stdout.close()
+                    raise RedirectionError(f"Pipe process exited with code {proc.returncode} before command could run")
+                redir_saved_state.redirecting = True
+                cmd_pipe_proc_reader = utils.ProcReader(proc, self.stdout, sys.stderr)
 
-            # Check if the pipe process already exited
-            if proc.returncode is not None:
-                subproc_stdin.close()
-                new_stdout.close()
-                raise RedirectionError(f"Pipe process exited with code {proc.returncode} before command could run")
-            redir_saved_state.redirecting = True
-            cmd_pipe_proc_reader = utils.ProcReader(proc, self.stdout, sys.stderr)
+                self.stdout = new_stdout
 
-            self.stdout = new_stdout
+                # Hold the suspension open until _restore_output() reaps the pipe process.
+                redir_saved_state.toolbar_suspension = terminal_stack.pop_all()
 
         elif statement.redirector in (constants.REDIRECTION_OVERWRITE, constants.REDIRECTION_APPEND):
             if statement.redirect_to:
@@ -3456,29 +3473,35 @@ def _restore_output(self, statement: Statement, saved_redir_state: utils.Redirec
         :param statement: Statement object which contains the parsed input from the user
         :param saved_redir_state: contains information needed to restore state data
         """
-        if saved_redir_state.redirecting:
-            # If we redirected output to the clipboard
-            if (
-                statement.redirector in (constants.REDIRECTION_OVERWRITE, constants.REDIRECTION_APPEND)
-                and not statement.redirect_to
-            ):
-                self.stdout.seek(0)
-                write_to_paste_buffer(self.stdout.read())
+        # The toolbar gets the terminal back once the pipe process is done with it.
+        with contextlib.ExitStack() as terminal_stack:
+            if saved_redir_state.toolbar_suspension is not None:
+                terminal_stack.callback(saved_redir_state.toolbar_suspension.close)
+                saved_redir_state.toolbar_suspension = None
+
+            if saved_redir_state.redirecting:
+                # If we redirected output to the clipboard
+                if (
+                    statement.redirector in (constants.REDIRECTION_OVERWRITE, constants.REDIRECTION_APPEND)
+                    and not statement.redirect_to
+                ):
+                    self.stdout.seek(0)
+                    write_to_paste_buffer(self.stdout.read())
 
-            with contextlib.suppress(BrokenPipeError):
-                # Close the file or pipe that stdout was redirected to
-                self.stdout.close()
+                with contextlib.suppress(BrokenPipeError):
+                    # Close the file or pipe that stdout was redirected to
+                    self.stdout.close()
 
-            # Restore self.stdout
-            self.stdout = cast(TextIO, saved_redir_state.saved_self_stdout)
+                # Restore self.stdout
+                self.stdout = cast(TextIO, saved_redir_state.saved_self_stdout)
 
-            # Check if we need to wait for the process being piped to
-            if self._cur_pipe_proc_reader is not None:
-                self._cur_pipe_proc_reader.wait()
+                # Check if we need to wait for the process being piped to
+                if self._cur_pipe_proc_reader is not None:
+                    self._cur_pipe_proc_reader.wait()
 
-        # These are restored regardless of whether the command redirected
-        self._cur_pipe_proc_reader = saved_redir_state.saved_pipe_proc_reader
-        self._redirecting = saved_redir_state.saved_redirecting
+            # These are restored regardless of whether the command redirected
+            self._cur_pipe_proc_reader = saved_redir_state.saved_pipe_proc_reader
+            self._redirecting = saved_redir_state.saved_redirecting
 
     def get_command_func(self, command: str) -> BoundCommandFunc[...] | None:
         """Get the bound command function for a command.
 
@@ -44,6 +44,23 @@ def wrapped(self: "Cmd", *args: Any, **kwargs: Any) -> Any:
     return cast(_F, wrapped)
 
 
+def pipe_target(stream: Any) -> Any:
+    """Return the stream a pipe process can inherit, or ``None`` if its output must be captured.
+
+    A pipe process may be interactive, such as ``less`` or ``fzf``, so it needs the real
+    terminal rather than a stream this process reads on its behalf. Look through a
+    :class:`ToolbarStream` wrapper, but only hand back a stream owning a file descriptor.
+    """
+    if isinstance(stream, ToolbarStream):
+        stream = stream.original
+    try:
+        stream.fileno()
+    except (AttributeError, OSError):
+        # io.UnsupportedOperation, raised by streams like io.StringIO, subclasses OSError.
+        return None
+    return stream
+
+
 class _ContextStdoutProxy(StdoutProxy):
     """Keep stdout's flush worker in the toolbar's isolated application session."""
 
@@ -57,19 +74,24 @@ def _start_write_thread(self) -> threading.Thread:
 class ToolbarStream:
     """Keep a stable stream identity across suspensions and cmd2 redirections."""
 
-    def __init__(self, original: TextIO) -> None:
+    def __init__(self, original: TextIO, lock: "threading.RLock") -> None:
         """Wrap a terminal stream while preserving its ordinary file attributes."""
         self.original = original
         self.proxy: StdoutProxy | None = None
+        # Shared with the toolbar so a write from another thread cannot land on a proxy
+        # that is being closed. Such a write is accepted by the dead proxy and discarded.
+        self._lock = lock
         self.buffer = _ToolbarBuffer(self)
 
     def write(self, data: str) -> int:
         """Write above the toolbar, or directly while the toolbar is suspended."""
-        return (self.proxy or self.original).write(data)
+        with self._lock:
+            return (self.proxy or self.original).write(data)
 
     def flush(self) -> None:
         """Flush the currently active output stream."""
-        (self.proxy or self.original).flush()
+        with self._lock:
+            (self.proxy or self.original).flush()
 
     def __getattr__(self, name: str) -> Any:
         """Delegate file attributes to the original terminal stream."""
@@ -117,6 +139,8 @@ def __init__(self, cmd: "Cmd") -> None:
         self._thread: threading.Thread | None = None
         self._streams: list[ToolbarStream] = []
         self._proxy: StdoutProxy | None = None
+        self._lock = threading.RLock()
+        self._pausing = False
 
         session = cmd.main_session
         self.app = session.app
@@ -149,12 +173,19 @@ def interrupt(event: KeyPressEvent) -> None:  # noqa: ARG001
             self._keys.clear()
             if sys.platform == "win32":
                 # os.kill(..., SIGINT) terminates the process on Windows instead
-                # of dispatching Python's signal handler.
+                # of dispatching Python's signal handler. This reaches only this
+                # process, so a console subprocess started by a command keeps
+                # running until it is waited on.
                 import _thread
 
                 _thread.interrupt_main()
             else:
-                os.kill(os.getpid(), signal.SIGINT)
+                # Raw mode clears ISIG, so no signal is generated for us. Signal the
+                # foreground process group the way the terminal driver would, since a
+                # command may be waiting on a subprocess that shares this group. Pipe
+                # processes are excluded because cmd2 starts them in their own session
+                # and forwards to them from sigint_handler().
+                os.killpg(os.getpgrp(), signal.SIGINT)
 
         @bindings.add(
             "c-z",
@@ -184,7 +215,7 @@ def start(self) -> None:
             for obj, name in ((self.cmd, "stdout"), (sys, "stdout"), (sys, "stderr")):
                 stream = getattr(obj, name)
                 if stream.isatty():
-                    wrapper = ToolbarStream(stream)
+                    wrapper = ToolbarStream(stream, self._lock)
                     self._streams.append(wrapper)
                     setattr(obj, name, cast(TextIO, wrapper))
                     stack.callback(self._restore_stream, obj, name, wrapper)
@@ -219,6 +250,7 @@ def run() -> None:
                 self._error = exc
             finally:
                 self._ready.set()
+                self._app_exited()
 
         self._thread = threading.Thread(target=context.run, args=(run,), name="cmd2-toolbar", daemon=True)
         self._thread.start()
@@ -227,32 +259,86 @@ def run() -> None:
             raise self._error
         # The worker already combines queued writes. A batching sleep would also
         # delay close(), which runs at each command finalization boundary.
-        self._proxy = _ContextStdoutProxy(raw=True, sleep_between_writes=0)
-        for stream in self._streams:
-            stream.proxy = self._proxy
+        proxy = _ContextStdoutProxy(raw=True, sleep_between_writes=0)
+        with self._lock:
+            self._proxy = proxy
+            for stream in self._streams:
+                stream.proxy = proxy
+
+    def _app_exited(self) -> None:
+        """Give the terminal back to the streams when the display stops on its own.
+
+        ``_ready`` is set as soon as the first frame renders, so a failure after that is
+        never seen by the command thread waiting in ``_resume()``. The display is gone at
+        that point and its stdout proxy can no longer reach the terminal, so anything
+        written through it would be discarded without a trace.
+        """
+        if self._pausing:
+            # A deliberate pause restores the streams itself, in the right order.
+            return
+
+        with self._lock:
+            # Leave self._proxy set so that the next _pause() still drains and closes
+            # it. With the display gone, its worker writes to the terminal directly.
+            started = self._proxy is not None
+            for stream in self._streams:
+                stream.proxy = None
+
+        # A proxy exists only once _resume() has handed startup failures to the command
+        # thread, so reporting here does not duplicate the exception it raises.
+        if started and self._error is not None:
+            self.cmd.perror(f"Bottom toolbar stopped after an error: {self._error!r}")
+
+    def _exit(self) -> None:
+        """Stop the display unless it has already stopped on its own.
+
+        Application.exit() raises once the result is set, and this runs later than the
+        check that scheduled it. Any exception here would reach the loop's default
+        handler, which prints a traceback over the terminal.
+
+        Output queued before this does not need draining: Application.run_async() waits
+        for cursor position reports and for run_in_terminal() calls still in flight
+        before its loop closes.
+        """
+        if self.app.is_running and not self.app.is_done:
+            self.app.exit()
 
     def _pause(self) -> None:
+        self._pausing = True
         try:
-            if self._proxy is not None:
-                self._proxy.flush()
-                self._proxy.close()
+            try:
+                # Hold off other threads while the proxy drains so their output is never
+                # handed to a proxy whose worker has already stopped. Writes that arrive
+                # after this go straight to the terminal, still in order.
+                with self._lock:
+                    try:
+                        if self._proxy is not None:
+                            self._proxy.flush()
+                            self._proxy.close()
+                    finally:
+                        self._proxy = None
+                        for stream in self._streams:
+                            stream.proxy = None
+            finally:
+                # The lock is released before joining, since the toolbar thread may be
+                # blocked writing through a stream that is waiting on it.
+                if self.app.is_running and self.app.loop is not None:
+                    self.app.loop.call_soon_threadsafe(self._exit)
+                if self._thread is not None:
+                    self._thread.join()
+                    self._thread = None
+                # Return the borrowed application to the main prompt, including on
+                # proxy failures. The upstream toolbar owned a separate application.
+                if self._display_stack is not None:
+                    self._display_stack.close()
+                    self._display_stack = None
+                # Application.run() saves its unprocessed queue before the thread
+                # exits. Those keys arrived after the ones handled by save_key().
+                pending_keys = get_typeahead(self.app.input)
+                store_typeahead(self.app.input, self._keys + pending_keys)
+                self._keys.clear()
         finally:
-            self._proxy = None
-            for stream in self._streams:
-                stream.proxy = None
-            if self.app.is_running and self.app.loop is not None:
-                self.app.loop.call_soon_threadsafe(self.app.exit)
-            if self._thread is not None:
-                self._thread.join()
-                self._thread = None
-            if self._display_stack is not None:
-                self._display_stack.close()
-                self._display_stack = None
-            # Application.run() saves its unprocessed queue before the thread
-            # exits. Those keys arrived after the ones handled by save_key().
-            pending_keys = get_typeahead(self.app.input)
-            store_typeahead(self.app.input, self._keys + pending_keys)
-            self._keys.clear()
+            self._pausing = False
 
     def stop(self) -> None:
         """Flush output, stop rendering, and restore the terminal and its streams."""
 
@@ -690,6 +690,9 @@ def __init__(
         self.saved_pipe_proc_reader = pipe_proc_reader
         self.saved_redirecting = saved_redirecting
 
+        # Holds the bottom toolbar's suspension while a pipe process owns the terminal
+        self.toolbar_suspension: contextlib.ExitStack | None = None
+
 
 def categorize(func: Callable[..., Any] | Iterable[Callable[..., Any]], category: str) -> None:
     """Categorize a function.
 
@@ -125,14 +125,23 @@ The embedded pager provides basic navigation and search; applications that need
 features can use this opt-out.
 
 cmd2 temporarily hides the toolbar for its input prompts, external pagers, Python environments, and
-shell commands. It restores the toolbar when those operations finish. For custom terminal UIs, calls
-to `input()`, or subprocesses that inherit the terminal, use [cmd2.Cmd.suspend_bottom_toolbar][]:
+shell commands. It also hides it while a command's output is piped to another process, since that
+process may be interactive, as `less` and `fzf` are. It restores the toolbar when those operations
+finish.
+
+For custom terminal UIs, calls to `input()`, or subprocesses your own command code starts, use
+[cmd2.Cmd.suspend_bottom_toolbar][]:
 
 ```py
 with self.suspend_bottom_toolbar():
     answer = input("Continue? ")
 ```
 
+Suspending matters for subprocesses even when they only print. While the toolbar is displayed, the
+terminal is in raw mode, so the kernel generates no signals from keystrokes. cmd2 sends `Ctrl-C` on
+to its own process group, which reaches a subprocess your command started and waits on, but `Ctrl-\`
+(`SIGQUIT`) does nothing, exactly as at the main prompt.
+
 The command toolbar is used by the interactive command loop, including startup commands and scripts
 launched from that loop. It is disabled for non-interactive input. Calls to `onecmd_plus_hooks()`
 outside the command loop do not start a toolbar.