diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ad947cb..1418b4d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,4 +1,4 @@
-# Lints the QuPath script (LabConstrictorTools.groovy) with npm-groovy-lint (CodeNarc rules); the rules are set in .groovylintrc.json.
+# Lints the QuPath script (the files listed in parts.txt, joined into one) with npm-groovy-lint (CodeNarc rules); the rules are set in .groovylintrc.json.
 #
 # The GUI tests in tests/ run in their own workflow, qupath-gui.yml.
 name: lint
@@ -20,9 +20,27 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
+      - name: Part files stay below 600 lines (LabConstrictorTools.groovy is the grandfathered main script, from before the split)
+        run: |
+          RES=src/main/resources/org/cellmigrationlab/labconstrictor/qupath
+          status=0
+          while IFS= read -r part || [ -n "$part" ]; do
+            [ -z "$part" ] || [ "$part" = "LabConstrictorTools.groovy" ] && continue
+            lines=$(wc -l < "$RES/$part")
+            echo "$part: $lines lines"
+            [ "$lines" -lt 600 ] || { echo "::error file=$RES/$part::$part has $lines lines (the limit is 600): split it into a new file and list it in parts.txt"; status=1; }
+          done < "$RES/parts.txt"
+          exit $status
+      - name: Join the script files (parts.txt) into the one script the extension runs
+        # CodeNarc reads one file at a time, so a class used from another file would not resolve: the joined text is what is linted
+        run: |
+          RES=src/main/resources/org/cellmigrationlab/labconstrictor/qupath
+          mkdir lint-input
+          { while IFS= read -r part || [ -n "$part" ]; do [ -z "$part" ] || { cat "$RES/$part"; echo; }; done < "$RES/parts.txt"; } > lint-input/LabConstrictorTools-all.groovy
       - name: Lint the script (fails on any finding)
         run: >
           npx --yes npm-groovy-lint@18.0.0
-          --path src/main/resources/org/cellmigrationlab/labconstrictor/qupath
+          --path lint-input
           --files "**/*.groovy"
+          --config .groovylintrc.json
           --failon info
diff --git a/README.md b/README.md
index fd7feaa..a137add 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,9 @@ so QuPath never imports the app's packages and needs no Python of its own. Same
 2. Drop `labconstrictor-qupath-0.1.0.jar` on the QuPath window (or into the QuPath extensions folder) and restart QuPath.
 3. **Extensions > LabConstrictor tools...**
 
-Without the jar: open `src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy` in QuPath's Script Editor and run it.
+Without the jar: the script is several files now (`src/main/resources/org/cellmigrationlab/labconstrictor/qupath/`, joined in the order of `parts.txt`; the first is the main script). `./build.sh` also writes `target/LabConstrictorTools-all.groovy`, all of them in one file: open that one in QuPath's Script Editor and run it. The main script alone no longer runs.
+
+Needs **labconstrictor-tools 0.3.0a1 or newer** in the app's environment (the run record and the clean-up use its helpers and its `prune` command). A run of an app with an older one is refused with `this app's labconstrictor-tools 0.2.0rc1 is older than the 0.3.0a1 this host needs: update it`.
 
 ## What it does
 * Pick an app and a tool. Numbers (range, unit), choices, checkboxes, text, files and folders become fields; parameters of a group sit under a heading, advanced ones in a collapsed section, optional ones without a default have a "set" box (unticked = the tool gets nothing), and `enabled_when` greys fields out.
@@ -21,7 +23,8 @@ Without the jar: open `src/main/resources/org/cellmigrationlab/labconstrictor/qu
 * **Points** found in the image that is open in QuPath become a point annotation named `<app>:<output>` (replaced by the next run when the output declares `Replace()`); points of any other image are shown as a table.
 * "No match" is a message, not an error. Progress bar, Cancel (a tool that ignores it is killed after 3 s), worker kept between runs (or not), details of the last run, no worker left behind when the window closes.
 * **Trust checks** on every registry entry (same rules as the Python registry and the Fiji script): the entry names its five text fields; the app name is a plain name; the interpreter lies inside the install prefix (which is not a filesystem root); the entry and its schema file are owned by you (in a shared folder also by root) and not writable by group or others; the schema sits next to the entry; the interpreter, its folder and the prefix are not writable by everybody (a sticky folder like `/tmp` excepted); tool ids and parameter names are plain names, parameter names Python identifiers (a parameter name becomes a file name). An entry that fails is listed under "skipped" with its reason and never started. On Windows the owner and permission checks do not apply.
-* Results are kept in `~/.labconstrictor/results/<time>_<6 hex>_<app>_<tool>` (names made safe), like the command line. The host never deletes a results folder or a run record (retention belongs to the Tools reference code, QuPath issue #14). Every run that reached the tool leaves a record `~/.labconstrictor/runs/<time>_<app>_<tool>/run.json` (none ever deleted by the host, the Tools format plus `"host": "qupath"`), and every log line is also appended to the shared `~/.labconstrictor/logs/labconstrictor.log` (Tools line format, `qupath:` prefix, 1 MB rotation with 5 backups), so `labconstrictor-tools logs` and `support-bundle` see QuPath runs.
+* **Results and run records, and their clean-up** (SPEC_WRONG_SCIENCE section 3). Each run makes a results folder `~/.labconstrictor/results/<time>_<6 hex>_<app>_<tool>` (names made safe, like the command line) and a run record folder `~/.labconstrictor/runs/<time>_<app>_<tool>`. **This host never deletes anything there.** It writes the two marker files of the spec: `.lc-owner.json` first, when the folder is made (a QuPath that dies mid-run leaves an owned, unfinished folder that nobody removes), and `.lc-done.json` last, atomically, when the run ends: `ok` (completed), `cancelled` (the tool honoured Cancel, or the worker had to be killed after Cancel was pressed, or the window was closed during the run), `failed` (the tool failed, or the worker died with no Cancel pressed). The status comes from the Tools helper `labconstrictor_tools.runs.done_status`. Then it starts `labconstrictor-tools prune` (`<the app's Python> -m labconstrictor_tools prune`) in a subprocess and does not wait for it: the newest 20 finished results and the newest 50 run records are kept, and Tools removes the older ones, **only** folders that carry a valid owner marker and a done marker. Folders from older versions (no marker), foreign folders, folders of runs that are still going or that crashed with QuPath (no done marker), links and files are never removed and do not use up the quota. A prune that cannot start, or that fails, is written to the log (`prune could not be started ...` / `prune ended with exit code N`) and never fails or delays the run; the folders then stay until a `prune` works. The older folders written by earlier versions of this script have no marker, so they are never cleaned up automatically (Tools has a follow-up item for an explicit `clean --legacy`).
+* **Run record** `runs/<...>/run.json`: built by the Tools helper `labconstrictor_tools.runs.build_record` and written with `record_json` (this script keeps no copy of the layout), plus `"host": "qupath"`, the `run_id` and `started_utc` of the run, and the `_calibration` input. A crash after Cancel keeps its crash text there (status `CRASHED`). If the record cannot be built (the app's Python cannot start, the helper fails) the status line says `(the run record could not be written (...); its folders stay as they are and are never removed)`. Every log line is also appended to the shared `~/.labconstrictor/logs/labconstrictor.log` (Tools line format, `qupath:` prefix, 1 MB rotation with 5 backups), so `labconstrictor-tools logs` and `support-bundle` see QuPath runs.
 * **Same rules as the other hosts** (the host-parity inventory of labconstrictor-tools): a form shows parameters in the Napari/Fiji order (a group gathered where it first appears; a Collapsed group is folded where it first appears; advanced last); `clear_after_run` resets every type of field; `enabled_when` follows text, number, choice, yes/no and "set" drivers (`""` counts as unset, numbers compare as numbers); a whole-number box holds ±(2^53 - 1) at most, declared limits or not (the largest whole number a double holds exactly, Tools `notebook.MAX_FORM_INTEGER`; a typed number beyond it stops at the limit), a decimal box without declared limits ±1e15; a choice of integers is sent as an integer; a missing input says `'L' is required`; NaN is refused with `'L' must be a finite number`; a folder input must be a folder; a worker that is idle for 10 minutes is closed; a worker ended after Cancel reads `cancelled (worker stopped)`; a worker that died is explained with the Tools sentences (a missing package first, then the exit code); a tool with a parameter type this host does not know is refused alone (`this tool cannot be shown: ...`); two tools with one label are listed as `label (id)` and the apps are sorted by name; `Copy as command` writes Python text the way `repr` does (a newline cannot break the snippet) and says `there is no clipboard to copy to` when there is none; message results show `- ` items as bullets; a result file that is missing, or a result type this version does not know, is said in one sentence.
 
 ## Pixel size (calibration)
@@ -56,6 +59,15 @@ The tool receives only the area; **results come back on the right place of the s
 
 The downsample of an export is 1 for now and is kept next to the offset (`downsample`, always 1.0), so the later resolution step changes one place.
 
+## Run identity (SPEC_WRONG_SCIENCE section 4)
+A run is placed on the image it was exported from, never on whatever is open when it ends.
+
+* **Frozen at the click.** When Run is pressed (on the FX thread, before any worker call) the host freezes the run: a `run_id` (uuid4), the app and tool, the form values, the plane, the Image areas, the **`ImageData` object** each "Current image" input came from (with its shape: width, height, planes, time points, channels), and the **ROIs of the selected annotations** (ROIs are immutable objects: the copy is by value). The export, the mask of a RegionOf selection, the request, the run record and the placement of the results read this and nothing live: opening another image, selecting other annotations or switching the tool or the app while the tool runs changes nothing that was sent or drawn (RUN-02, RUN-03). The text of the chooser (`Current image: slide A`) is only a name for sentences, never identity.
+* **The chooser follows QuPath.** When the open image changes, the "Current image: ..." entry of every image chooser names the image that is open now (everything else in the form stays). A run whose chooser names another image than the open one is refused (`'Image': 'A' is no longer the image open in QuPath ('B' is): choose the image again`) instead of exporting B under A's name.
+* **Placement checks identity first.** Points and outlines are drawn only on that very `ImageData` (the image the run started on), and only while a viewer still shows it with the shape it was exported with. The image may be in another viewer than the active one: the results go to it, never to the active image. If the image was replaced or closed while the tool ran, nothing is drawn, the files stay in the results folder, the run record is written, and the status line reads (conformance `target_unavailable`): `run <run_id> on 'A': 'A' is no longer open; results are in <path>`. If it is still shown but has another shape (a script replaced its server; practically only a script can do this in QuPath): `run <run_id> on 'A': 'A' changed size while the tool ran; results are in <path>`; the two sentences are never swapped, both are logged with the code `target_unavailable`. A run on a project image or a file has no open image to draw on and says so as before.
+* **What a drawn result carries.** Every annotation a run draws has the metadata `labconstrictor.run_id`, `labconstrictor.app` and `labconstrictor.tool` of **that run** (not of the tool the form shows later); the results window keeps the run id as its `userData`; the run record has `run_id` and `started_utc`. A tool or app switched while a run goes on is never cleared or rebound by the finish of that run (`ClearAfterRun` resets only the form the run was started from).
+* RUN-05 (a Napari layer is moved) does not apply: an `ImageData` has no transform.
+
 ## Fallbacks (intended)
 Each of these is deliberate and is written once to QuPath's log (logger `labconstrictor`) when it happens. Every other failure is logged with its stack trace and shown to the person (status line or Details).
 
@@ -108,6 +120,10 @@ The `gui_test_parity_*` bodies need the registered `interactions` app (its Pytho
 
 `BODY=gui_test_parity_host_body.groovy LC_HOME=<scratch folder named lhome_host> tests/run_gui_test.sh` checks the tool chooser, an unsupported parameter type, folder inputs, the Python literal (also read back by Python), bullets, missing result files, a failing clipboard and the crash sentences (fake interpreters that print and exit); a missing image file is refused with the sentence, a missing table is left to the worker, a clipboard that refuses or throws is said (49 checks).
 
+`BODY=gui_test_retention_body.groovy LC_HOME=<scratch folder named lhome_retention> tests/run_gui_test.sh` runs HRET-01..06, RET-10 and RET-11 of `conformance.json` against the `runs` test app (`tests/runs_app`, registered by `tests/ci_setup_apps.sh`): the markers, their validity judged by Tools itself (`prune --dry-run --json`), the `prune` subprocess replaced by a recorder, by a failing and by a missing command, 60 runs with foreign and old folders that must survive, the REAL `prune` (newest 20 and 50 kept; legacy, foreign, unfinished, renamed and linked folders untouched), a worker killed after Cancel (`cancelled`) and one that dies (`failed`), the Tools-too-old refusals, and a scan that the script has no code that deletes under `results/` or `runs/`.
+
+`BODY=gui_test_identity_body.groovy LC_HOME=<scratch folder named lhome_identity> tests/run_gui_test.sh` runs RUN-01..04, 06 and 07 of `conformance.json` through the real dialog with the delayed tool of the `runs` app (a gate file is the barrier): the image is changed, closed or kept in a second viewer, the selection is changed during the export (a hook on the run thread), the tool and the app are switched while the run goes, and the shape of the image is changed (by reflection: nothing else can do it).
+
 `BODY=gui_test_parity_lifecycle_body.groovy LC_HOME=<scratch folder named lhome_life> tests/run_gui_test.sh` checks results folder names and that no folder is ever deleted, the byte limit, the shapes cap sentence and the idle worker (28 checks).
 
 `BODY=gui_test_parity_cancel_body.groovy tests/run_gui_test.sh` cancels the Playground's "ignores Cancel" tool and checks `cancelled (worker stopped)` (9 checks; needs the Playground in `LC_HOME`).
@@ -120,9 +136,12 @@ The `gui_test_parity_*` bodies need the registered `interactions` app (its Pytho
 
 ### Lint (runs in CI) and what CI does not run
 
-`.github/workflows/lint.yml` lints `LabConstrictorTools.groovy` with `npm-groovy-lint` (pinned version, CodeNarc rules, config in `.groovylintrc.json`; each disabled rule has its reason there). It fails on any finding, including info. Run it locally (needs Node and Java):
+`.github/workflows/lint.yml` lints the script (the files listed in `parts.txt`, joined into one file, which is what the extension runs) with `npm-groovy-lint` (pinned version, CodeNarc rules, config in `.groovylintrc.json`; each disabled rule has its reason there). It fails on any finding, including info. Run it locally (needs Node and Java):
+
+    mkdir -p lint-input && cp target/LabConstrictorTools-all.groovy lint-input/        # ./build.sh writes it (the files of parts.txt joined)
+    npx --yes npm-groovy-lint@18.0.0 --path lint-input --files "**/*.groovy" --config .groovylintrc.json --failon info
 
-    npx --yes npm-groovy-lint@18.0.0 --path src/main/resources/org/cellmigrationlab/labconstrictor/qupath --files "**/*.groovy" --failon info
+The same workflow fails when a part file (all but the older main script) has 600 lines or more: new code goes into a new file listed in `parts.txt`.
 
 ### GUI tests in CI
 
diff --git a/build.sh b/build.sh
index 01f10ac..9ad148d 100755
--- a/build.sh
+++ b/build.sh
@@ -8,3 +8,7 @@ rm -rf target/classes && mkdir -p target/classes
 cp -r src/main/resources/* target/classes/
 "${JAVA_HOME:+$JAVA_HOME/bin/}jar" cf target/labconstrictor-qupath-0.1.0.jar -C target/classes .
 echo "built target/labconstrictor-qupath-0.1.0.jar"
+# one file with the whole script, for QuPath's Script Editor (the jar joins the files listed in parts.txt itself)
+RES=src/main/resources/org/cellmigrationlab/labconstrictor/qupath
+{ while IFS= read -r part || [ -n "$part" ]; do [ -z "$part" ] || { cat "$RES/$part"; echo; }; done < "$RES/parts.txt"; } > target/LabConstrictorTools-all.groovy
+echo "built target/LabConstrictorTools-all.groovy (all parts in one file, for the Script Editor)"
diff --git a/docs/user-guide.md b/docs/user-guide.md
index f968509..f0be880 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -32,6 +32,9 @@ Choose **Extensions > LabConstrictor tools...**, pick an app and a tool, and pre
 ## If something does not work
 
 - The status line and **Details** show what failed. The log is `~/.labconstrictor/logs/labconstrictor.log`.
+- Results and run records are kept in `~/.labconstrictor/results` and `~/.labconstrictor/runs`. The extension never deletes them; after each run it starts `labconstrictor-tools prune`, which keeps the newest 20 results and 50 run records and removes only folders LabConstrictor made and finished. Folders from older versions of the extension are not removed automatically.
+- The app's `labconstrictor-tools` must be 0.3.0a1 or newer; with an older one the run is refused and the status line says to update it.
+- If you open another image while a tool runs, the results are not drawn on the new image: the status line says where the files are.
 - `labconstrictor-tools doctor` shows which apps are registered.
 
 Source and issues: [LabConstrictor-QuPath](https://github.com/CellMigrationLab/LabConstrictor-QuPath).
diff --git a/src/main/java/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorExtension.java b/src/main/java/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorExtension.java
index 9741d66..44e3f93 100644
--- a/src/main/java/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorExtension.java
+++ b/src/main/java/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorExtension.java
@@ -18,7 +18,9 @@
  * QuPath has started.
  */
 public class LabConstrictorExtension implements QuPathExtension {
-    private static final String SCRIPT = "/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy";
+    private static final String FOLDER = "/org/cellmigrationlab/labconstrictor/qupath/";
+    /** The script files in the order they are joined into one Groovy script (the file names are the lines of parts.txt; the first is the main script). */
+    private static final String PARTS = FOLDER + "parts.txt";
 
     @Override
     public void installExtension(QuPathGUI qupath) {
@@ -47,9 +49,7 @@ private void run(QuPathGUI qupath, String testFile) {
             if (testFile != null) {
                 text = new String(Files.readAllBytes(Paths.get(testFile)), StandardCharsets.UTF_8);
             } else {
-                try (InputStream in = getClass().getResourceAsStream(SCRIPT)) {
-                    text = new String(in.readAllBytes(), StandardCharsets.UTF_8);
-                }
+                text = joinedScript();
             }
             Binding binding = new Binding();
             binding.setVariable("qupath", qupath);
@@ -61,6 +61,27 @@ private void run(QuPathGUI qupath, String testFile) {
         }
     }
 
+    /** The text of every script file listed in parts.txt, one after the other, as one script (what tests/run_gui_test.sh and build.sh also do). */
+    private String joinedScript() throws java.io.IOException {
+        StringBuilder all = new StringBuilder();
+        for (String line : resourceText(PARTS).split("\\R")) {
+            String name = line.trim();
+            if (!name.isEmpty()) {
+                all.append(resourceText(FOLDER + name)).append('\n');
+            }
+        }
+        return all.toString();
+    }
+
+    private String resourceText(String path) throws java.io.IOException {
+        try (InputStream in = getClass().getResourceAsStream(path)) {
+            if (in == null) {
+                throw new java.io.IOException("the resource " + path + " is missing from the extension jar");
+            }
+            return new String(in.readAllBytes(), StandardCharsets.UTF_8);
+        }
+    }
+
     @Override
     public String getName() {
         return "LabConstrictor tools";
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
index 9495d39..ccb548c 100644
--- a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
@@ -5,7 +5,9 @@
  * tool's declared schema (see https://github.com/CellMigrationLab/LabConstrictor-Tools, docs/PROTOCOL.md); the tool runs in the app's
  * own Python environment through the LabConstrictor worker (JSON lines on stdin/stdout), so QuPath never imports the app's packages.
  *
- * Use it as the extension jar (Extensions > LabConstrictor tools...) or paste it in the Script Editor and run it.
+ * Use it as the extension jar (Extensions > LabConstrictor tools...). The script is several files, joined in the order of parts.txt (this file first; the others hold the
+ * compatibility check LcCompat, retention and run records LcRetention, run identity LcRunIdentity, and any file added after them): this file alone does not run, because the classes it
+ * uses are in the others. `./build.sh` also writes target/LabConstrictorTools-all.groovy, the whole script in one file, to paste in the Script Editor and run.
  *
  * Sections, in file order: logging (LcLog), JSON (LcJson), image area (LcArea), calibration (LcUnits, LcCal, LcTiff, LcLink), registry and trust checks (LcRegistry), the worker (LcWorker), the dialog (LcDialog:
  * form, copy as command, request, running, results) and the entry point.
@@ -828,39 +830,6 @@ class LcRegistry {
     }
 }
 
-// ---------------------------------------------------------------------------------------------------- run records
-/** One folder per run under <LC_HOME>/runs with a run.json, in the format of labconstrictor_tools.runs (a host never deletes a record: retention belongs to the Tools reference code), so that
- *  `labconstrictor-tools support-bundle` finds QuPath runs. A record holds file paths and the values passed, never image or table contents. */
-class LcRuns {
-    static final Map<String, String> STATUS = [COMPLETION: "COMPLETE", FAILURE: "FAILED", CANCELATION: "CANCELED", CRASH: "CRASHED"]   // the worker's response types as the client names them
-
-    static File runsDir() { return new File(LcRegistry.home(), "runs") }
-
-    /** Writes the record of one finished run and returns its folder, or null (said in the log) when it cannot be written: a record never breaks a run.
-     *  `run` holds entry (the registry entry of the app), app, tool, inputs, outcome (the worker's last message), seconds and stderr (the worker's output). */
-    static File record(Map run) {
-        def (entry, app, toolId, inputs, outcome, seconds, stderr) = [run.entry, run.app as String, run.tool as String, run.inputs as Map, run.outcome as Map, run.seconds as double, run.stderr as String]
-        try {
-            def now = java.time.Instant.now()
-            def stamp = java.time.format.DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmssSSSSSS").withZone(java.time.ZoneOffset.UTC).format(now)
-            def folder = new File(runsDir(), stamp + "_" + LcDialog.slug(app) + "_" + LcDialog.slug(toolId))
-            folder.mkdirs()
-            def outputs = outcome.outputs instanceof Map ? outcome.outputs : [:]
-            def content = [
-                app: app, app_version: entry.version, tool: toolId, host: "qupath", finished_utc: now.toString(), seconds: Math.round(seconds * 100) / 100d,
-                status: STATUS[outcome.responseType] ?: outcome.responseType, error: outcome.error, code: outcome.code, traceback: outcome.trace ?: outcome.traceback,
-                inputs: inputs.findAll { k, v -> k != "_job_dir" },      // the host-owned folder is not a user input
-                results: (outputs.results ?: []).collect { r -> r.findAll { k, v -> k != "matrix_yx" } },
-                timings: outputs.timings, interpreter: outputs.diagnostics, stderr_tail: (stderr ?: "").takeRight(LcConst.RUN_STDERR_CHARS)]
-            new File(folder, "run.json").setText(LcJson.pretty(content), "UTF-8")
-            return folder
-        } catch (IOException | RuntimeException e) {      // broad on purpose: whatever goes wrong here must not break the run, but its absence must be visible
-            LcLog.warn("could not write the run record for " + app + " " + toolId, e)
-            return null
-        }
-    }
-}
-
 // ---------------------------------------------------------------------------------------------------- the worker
 /** One Python worker process of an app: JSON lines on stdin/stdout, one reader thread per stream, one result queue per running task. */
 class LcWorker {
@@ -870,14 +839,13 @@ class LcWorker {
     volatile boolean closed = false
     Thread stderrReader                                 // reads the worker's error output; a crash text waits for it to finish so the worker's last words are not missed
     volatile boolean killedAfterCancel = false          // the person pressed Cancel and the tool did not stop: the worker was ended by the host, not by a fault
+    volatile boolean cancelRequested = false            // the person pressed Cancel during the run in progress (Tools Task.cancel_requested): a crash that follows is recorded as cancelled, not failed
     private int counter = 0
 
     LcWorker(Map entry) {
         def command = [entry.python as String, "-m", "labconstrictor_tools", "serve", "--module", entry.module as String]
         def pb = new ProcessBuilder(command)
-        LcRegistry.SCRUBBED_ENV.each { pb.environment().remove(it) }
-        def path = ((entry.pythonpath ?: []) + [entry.runtime_path ?: ""]).findAll { it }.join(File.pathSeparator)
-        pb.environment().putAll([PYTHONPATH: path, PYTHONNOUSERSITE: "1", PYTHONSAFEPATH: "1", PYTHONIOENCODING: "utf-8", PYTHONUNBUFFERED: "1"])
+        LcPython.applyEnvironment(pb, entry)
         proc = pb.start()
         Thread.start("lc-stdout") {
             try {
@@ -940,6 +908,7 @@ class LcWorker {
     /** Sends one EXECUTE and blocks until its terminal message; `onUpdate` gets (message, current, maximum). */
     Map run(String toolId, Map inputs, Closure onUpdate) {
         def id = "lcq-" + (++counter) + "-" + System.nanoTime()
+        cancelRequested = false
         def queue = new LinkedBlockingQueue<Map>()
         tasks.put(id, queue)
         try {
@@ -961,9 +930,12 @@ class LcWorker {
     }
     volatile String currentTask = null      // id of the run in progress (cancel targets it)
 
-    /** The terminal message of a run; a worker that ended after Cancel was pressed is a cancellation (the person asked for it), never a crash text that reads like out-of-memory. */
+    /** The terminal message of a run; a worker that ended after Cancel was pressed is a cancellation (the person asked for it), never a crash text that reads like out-of-memory
+     *  (the crash text stays in `error`, for the run record). `cancelRequested` says whether Cancel was pressed before the end: the run record and the done markers read it. */
     private Map endOfRun(Map msg) {
-        return (msg.responseType == "CRASH" && killedAfterCancel) ? [responseType: "CANCELATION", workerStopped: true] : msg
+        Map end = (msg.responseType == "CRASH" && killedAfterCancel) ? [responseType: "CANCELATION", workerStopped: true, error: msg.error] : msg
+        end.cancelRequested = cancelRequested
+        return end
     }
 
     /** Writes one JSON line to the worker; synchronized so lines from the run and cancel threads never interleave. */
@@ -978,6 +950,7 @@ class LcWorker {
     void cancel(int graceSeconds = LcConst.CANCEL_GRACE_SECONDS) {
         def id = currentTask
         if (id == null) return
+        cancelRequested = true
         try { send([task: id, requestType: "CANCEL"]) } catch (IOException e) { LcLog.warn("could not send the cancel request (the worker is killed after " + graceSeconds + " s)", e) }
         Thread.start("lc-cancel") {
             Thread.sleep(graceSeconds * 1000L)
@@ -1072,6 +1045,8 @@ class LcDialog {
     Map<String, String> imageOf = [:]            // pixel-size parameter -> image parameter
     Map<String, LcLink> links = [:]              // pixel-size parameter -> the state of its field (unset / auto / user), a flag set by the person's edits (SPEC 2.2)
     volatile Map<String, Map> calibrationAtRun = [:]     // pixel-size parameter -> its `_calibration` entry, frozen when the request was read (SPEC 2.3.4)
+    volatile LcRun runSnapshot                           // the run in progress, or the last one: frozen when Run was pressed, before any worker call (SPEC 4.1); export, the record and the placement of results read it
+    Map<String, Closure> formSources = [:]               // the image choices of the form (the Map the image choosers share); kept in step with the image open in QuPath
     List imageDataListeners = []                 // listeners on QuPath's image property (removed when the window closes)
     boolean programmatic = false                 // true while the host writes a pixel-size field (such a write is never a person's edit)
     Map<String, TextField> fileFields = [:]      // image parameter -> the field for a file path
@@ -1100,7 +1075,7 @@ class LcDialog {
             status.text = "No LabConstrictor app is registered on this machine." + (problems ? " Skipped: " + problems.join("; ") : "")
         }
         stage.scene = new Scene(root)
-        stage.onHidden = { stopWorker(false); imageDataListeners.each { qupath?.imageDataProperty()?.removeListener(it as javafx.beans.value.ChangeListener) } }   // also when closed from code
+        stage.onHidden = { if (running) worker?.cancelRequested = true; stopWorker(false); imageDataListeners.each { qupath?.imageDataProperty()?.removeListener(it as javafx.beans.value.ChangeListener) } }   // also when closed from code
         stage.show()
         if (!apps.isEmpty()) appBox.value = apps.keySet().first()
     }
@@ -1132,6 +1107,9 @@ class LcDialog {
         messageLabel.managed = false
         choiceTimer.onFinished = { resolveChoices() }
         idleTimer.onFinished = { closeIdleWorker() }
+        def follow = { o, a, b -> LcRun.refreshChoosers(this) } as javafx.beans.value.ChangeListener      // the open image changed: "Current image: ..." must name the image that is open now
+        qupath?.imageDataProperty()?.addListener(follow)
+        imageDataListeners << follow
     }
 
     /** The scrolling area that holds the generated form. */
@@ -1344,6 +1322,7 @@ class LcDialog {
     /** Rows for the normal parameters, one collapsed section per Collapsed group, one for Advanced; then the links between parameters. */
     void buildForm(List inputs) {
         def sources = imageSources()
+        formSources = sources
         def ordered = presentationOrder(inputs)
         def shown = ordered.findAll { !it.advanced }, advanced = ordered.findAll { it.advanced }
         addSections(shown, sources)
@@ -2039,10 +2018,29 @@ class LcDialog {
         def values = readFormValues()
         if (values == null) return
         imageChoiceAtRun = imageBoxes.collectEntries { k, b -> [(k): b.value as String] }
+        def app = apps[appBox.value]
+        Map<String, String> compat = LcCompat.checkApp(app)
+        if (compat.status == LcCompat.REFUSE) { LcLog.warn("run of '" + currentTool.id + "' refused: " + compat.reason); status.text = compat.reason; return }
         showRunning()
+        try {
+            freeze(values)
+        } catch (LcRefusal e) {
+            LcLog.warn("run of '" + currentTool.id + "' refused" + (e.code ? " [" + e.code + "]" : "") + ": " + e.message)
+            runSnapshot?.active = false
+            finish(appBox.value as String, currentTool.label as String, [responseType: "FAILURE", error: e.message, code: LcConst.REFUSAL_CODE, reason: e.code], 0d)
+            return
+        }
         runInBackground(values)
     }
 
+    /** Freezes the run (SPEC 4.1) on the FX thread: the image each input comes from (as objects), the selected regions, the plane and the Image areas, all as they are NOW. A refusal
+     *  (an area outside the image, no selection, a chooser that names another image than the open one) is thrown before anything starts. */
+    void freeze(Map values) {
+        planeAtRun = viewerPlane()
+        runSnapshot = LcRun.take(this, values)
+        areasAtRun = resolveAreas(values, currentTool.inputs)
+    }
+
     /** The form goes busy: Run off, Cancel on, an indeterminate progress bar. */
     void showRunning() {
         messageLabel.visible = false; messageLabel.managed = false
@@ -2075,11 +2073,12 @@ class LcDialog {
 
     /** Copies what the thread needs (the form may change meanwhile), runs on a thread, shows the outcome on the FX thread. */
     void runInBackground(Map values) {
-        def toolId = currentTool.id as String
-        def app = apps[appBox.value]
-        def appName = appBox.value
-        def toolLabel = currentTool.label
-        def toolInputs = currentTool.inputs
+        LcRun run = runSnapshot
+        def toolId = run.toolId
+        def app = run.app
+        def appName = run.appName
+        def toolLabel = run.toolLabel
+        def toolInputs = run.tool.inputs
         Thread.start("lc-run") {
             def t0 = System.nanoTime()
             Map outcome = runOnWorker(app, appName, toolId, toolInputs, values)
@@ -2092,10 +2091,12 @@ class LcDialog {
     Map runOnWorker(Map app, String appName, String toolId, List toolInputs, Map values) {
         Map outcome
         Map inputs = null
+        File recordDir = null
         def t0 = System.nanoTime()
         def tmp = Files.createTempDirectory("lcqupath_").toFile()
         try {
             inputs = prepareInputs(values, toolInputs, tmp, appName, toolId)
+            recordDir = LcRuns.begin(appName, toolId)      // the record folder exists from the start of the run, owner marker first (SPEC 3.2)
             ensureWorker(app, appName)
             outcome = worker.run(toolId, inputs) { message, current, maximum ->
                 Platform.runLater {
@@ -2113,7 +2114,13 @@ class LcDialog {
         } finally {
             LcLog.deleteTemp(tmp)
         }
-        if (inputs != null && outcome.code != LcConst.REFUSAL_CODE) LcRuns.record([entry: app.entry, app: appName, tool: toolId, inputs: inputs, outcome: outcome, seconds: (System.nanoTime() - t0) / 1e9, stderr: worker?.stderrText()])      // a refusal never reached the worker: no record
+        if (inputs != null && outcome.code != LcConst.REFUSAL_CODE) {      // a refusal never reached the worker: no record
+            LcRun run = runSnapshot
+            Map<String, String> ended = LcRuns.finish(recordDir, new File(inputs["_job_dir"] as String), [entry: app.entry, app: appName, tool: toolId, inputs: inputs, outcome: outcome, seconds: (System.nanoTime() - t0) / 1e9,
+                                                                                                          stderr: worker?.stderrText(), runId: run?.runId, startedUtc: run?.startedUtc])
+            if (ended.problem) outcome.recordProblem = ended.problem
+            else LcRetention.startPrune(app.entry as Map)      // after the done markers: the Tools CLI removes what is past the quota, this script never does (SPEC 3.1)
+        }
         return outcome
     }
 
@@ -2123,10 +2130,10 @@ class LcDialog {
     File selectionMask(Map p, File tmp, String appName) {
         def label = p.label as String
         def chosen = imageChoiceAtRun[p.region_of]
-        def data = qupath?.imageData
+        def data = LcRun.dataFor(this, p.region_of as String)
         if (data == null || chosen == null || !chosen.startsWith("Current image"))
             throw new LcRefusal("'" + label + "': the selection belongs to the image open in QuPath: choose 'Current image' for the image, or untick the selection")
-        def selected = data.hierarchy.selectionModel.selectedObjects.findAll { it.isAnnotation() && it.ROI != null && !it.ROI.isPoint() }
+        def selected = LcRun.roisOf(this, data).collect { [ROI: it] }      // the regions frozen when Run was pressed
         if (!selected) throw new LcRefusal("'" + label + "': no annotation is selected: select one or more annotations, or untick the selection")
         LcArea.checkSelectionPlane(label, selected*.ROI, planeAtRun.z, planeAtRun.t)       // the mask is for the plane that is exported (QuPath #21)
         if (selected.size() > LcConst.MAX_REGION_OBJECTS) throw new LcRefusal("'" + label + "': " + selected.size() + " annotations are selected; at most " + LcConst.MAX_REGION_OBJECTS + " are supported")
@@ -2163,13 +2170,20 @@ class LcDialog {
     /** The request inputs: every form value prepared, plus the host-owned results folder as `_job_dir`. */
     Map prepareInputs(Map values, List params, File tmp, String appName, String toolId) {
         def inputs = new LinkedHashMap()
-        planeAtRun = viewerPlane()                      // one plane for the whole run, read once (what is exported, masked and drawn on is the same plane)
+        LcRun run = runSnapshot
+        LcRun.reach("prepare")
+        boolean frozen = run != null && run.active      // a run started by Run: the plane, the areas, the images and the selection were frozen when it was pressed (SPEC 4.1)
+        if (!frozen) {                                   // a direct call (no run in progress): one plane for the whole call, read once; before anything is exported, so a refused area costs nothing
+            planeAtRun = viewerPlane()
+            areasAtRun = resolveAreas(values, params)
+        }
         framesAtRun = [:]
-        areasAtRun = resolveAreas(values, params)       // before anything is exported: a refused area costs nothing
+        LcRun.reach("export")
         values.each { name, v -> inputs[name] = prepareInput(params.find { it.name == name }, name as String, v, tmp, appName) }
         def calibration = calibrationAtRun.findAll { name, entry -> values[name] != null }
         if (calibration) inputs["_calibration"] = calibration      // the reserved per-axis input (SPEC 2.3.4): tools never see it, the run record keeps it
         inputs["_job_dir"] = newJobDir(appName, toolId).absolutePath
+        if (frozen) run.resultsPath = inputs["_job_dir"]
         return inputs
     }
 
@@ -2237,19 +2251,18 @@ class LcDialog {
 
     Map resolveAreaOnFx(Map p, String kind, def server) {
         def label = p.label as String
-        def data = qupath?.imageData
+        def data = LcRun.dataFor(this, p.name as String)
         if (data == null) throw new LcRefusal("'" + label + "': no image is open in QuPath for the Image area '" + kind + "': open the image, or choose '" + LcArea.WHOLE + "'")
         def viewer = qupath.viewer
         int z = planeAtRun.z, t = planeAtRun.t       // the plane the person was looking at when the run started
-        def area = kind == LcArea.SELECTION ? selectionArea(label, data, server, z, t) : kind == LcArea.VIEWPORT ? viewportArea(label, viewer, server, z, t) : null
+        def area = kind == LcArea.SELECTION ? selectionArea(label, LcRun.roisOf(this, data), server, z, t) : kind == LcArea.VIEWPORT ? viewportArea(label, viewer, server, z, t) : null
         if (area == null && kind != LcArea.SELECTION && kind != LcArea.VIEWPORT) throw new LcRefusal("'" + label + "': unknown Image area '" + kind + "'")
         if (area == null) throw new LcRefusal("'" + label + "': the " + kind + " lies outside the image: choose another area, or '" + LcArea.WHOLE + "'")
         return area
     }
 
     /** The bounding box of the selected annotations (points do not count), clamped to the image. */
-    static Map selectionArea(String label, def data, def server, int z, int t) {
-        def rois = data.hierarchy.selectionModel.selectedObjects.findAll { it.isAnnotation() && it.ROI != null && !it.ROI.isPoint() }*.ROI
+    static Map selectionArea(String label, List rois, def server, int z, int t) {
         if (!rois) throw new LcRefusal("'" + label + "': no annotation is selected for the Image area '" + LcArea.SELECTION + "': select one or more annotations, or choose '" + LcArea.WHOLE + "'")
         LcArea.checkSelectionPlane(label, rois, z, t)       // one plane, the exported one (QuPath #21)
         def box = [rois*.boundsX.min(), rois*.boundsY.min(), rois.collect { it.boundsX + it.boundsWidth }.max(), rois.collect { it.boundsY + it.boundsHeight }.max()]
@@ -2343,7 +2356,8 @@ class LcDialog {
         return f
     }
 
-    /** Results go to a new folder under <LC_HOME>/results, where the command line also puts its runs. The host never deletes a results folder: retention belongs to the Tools reference code. */
+    /** Results go to a new folder under <LC_HOME>/results, where the command line also puts its runs, with its owner marker written first (SPEC 3.2; the done marker comes when the run ends).
+     *  The host never deletes a results folder: `labconstrictor-tools prune` does, started after the run (LcRetention). */
     static File newJobDir(String appName, String toolId) {
         def root = new File(LcRegistry.home(), "results")
         root.mkdirs()
@@ -2356,6 +2370,8 @@ class LcDialog {
             if (candidate.mkdir()) job = candidate          // a name that exists is never reused
         }
         if (job == null) throw new LcRefusal("could not create a results folder in " + root)
+        try { LcRetention.writeOwner(job, "result") }
+        catch (IOException e) { throw new LcRefusal("could not mark the results folder " + job + " as this run's (" + e.message + "); nothing was started") }      // an unmarked folder could never be cleaned up: refuse instead
         return job
     }
 
@@ -2384,6 +2400,8 @@ class LcDialog {
         } else {
             finishFailed(toolLabel, outcome)
         }
+        if (outcome.recordProblem) status.text = status.text + "  (" + outcome.recordProblem + ")"      // a record that could not be written is said, never dropped
+        runSnapshot?.active = false
         if (!keepWorker.selected) stopWorker(false)
         else if (worker != null) { idleTimer.duration = Duration.seconds(idleSeconds); idleTimer.playFromStart() }      // the clock of an unused worker starts when its run ends
     }
@@ -2401,9 +2419,11 @@ class LcDialog {
         def summary = results.findAll { it.type == "values" }.collect { r -> r.values.collect { k, v -> k + "=" + show(v) }.join(", ") }.join("; ")
         status.text = "done in " + String.format("%.1f", seconds) + "s  " + summary
         resultNotes = []
+        targetNote = ""
         showResults(appName, toolLabel, results)
         if (resultNotes) status.text = status.text + "  " + resultNotes.unique().join(" ")      // what the person must know about where the results are (size mismatch, SPEC 1.1.7)
-        clearAfterRun()
+        if (targetNote) status.text = targetNote          // the results could not be drawn on their image (SPEC 4.4): the sentence says which run, which image and where the files are
+        if (LcRun.formShowsToolOf(this)) clearAfterRun()              // another tool or app is shown now: its fields are not this run's to clear
         scheduleChoices(LcConst.CHOICES_AFTER_RUN_MS)          // a run may change what a source tool answers (e.g. a game was prepared)
     }
 
@@ -2511,13 +2531,13 @@ class LcDialog {
     /** SPEC 1.1.7: an image or labels result that says ApplyTo and has another Y/X size than the part of its source the tool received is never aligned (QuPath opens a
      *  result as an image of its own at the pixel origin); the sentence is conformance `size_mismatch`. Empty when the sizes agree or one of them is unknown. */
     String sizeMismatch(Map r) {
-        def declared = r.apply_to ?: currentTool?.outputs?.find { it.name == r.name }?.display?.apply_to      // only a result that says ApplyTo (the first image input is not assumed)
+        def declared = r.apply_to ?: LcRun.toolOf(this)?.outputs?.find { it.name == r.name }?.display?.apply_to      // only a result that says ApplyTo (the first image input is not assumed)
         def frame = declared ? framesAtRun[declared as String] : null
         if (frame == null) return ""
         try {
             def server = ImageServers.buildServer(r.path as String)
             if (server.width == frame.width && server.height == frame.height) return ""
-            def source = currentTool?.inputs?.find { it.name == declared }?.label ?: declared
+            def source = LcRun.toolOf(this)?.inputs?.find { it.name == declared }?.label ?: declared
             return LcConst.SIZE_MISMATCH_TEMPLATE.replace("{name}", (r.name ?: r.type) as String).replace("{w}", server.width as String).replace("{h}", server.height as String)
                     .replace("{source}", source as String).replace("{w2}", frame.width as String).replace("{h2}", frame.height as String)
         } catch (Exception e) {      // broad on purpose (any reader can fail on any file): the preview reports an unreadable result; here the size check is just skipped
@@ -2537,9 +2557,10 @@ class LcDialog {
     /** Replace(): the next run's results take the place of the last ones in the same window. */
     void showResultWindow(VBox box, String appName, String toolLabel) {
         def key = appName + "/" + toolLabel
-        def replacing = currentTool?.outputs?.any { it.replace } && resultWindows[key]?.showing
+        def replacing = LcRun.toolOf(this)?.outputs?.any { it.replace } && resultWindows[key]?.showing
         def stage2 = replacing ? resultWindows[key] : new Stage()
         stage2.title = appName + ": " + toolLabel
+        stage2.userData = runSnapshot?.runId      // which run these results are of
         if (!replacing) stage2.initOwner(stage)
         def sc = new ScrollPane(box)
         sc.fitToWidth = true
@@ -2549,26 +2570,29 @@ class LcDialog {
         lastResultStage = stage2
     }
     Stage lastResultStage       // the window of the last results
+    String targetNote = ""      // the sentence of SPEC 4.4 when results of the last run were not drawn because their image is gone or changed (the status line shows it)
 
     // ---- placing results on the image (points, outlines)
     /** The input an output's results belong to: the one its ApplyTo names (the result's own `apply_to`, else the declaration in the schema), else the first image or labels input. */
     String applyToOf(Map r) {
-        return r.apply_to ?: currentTool?.outputs?.find { it.name == r.name }?.display?.apply_to ?: currentTool?.inputs?.find { it.type in ["image", "labels"] }?.name
+        return r.apply_to ?: LcRun.toolOf(this)?.outputs?.find { it.name == r.name }?.display?.apply_to ?: LcRun.toolOf(this)?.inputs?.find { it.type in ["image", "labels"] }?.name
     }
 
-    /** The image open in QuPath when an output's results were found in it (the image parameter was "Current image" for this run); otherwise null. */
-    def openImageFor(Map r) {
-        def data = qupath?.imageData
+    /** The image the results of output `r` are drawn on: the image the run was started on (frozen when Run was pressed, SPEC 4.2), and only while that very `ImageData` is still open
+     *  with the shape it was exported with (4.4). null when the input was not the image open in QuPath (a file or a project image), or when that image is gone or changed:
+     *  notPlacedSentence says which. Never the image that happens to be open when the run ends. */
+    qupath.lib.images.ImageData openImageFor(Map r) {
+        LcRun run = runSnapshot
         def target = applyToOf(r)
-        def chosen = target ? imageChoiceAtRun[target] : null
-        return (data == null || chosen == null || !chosen.startsWith("Current image")) ? null : data
+        LcSource source = (run != null && target != null) ? run.sources[target as String] : null
+        return (source == null || run.targetProblem(qupath, target as String) != null) ? null : source.imageData
     }
 
     /** The area the results of output `r` were found in: that of its apply_to image (a region parameter counts as the image it belongs to), else of the
      *  first image input; null when that input was sent whole (no offset). */
     Map areaFor(Map r) {
         def target = applyToOf(r)
-        def param = currentTool?.inputs?.find { it.name == target }
+        def param = LcRun.toolOf(this)?.inputs?.find { it.name == target }
         return areasAtRun[(param?.region_of ?: target) as String]
     }
 
@@ -2582,6 +2606,12 @@ class LcDialog {
      *  any other source that is not the image open in QuPath is named; the files stay where they are. */
     String notPlacedSentence(Map r, String what) {
         def target = applyToOf(r)
+        String problem = (runSnapshot != null && target != null) ? runSnapshot.targetProblem(qupath, target as String) : null
+        if (problem != null) {
+            targetNote = problem
+            LcLog.warn("results of run " + runSnapshot.runId + " not placed [" + LcRun.CODE_TARGET_UNAVAILABLE + "]: " + problem)      // the code of conformance host_internal_codes; the person reads the sentence
+            return "Not placed on an image: " + problem
+        }      // the image of this run is gone or changed (SPEC 4.4): the sentence names the run and the folder
         def chosen = target ? imageChoiceAtRun[target] : null
         def where = r.path ? " The " + what + " are in " + r.path : ""
         if (chosen == LcDialog.FILE_CHOICE) { resultNotes << LcConst.FILE_INPUT_NOTE; return "Not placed on an image: " + LcConst.FILE_INPUT_NOTE + "." + where }      // also in the status line
@@ -2614,9 +2644,10 @@ class LcDialog {
         def name = appName + ":" + r.name
         def hierarchy = data.hierarchy
         def previous = hierarchy.annotationObjects.findAll { it.name == name }
-        if (previous && currentTool.outputs.any { it.name == r.name && it.replace }) hierarchy.removeObjects(previous, true)   // Replace()
+        if (previous && LcRun.toolOf(this).outputs.any { it.name == r.name && it.replace }) hierarchy.removeObjects(previous, true)   // Replace()
         def obj = PathObjects.createAnnotationObject(ROIs.createPointsROI(xs as double[], ys as double[], placementPlane(area)))
         obj.name = name
+        runSnapshot?.tag(obj)             // the run id, app and tool of THIS run (SPEC 4.5)
         hierarchy.addObject(obj)
         return xs.size() + " point(s) added to the open image as the annotation '" + name + "'." + offsetNote(area)
     }
@@ -2644,11 +2675,12 @@ class LcDialog {
         def built = shapeAnnotations(collection, prefix, area, placementPlane(area))
         def objects = built.objects, holes = built.holes, total = collection.features.size()
         def hierarchy = data.hierarchy
-        def replacing = currentTool.outputs.any { it.name == r.name && it.replace }
+        def replacing = LcRun.toolOf(this).outputs.any { it.name == r.name && it.replace }
         if (replacing) {
             def previous = hierarchy.annotationObjects.findAll { it.name?.startsWith(prefix + " ") }
             if (previous) hierarchy.removeObjects(previous, true)       // Replace()
         }
+        objects.each { runSnapshot?.tag(it) }
         hierarchy.addObjects(objects)
         def text = objects.size() + " outline(s) added to the open image as annotations named '" + prefix + " <label>'."
         if (total > LcConst.MAX_SHAPES) text += " '" + r.name + "': showing the first " + LcConst.MAX_SHAPES + " of " + total + " outlines."
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcCompat.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcCompat.groovy
new file mode 100644
index 0000000..a156ff7
--- /dev/null
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcCompat.groovy
@@ -0,0 +1,83 @@
+// ---------------------------------------------------------------------------------------------------- Tools compatibility (docs/PROTOCOL.md, "Compatibility rules for hosts")
+/** May this host use a schema written by the labconstrictor-tools of an app? The rules of `labconstrictor_tools.compat.check_schema`, written in Groovy (Fiji and QuPath
+ *  apply the same rules in their own language; the vectors are in conformance.json, `compat`, and the GUI tests run them). The result is [status: "ok" | "warn" | "refuse",
+ *  reason: one sentence for the person ("" when ok)]. A missing field means unknown or old, never an error; odd input never throws. */
+class LcCompat {
+    static final String OK = "ok"
+    static final String WARN = "warn"
+    static final String REFUSE = "refuse"
+    /** What this host needs from the Tools of an app: the run-record helpers (`runs.build_record`, `record_json`, `done_status`) arrived in 0.3.0a1, and the `prune`
+     *  command is the feature `retention_prune`; `_job_dir` and `_calibration` are `reserved_inputs_v1`. */
+    static final String MIN_TOOLS_VERSION = "0.3.0a1"
+    static final List<String> REQUIRED_FEATURES = ["reserved_inputs_v1", "retention_prune"]
+    private static final java.util.regex.Pattern VERSION = java.util.regex.Pattern.compile('^v?(\\d+)\\.(\\d+)(?:\\.(\\d+))?(?:[-.]?(a|alpha|b|beta|rc|c)[-.]?(\\d+))?$', java.util.regex.Pattern.CASE_INSENSITIVE)
+    private static final Map<String, Integer> PRE_ORDER = [a: 0, alpha: 0, b: 1, beta: 1, rc: 2, c: 2]
+    private static final int RELEASE_RANK = 3        // a release sorts after its pre-releases
+
+    /** `0.2.0rc1` / `v0.2.0-rc.1` / `0.2` as a sortable list of five numbers (a release sorts after its pre-releases); null when it is not a version. */
+    static List<Integer> parseVersion(Object text) {
+        if (!(text instanceof String)) return null
+        java.util.regex.Matcher match = VERSION.matcher((text as String).trim())
+        if (!match.matches()) return null
+        String pre = match.group(4)
+        List<Integer> rank = pre != null ? [PRE_ORDER[pre.toLowerCase(Locale.ROOT)], Integer.parseInt(match.group(5))] : [RELEASE_RANK, 0]
+        return [Integer.parseInt(match.group(1)), Integer.parseInt(match.group(2)), match.group(3) != null ? Integer.parseInt(match.group(3)) : 0] + rank
+    }
+
+    /** -1, 0 or 1 like Python's tuple comparison of two parsed versions. */
+    static int compareVersions(List<Integer> a, List<Integer> b) {
+        for (int i = 0; i < a.size(); i++) {
+            int step = Integer.compare(a[i], b[i])
+            if (step != 0) return step
+        }
+        return 0
+    }
+
+    private static Map<String, String> result(String status, String reason) { return [status: status, reason: reason] }
+
+    /** The rules of the Tools reference for one cached schema. `minToolsVersion` and `warnBelowToolsVersion` may be null; a limit that is not a version is a programming error (IllegalArgumentException). */
+    static Map<String, String> check(Map schema, String minToolsVersion, Collection<String> requiredFeatures, String warnBelowToolsVersion = null) {
+        for (List<Object> limit : [["min_tools_version", minToolsVersion], ["warn_below_tools_version", warnBelowToolsVersion]]) {
+            if (limit[1] && parseVersion(limit[1]) == null)
+                throw new IllegalArgumentException(limit[0] + " " + limit[1] + " is not a version (programming error in the host)")
+        }
+        List<String> required = (requiredFeatures as Set<String>).sort() as List<String>
+        Object protocol = schema.protocol
+        boolean supported = protocol instanceof Number && LcConst.SUPPORTED_PROTOCOLS.any { it == (protocol as double) }
+        if (!supported) return result(REFUSE, "this app speaks protocol " + pythonText(protocol) + ", which this host does not support")
+        Object rawVersion = schema.tools_version
+        Object rawFeatures = schema.features
+        List<Integer> version = parseVersion(rawVersion)
+        Set<String> features = rawFeatures instanceof List ? (rawFeatures as List).collect { String.valueOf(it) } as Set<String> : null
+        if (features == null && required)
+            return result(REFUSE, "this app's labconstrictor-tools is too old (it lists no features, this host needs " + required.join(", ") + "): update it")
+        List<String> missing = required.findAll { String f -> features != null && !features.contains(f) }
+        if (missing) return result(REFUSE, "this app's labconstrictor-tools lacks " + missing.join(", ") + ": update it")
+        if (minToolsVersion) {
+            if (rawVersion == null || rawVersion == "")
+                return result(REFUSE, "this app's labconstrictor-tools is too old (no version recorded, this host needs " + minToolsVersion + " or newer): update it")
+            List<Integer> wanted = parseVersion(minToolsVersion)
+            if (version != null && compareVersions(version, wanted) < 0)
+                return result(REFUSE, "this app's labconstrictor-tools " + rawVersion + " is older than the " + minToolsVersion + " this host needs: update it")
+        }
+        if (rawVersion == null || rawVersion == "") return result(WARN, "the version of this app's labconstrictor-tools is unknown (it predates version 0.2)")
+        if (version == null) return result(WARN, "the labconstrictor-tools version " + pythonText(rawVersion) + " of this app is not understood")
+        List<Integer> soft = parseVersion(warnBelowToolsVersion)
+        if (soft != null && compareVersions(version, soft) < 0)
+            return result(WARN, "this app's labconstrictor-tools " + rawVersion + " is older than the recommended " + warnBelowToolsVersion + ": update it")
+        return result(OK, "")
+    }
+
+    /** What this host needs from the app's Tools (LcCompat.MIN_TOOLS_VERSION, LcCompat.REQUIRED_FEATURES), as the result of `check` for the app's cached schema. */
+    static Map<String, String> checkApp(Map app) {
+        return check(app.schema as Map, MIN_TOOLS_VERSION, REQUIRED_FEATURES)
+    }
+
+    /** A value the way Python's `%r` shows it in the Tools sentences: a string in single quotes, a whole number without ".0", None for null. */
+    static String pythonText(Object value) {
+        if (value == null) return "None"
+        if (value instanceof String) return "'" + value + "'"
+        if (value instanceof Double && (value as double) == Math.rint(value as double) && Math.abs(value as double) < 1e15d) return String.valueOf((value as double).longValue())
+        return String.valueOf(value)
+    }
+}
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcRetention.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcRetention.groovy
new file mode 100644
index 0000000..d2bc1ff
--- /dev/null
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcRetention.groovy
@@ -0,0 +1,175 @@
+// ---------------------------------------------------------------------------------------------------- retention and run records (SPEC_WRONG_SCIENCE section 3)
+/** The environment of the app's own Python: the variables that would mix it with QuPath's or the user's are removed, the paths of the registry entry are set. The worker, the run-record helper
+ *  and the `prune` subprocess all start the app's interpreter this way. */
+class LcPython {
+    static final int HELPER_SECONDS = 60             // the run-record helper is a short Python call; a longer one is killed and reported
+
+    /** Sets the environment of `builder` for the app described by the registry entry `entry` (the same rules as the worker's). */
+    static void applyEnvironment(ProcessBuilder builder, Map entry) {
+        LcRegistry.SCRUBBED_ENV.each { String name -> builder.environment().remove(name) }
+        String path = ((entry.pythonpath ?: []) + [entry.runtime_path ?: ""]).findAll { it }.join(File.pathSeparator)
+        builder.environment().putAll([PYTHONPATH: path, PYTHONNOUSERSITE: "1", PYTHONSAFEPATH: "1", PYTHONIOENCODING: "utf-8", PYTHONUNBUFFERED: "1"])
+    }
+}
+
+/** The two marker files of SPEC_WRONG_SCIENCE 3.2 and the `prune` subprocess (3.1). This host only CREATES folders under <LC_HOME>/results and <LC_HOME>/runs: it writes `.lc-owner.json` when
+ *  it makes a folder and `.lc-done.json` (atomically) when the run is over, then starts `labconstrictor-tools prune` in the app's Python environment. It never deletes anything there itself,
+ *  and a prune that cannot start leaves the folders where they are (3.1.4): there is no deleting code in this script for them. */
+class LcRetention {
+    static final String OWNER_FILE = ".lc-owner.json"
+    static final String DONE_FILE = ".lc-done.json"
+    static final String HOST = "qupath"
+    static final int MARKER_VERSION = 1
+    static final List<String> STATUSES = ["ok", "failed", "cancelled"]
+    /** Test hook (tests only): returns the command to start instead of `<python> -m labconstrictor_tools prune`; null (the default) means the real command. */
+    static volatile Closure<List<String>> pruneCommandFor = null
+    /** The `prune` processes started by this JVM (tests wait for them). */
+    static final List<Thread> pruneThreads = Collections.synchronizedList(new ArrayList<Thread>())
+
+    /** `2026-10-12T09:30:00.123Z`: the format of `created` and `finished`. */
+    static String nowUtc() {
+        return java.time.format.DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'").withZone(java.time.ZoneOffset.UTC).format(java.time.Instant.now())
+    }
+
+    /** Writes `.lc-owner.json` into a folder that was just created: the first thing in it. `kind` is "result" or "run". */
+    static void writeOwner(File folder, String kind) {
+        Map<String, Object> marker = [lc_marker: MARKER_VERSION, kind: kind, name: folder.name, host: HOST, pid: ProcessHandle.current().pid(), created: nowUtc(), token: UUID.randomUUID().toString()]
+        new File(folder, OWNER_FILE).setText(LcJson.toJson(marker), "UTF-8")
+    }
+
+    /** Writes `.lc-done.json` atomically (a temporary file, then a rename): the last thing in the folder. */
+    static void writeDone(File folder, String status) {
+        if (!(status in STATUSES)) throw new IllegalArgumentException("a done status is one of " + STATUSES.join(", ") + ", got '" + status + "'")
+        File temporary = new File(folder, DONE_FILE + ".tmp-" + ProcessHandle.current().pid() + "-" + System.nanoTime())
+        temporary.setText(LcJson.toJson([finished: nowUtc(), status: status]), "UTF-8")
+        Files.move(temporary.toPath(), new File(folder, DONE_FILE).toPath(), java.nio.file.StandardCopyOption.ATOMIC_MOVE, java.nio.file.StandardCopyOption.REPLACE_EXISTING)
+    }
+
+    /** The command of the `prune` subprocess: the app's interpreter, as the worker uses it. */
+    static List<String> pruneCommand(Map entry) {
+        Closure<List<String>> hook = pruneCommandFor
+        if (hook != null) return hook.call(entry)
+        List<String> command = [entry.python as String, "-m", "labconstrictor_tools", "prune"]
+        return command
+    }
+
+    /** Starts `prune` and returns at once: a daemon thread waits for it, ignores its exit code except to log a failure, and never fails or delays the run (3.1.3). */
+    static Thread startPrune(Map entry) {
+        List<String> command = pruneCommand(entry)
+        Thread thread = new Thread({ -> runPrune(entry, command) } as Runnable, "lc-prune")
+        thread.daemon = true
+        pruneThreads << thread
+        thread.start()
+        return thread
+    }
+
+    private static void runPrune(Map entry, List<String> command) {
+        try {
+            ProcessBuilder builder = new ProcessBuilder(command).redirectErrorStream(true)
+            LcPython.applyEnvironment(builder, entry)
+            Process process = builder.start()
+            process.outputStream.close()
+            String output = process.inputStream.getText("UTF-8").trim()
+            int code = process.waitFor()
+            if (code != 0) LcLog.warn("prune ended with exit code " + code + " (the folders it could not remove stay): " + output.take(LcConst.LOG_LINE_CHARS))
+        } catch (IOException e) {      // the command cannot be started: the folders accumulate until it can (nothing is deleted here instead)
+            LcLog.warn("prune could not be started (" + command.join(" ") + "); older results and run records stay where they are", e)
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt()
+            LcLog.warn("interrupted while waiting for prune", e)
+        }
+    }
+}
+
+/** The run-record content, built by the Tools helpers (`labconstrictor_tools.runs.build_record`, `record_json`, `done_status`) in the app's own Python: this script keeps no copy of the
+ *  record layout or of the status rule. The helpers arrived in Tools 0.3.0a1 (LcCompat.MIN_TOOLS_VERSION). */
+class LcRunRecord {
+    static final Map<String, String> STATUS = [COMPLETION: "COMPLETE", FAILURE: "FAILED", CANCELATION: "CANCELED", CRASH: "CRASHED"]   // the worker's response types as the client names them
+    static final String HELPER = '''
+import json, sys, types
+from labconstrictor_tools import runs
+request = json.loads(sys.stdin.read())
+task = types.SimpleNamespace(status=request["status"], error=request.get("error"), code=request.get("code"), traceback=request.get("traceback"),
+                             outputs=request.get("outputs") or {}, cancel_requested=bool(request.get("cancel_requested")))
+content = runs.build_record(request["app"], request["tool"], request["inputs"], task, request["seconds"], request.get("stderr") or "",
+                            run_id=request.get("run_id"), started_utc=request.get("started_utc"), finished_utc=request["finished_utc"])
+content["host"] = request["host"]
+sys.stdout.write("\\n" + json.dumps({"text": runs.record_json(content), "done_status": runs.done_status(request["status"], bool(request.get("cancel_requested")))}) + "\\n")
+'''
+
+    /** What the helper needs for one finished run: the task fields come from the worker's last message (`outcome`); a worker that was killed after Cancel is a crash that followed Cancel. */
+    static Map<String, Object> request(Map run) {
+        Map outcome = run.outcome as Map
+        Map outputs = outcome.outputs instanceof Map ? outcome.outputs as Map : [:]
+        String type = outcome.responseType as String
+        String status = outcome.workerStopped ? "CRASHED" : (STATUS[type] ?: type)
+        Map<String, Object> request = [app: run.app, tool: run.tool, inputs: (run.inputs as Map), seconds: run.seconds, stderr: run.stderr ?: "", status: status, error: outcome.error, code: outcome.code,
+                                       traceback: outcome.trace ?: outcome.traceback, outputs: outputs, cancel_requested: outcome.cancelRequested ? true : false, run_id: run.runId, started_utc: run.startedUtc,
+                                       finished_utc: java.time.Instant.now().toString(), host: LcRetention.HOST]
+        return request
+    }
+
+    /** Runs the helper in the app's interpreter: [text: the text of run.json, doneStatus: the status for the done markers]. Throws IllegalStateException with the reason when it cannot. */
+    static Map<String, String> build(Map entry, Map<String, Object> request) {
+        ProcessBuilder builder = new ProcessBuilder([entry.python as String, "-c", HELPER])
+        LcPython.applyEnvironment(builder, entry)
+        Process process
+        try { process = builder.start() }
+        catch (IOException e) { throw new IllegalStateException("the app's Python could not be started: " + e.message, e) }
+        StringBuffer errors = new StringBuffer()
+        Thread reader = Thread.start("lc-record-stderr") { errors.append(process.errorStream.getText("UTF-8")) }
+        process.outputStream.withWriter("UTF-8") { Writer w -> w.write(LcJson.toJson(request)) }
+        String out = process.inputStream.getText("UTF-8")
+        if (!process.waitFor(LcPython.HELPER_SECONDS, TimeUnit.SECONDS)) { process.destroyForcibly(); throw new IllegalStateException("the Tools run-record helper did not finish in " + LcPython.HELPER_SECONDS + " s") }
+        reader.join(LcConst.STREAM_DRAIN_MS)
+        if (process.exitValue() != 0) throw new IllegalStateException("the Tools run-record helper failed (exit code " + process.exitValue() + "): " + errors.toString().trim().takeRight(LcConst.CRASH_TAIL_CHARS))
+        Map answer = LcJson.parseText(out.readLines().findAll { it.trim() }.last()) as Map
+        return [text: answer.text as String, doneStatus: answer.done_status as String]
+    }
+}
+
+/** One folder per run under <LC_HOME>/runs with a run.json in the format of labconstrictor_tools.runs, so that `labconstrictor-tools support-bundle` finds QuPath runs. The folder is made when
+ *  the run starts (owner marker first, so a QuPath that dies leaves an owned, unfinished folder that nobody removes); run.json and the done marker come when it ends. A record holds file paths
+ *  and the values passed, never image or table contents. Nothing here deletes a folder: retention is `labconstrictor-tools prune`, started after the done markers (LcRetention). */
+class LcRuns {
+    static File runsDir() { return new File(LcRegistry.home(), "runs") }
+
+    /** Makes the record folder `<time>_<app>_<tool>` (never an existing one) and writes its owner marker. Throws IOException when it cannot. */
+    static File begin(String app, String toolId) {
+        File root = runsDir()
+        root.mkdirs()
+        for (int attempt = 0; attempt < LcConst.RESULTS_DIR_ATTEMPTS; attempt++) {
+            String stamp = java.time.format.DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmssSSSSSS").withZone(java.time.ZoneOffset.UTC).format(java.time.Instant.now())
+            File folder = new File(root, stamp + "_" + LcDialog.slug(app) + "_" + LcDialog.slug(toolId))
+            if (folder.mkdir()) { LcRetention.writeOwner(folder, "run"); return folder }
+        }
+        throw new IOException("could not create a run record folder in " + root)
+    }
+
+    /** Ends the run: builds the record with the Tools helpers, writes run.json, then the done markers of the record folder and of the results folder `resultsDir` (may be null). The caller
+     *  starts `prune` afterwards (LcRetention.startPrune) when this returns no problem. Never throws: whatever goes wrong is returned as `problem` (a sentence for the status line) and logged, and the folders then stay unfinished, so nothing is ever removed.
+     *  `run` holds entry, app, tool, inputs, outcome, seconds, stderr, runId and startedUtc. */
+    static Map<String, String> finish(File recordDir, File resultsDir, Map run) {
+        try {
+            Map<String, String> built = LcRunRecord.build(run.entry as Map, LcRunRecord.request(run))
+            new File(recordDir, "run.json").setText(built.text, "UTF-8")
+            LcRetention.writeDone(recordDir, built.doneStatus)
+            if (resultsDir != null) LcRetention.writeDone(resultsDir, built.doneStatus)
+            return [doneStatus: built.doneStatus]
+        } catch (IOException | RuntimeException e) {      // broad on purpose: whatever goes wrong here must not break the run, but its absence must be visible
+            LcLog.warn("could not write the run record for " + run.app + " " + run.tool, e)
+            return [problem: "the run record could not be written (" + e.message + "); its folders stay as they are and are never removed"]
+        }
+    }
+
+    /** Makes and finishes a record in one call (what a run that has no folder yet needs): the folder, or null (said in the log) when it cannot be written. */
+    static File record(Map run) {
+        try {
+            File folder = begin(run.app as String, run.tool as String)
+            return finish(folder, null, run).problem ? null : folder
+        } catch (IOException e) {
+            LcLog.warn("could not write the run record for " + run.app + " " + run.tool, e)
+            return null
+        }
+    }
+}
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcRunIdentity.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcRunIdentity.groovy
new file mode 100644
index 0000000..4bf44b8
--- /dev/null
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcRunIdentity.groovy
@@ -0,0 +1,169 @@
+// ---------------------------------------------------------------------------------------------------- run identity (SPEC_WRONG_SCIENCE section 4)
+/** The image one input of a run was taken from, as an OBJECT and not as a label: the `ImageData` open in QuPath when Run was pressed (null for a project image or a file, which have no
+ *  open image to draw on), and the shape the image had then. The text of the chooser ("Current image: slide A") is only the name shown in sentences, never identity (4.2). */
+class LcSource {
+    final String param                 // the parameter name of the image input
+    final String choice                // what the chooser said when Run was pressed
+    final String name                  // the image name without the chooser's prefix (the name used in sentences)
+    final qupath.lib.images.ImageData imageData
+    final List<Integer> shape          // [width, height, z-planes, time points, channels] of the image when Run was pressed
+
+    LcSource(String param, String choice, String name, qupath.lib.images.ImageData imageData, List<Integer> shape) {
+        this.param = param
+        this.choice = choice
+        this.name = name
+        this.imageData = imageData
+        this.shape = shape
+    }
+}
+
+/** One run, frozen when Run is pressed on the FX thread, before any worker call (4.1): an id, the app and tool (the schema maps), the image each input came from (LcSource), the selected
+ *  regions (their ROIs, which are immutable, copied by value) and the plane the viewer showed. Export, the request, the run record and the placement of the results read this and nothing
+ *  live: opening another image, selecting other annotations or switching the tool while the run goes cannot change what is exported, drawn or recorded (RUN-01..07). */
+class LcRun {
+    static final String TARGET_UNAVAILABLE = "run {run_id} on '{source}': '{source}' is no longer open; results are in {path}"            // conformance messages.target_unavailable
+    static final String TARGET_CHANGED_SIZE = "run {run_id} on '{source}': '{source}' changed size while the tool ran; results are in {path}"   // messages.target_changed_size
+    static final String CODE_TARGET_UNAVAILABLE = "target_unavailable"       // conformance host_internal_codes: also the code of "changed size" (RUN-07)
+    static final String CURRENT_PREFIX = "Current image: "
+    static final String META_RUN_ID = "labconstrictor.run_id"                // metadata of every annotation drawn by a run
+    static final String META_APP = "labconstrictor.app"
+    static final String META_TOOL = "labconstrictor.tool"
+    /** Test hook (tests only): called with a stage name ("export") on the run thread, so a test can change the viewer or the selection at that point of a real run. */
+    static volatile Closure<Object> barrier = null
+
+    final String runId = String.valueOf(UUID.randomUUID())
+    final String startedUtc = LcRetention.nowUtc()
+    final String appName
+    final Map app
+    final Map tool
+    final Map<String, LcSource> sources = new LinkedHashMap<String, LcSource>()
+    final List<Object> selectedRois = new ArrayList<Object>()      // the ROIs of the annotations selected on the open image when Run was pressed (points do not count)
+    final Map<String, Integer> plane
+    volatile String resultsPath = ""                                // the results folder of the run (set when it is made); the sentences of 4.4 name it
+    volatile boolean active = false                                 // true from Run until the results are shown: prepareInputs reads this snapshot then
+
+    LcRun(String appName, Map app, Map tool, Map<String, Integer> plane) {
+        this.appName = appName
+        this.app = app
+        this.tool = tool
+        this.plane = plane
+    }
+
+    String getToolId() { return tool.id as String }
+
+    String getToolLabel() { return tool.label as String }
+
+    /** [width, height, z-planes, time points, channels] of an image server. */
+    static List<Integer> shapeOf(qupath.lib.images.servers.ImageServer server) {
+        return [server.width as int, server.height as int, server.nZSlices() as int, server.nTimepoints() as int, server.nChannels() as int]
+    }
+
+    /** The name shown for an image in sentences: the chooser text without "Current image: ". */
+    static String nameOf(String choice) { return choice.startsWith(CURRENT_PREFIX) ? choice.substring(CURRENT_PREFIX.length()) : choice }
+
+    /** Freezes the run `dialog` is about to start. Call on the FX thread. `values` are the form values (the image values that use the open image get a source that is bound to the image open NOW);
+     *  what each image chooser shows is `dialog.imageChoiceAtRun`; a "Current image" label that the form cannot offer any more means the open image changed since the chooser was filled: the
+     *  run is refused, never started on another image than the one named. */
+    static LcRun take(LcDialog dialog, Map values) {
+        QuPathGUI qupath = dialog.qupath
+        Map tool = dialog.currentTool
+        Map<String, String> choices = dialog.imageChoiceAtRun
+        Collection<String> openLabels = dialog.imageSources().keySet()
+        LcRun run = new LcRun(dialog.appBox.value as String, dialog.apps[dialog.appBox.value] as Map, tool, dialog.planeAtRun)
+        for (Map p : (tool.inputs as List<Map>).findAll { it.type in ["image", "labels"] }) {
+            String name = p.name as String
+            Object value = values[name]
+            String choice = choices[name]
+            if (!(value instanceof Map) || value.selection || choice == null || !choice.startsWith(CURRENT_PREFIX)) continue      // a project image, a file, a region or nothing: no open image to bind
+            qupath.lib.images.ImageData data = qupath?.imageData
+            if (data == null || !openLabels.contains(choice))
+                throw new LcRefusal("'" + p.label + "': '" + nameOf(choice) + "' is no longer the image open in QuPath" + (data == null ? " (no image is open)" : " ('" + openName(qupath, data) + "' is)") + ": choose the image again")
+            qupath.lib.images.servers.ImageServer server = data.server
+            run.sources[name] = new LcSource(name, choice, nameOf(choice), data, shapeOf(server))
+            (value as Map).source = { server }          // the export reads this image, whatever is open later
+        }
+        qupath.lib.images.ImageData open = run.sources.values().isEmpty() ? null : run.sources.values().first().imageData
+        if (open != null) {
+            run.selectedRois.addAll(open.hierarchy.selectionModel.selectedObjects.findAll { it.isAnnotation() && it.ROI != null && !it.ROI.isPoint() }*.ROI)
+        }
+        run.active = true
+        return run
+    }
+
+    /** The name the chooser would give the image `data` ("Current image: <name>" without the prefix): the project entry's name, else the server's name, else the file name. */
+    static String openName(QuPathGUI qupath, qupath.lib.images.ImageData data) {
+        qupath.lib.projects.ProjectImageEntry entry = qupath.getProjectImageEntry(data)
+        return entry?.imageName ?: data.server.metadata.name ?: new File(data.server.path.replaceFirst(/^[^:]*:\s*/, "")).name
+    }
+
+    /** The image the open-image input `param` was bound to, or null (a project image, a file, or no such input). */
+    qupath.lib.images.ImageData dataFor(String param) { return sources[param]?.imageData }
+
+    /** Why the results for `param` must not be drawn on its image now (4.4), as the conformance sentence, or null when the very same image is still open with the shape it was exported
+     *  with. Gone (no viewer shows that ImageData) is `target_unavailable` "is no longer open"; still shown but another shape is "changed size while the tool ran": the two sentences are never swapped. */
+    String targetProblem(QuPathGUI qupath, String param) {
+        LcSource source = sources[param]
+        if (source == null) return null
+        boolean open = qupath != null && qupath.allViewers.any { it.imageData != null && it.imageData.is(source.imageData) }
+        if (!open) return sentence(TARGET_UNAVAILABLE, source)
+        return shapeOf(source.imageData.server) == source.shape ? null : sentence(TARGET_CHANGED_SIZE, source)
+    }
+
+    private String sentence(String template, LcSource source) {
+        return template.replace("{run_id}", runId).replace("{source}", source.name).replace("{path}", resultsPath)
+    }
+
+    /** Puts the run's identity on an annotation it draws (4.5): the run id, and the app and tool of THIS run, not of whatever the form shows later. */
+    void tag(qupath.lib.objects.PathObject annotation) {
+        annotation.metadata.put(META_RUN_ID, runId)
+        annotation.metadata.put(META_APP, appName)
+        annotation.metadata.put(META_TOOL, toolId)
+    }
+
+    /** The tool the results of the dialog's last run belong to: the one the run was started for (frozen with it), not whatever the form shows now (4.5). */
+    static Map toolOf(LcDialog dialog) { return dialog.runSnapshot != null ? dialog.runSnapshot.tool : dialog.currentTool }
+
+    /** True while the form shows the tool the run was started for (the form can be switched to another tool or app while a run goes on). */
+    static boolean formShowsToolOf(LcDialog dialog) {
+        LcRun run = dialog.runSnapshot
+        return run != null && dialog.currentTool != null && run.toolId == dialog.currentTool.id && run.appName == dialog.appBox.value
+    }
+
+    /** The image the open-image input `param` was frozen to when Run was pressed; with no run in progress (a direct call) the image open now. */
+    static qupath.lib.images.ImageData dataFor(LcDialog dialog, String param) {
+        LcRun run = dialog.runSnapshot
+        return (run != null && run.active) ? run.dataFor(param) : dialog.qupath?.imageData
+    }
+
+    /** The ROIs of the selected annotations (points do not count) the run uses: those frozen when Run was pressed; with no run in progress the live selection of `data`. */
+    static List roisOf(LcDialog dialog, qupath.lib.images.ImageData data) {
+        LcRun run = dialog.runSnapshot
+        if (run != null && run.active) return run.selectedRois
+        return data.hierarchy.selectionModel.selectedObjects.findAll { it.isAnnotation() && it.ROI != null && !it.ROI.isPoint() }*.ROI
+    }
+
+    /** The image open in QuPath changed: the "Current image: ..." choice of every image chooser names the image that is open now, so that a label never names another image than the one that
+     *  would be exported (4.2). A choice the person made on another entry (a project image, a file) and every other field stay as they are; with no image open a "Current image" choice
+     *  keeps its old label (a run is then refused, never moved to another entry). */
+    static void refreshChoosers(LcDialog dialog) {
+        if (dialog.currentTool == null || dialog.imageBoxes.isEmpty()) return
+        Map<String, Closure> fresh = dialog.imageSources()
+        dialog.formSources.clear()
+        dialog.formSources.putAll(fresh)
+        String current = fresh.keySet().find { LcDialog.isCurrentImage(it) }
+        for (Map p : (dialog.currentTool.inputs as List<Map>).findAll { dialog.imageBoxes[it.name] != null }) {
+            ComboBox<String> box = dialog.imageBoxes[p.name as String]
+            String old = box.value
+            List<String> items = (p.required ? [] : [LcDialog.NO_IMAGE]) + fresh.keySet().toList() + [LcDialog.FILE_CHOICE]
+            String start = p.required ? (fresh ? fresh.keySet().first() : LcDialog.FILE_CHOICE) : LcDialog.NO_IMAGE
+            box.items.setAll(items)
+            box.value = LcDialog.isCurrentImage(old) ? (current ?: old) : (items.contains(old) ? old : start)
+        }
+    }
+
+    /** Called at a named point of the run thread; a no-op unless a test set the barrier. */
+    static void reach(String stage) {
+        Closure<Object> hook = barrier
+        if (hook != null) hook.call(stage)
+    }
+}
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
new file mode 100644
index 0000000..9ccf7aa
--- /dev/null
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
@@ -0,0 +1,4 @@
+LabConstrictorTools.groovy
+LcCompat.groovy
+LcRetention.groovy
+LcRunIdentity.groovy
diff --git a/tests/ci_setup_apps.sh b/tests/ci_setup_apps.sh
index 8812ca9..5b2f063 100755
--- a/tests/ci_setup_apps.sh
+++ b/tests/ci_setup_apps.sh
@@ -4,6 +4,7 @@
 #   interactions  the example app of labconstrictor-tools (labconstrictor_tools.examples.interactions)
 #   adv           tests/adversarial_app (odd input for the hints)
 #   frame         tests/frame_app (a probe tool for the coordinate-frame tests: it reports what it received and returns a point, an outline and labels)
+#   runs          tests/runs_app (delayed, failing, crashing and number-reporting tools for the run-identity, retention and number-limit tests)
 #   LabConstrictorPlayground  the Playground app, from its main branch, with CPU PyTorch (its device test runs a real model on the CPU)
 # Not installed: CellTracksColab and NucleiSky (their bridge is not on their main branch yet, see tests/run_gui_ci.sh).
 set -euo pipefail
@@ -20,6 +21,7 @@ export LC_HOME="$WORK/home"; mkdir -p "$LC_HOME"
 "$WORK/tools_env/bin/python" -m labconstrictor_tools register --name interactions --prefix "$WORK/tools_env" --module labconstrictor_tools.examples.interactions
 "$WORK/tools_env/bin/python" -m labconstrictor_tools register --name adv --prefix "$WORK/tools_env" --module adv_lc_tools --pythonpath "$REPO/tests/adversarial_app"
 "$WORK/tools_env/bin/python" -m labconstrictor_tools register --name frame --prefix "$WORK/tools_env" --module frame_lc_tools --pythonpath "$REPO/tests/frame_app"
+"$WORK/tools_env/bin/python" -m labconstrictor_tools register --name runs --prefix "$WORK/tools_env" --module runs_lc_tools --pythonpath "$REPO/tests/runs_app"
 
 "${PYTHON:-python3}" -m venv --copies "$WORK/playground_env"
 "$WORK/playground_env/bin/pip" install -q --upgrade pip
diff --git a/tests/gui_test_area_body.groovy b/tests/gui_test_area_body.groovy
index a3a7dd2..8a8cbd7 100644
--- a/tests/gui_test_area_body.groovy
+++ b/tests/gui_test_area_body.groovy
@@ -12,6 +12,7 @@ def FIXTURES = System.getProperty("lc.test.fixtures", new File("tests/fixtures")
 def BLOBS = FIXTURES + "/blobs.tif"
 def PROP = "lc.qupath.max_export_pixels"
 def results = [:]
+LcRetention.pruneCommandFor = { Map entry -> [entry.python as String, "-c", "pass"] as List<String> }      // no clean-up while this body counts the folders of the results folder (the real prune is checked by gui_test_retention_body.groovy)
 def fx = { Closure c ->
     if (Platform.isFxApplicationThread()) return c()
     def latch = new CountDownLatch(1); def box = [null, null]
diff --git a/tests/gui_test_frame_body.groovy b/tests/gui_test_frame_body.groovy
index 0e145e9..95167cc 100644
--- a/tests/gui_test_frame_body.groovy
+++ b/tests/gui_test_frame_body.groovy
@@ -14,6 +14,7 @@ def OUT = new File(System.getProperty("lc.test.out", "/tmp/qp_shots")); OUT.mkdi
 def FIXTURES = System.getProperty("lc.test.fixtures", new File("tests/fixtures").absolutePath)
 def ASYM = FIXTURES + "/asym.tif", ASYM_ZT = FIXTURES + "/asym_zt.tif"
 def results = [:]
+LcRetention.pruneCommandFor = { Map entry -> [entry.python as String, "-c", "pass"] as List<String> }      // no clean-up while this body counts the folders of the results folder (the real prune is checked by gui_test_retention_body.groovy)
 def fx = { Closure c ->
     if (Platform.isFxApplicationThread()) return c()
     def latch = new CountDownLatch(1); def box = [null, null]
diff --git a/tests/gui_test_identity_body.groovy b/tests/gui_test_identity_body.groovy
new file mode 100644
index 0000000..3525fb7
--- /dev/null
+++ b/tests/gui_test_identity_body.groovy
@@ -0,0 +1,237 @@
+// ================================================================== GUI test body: run identity (SPEC_WRONG_SCIENCE section 4; RUN-01..07, QuPath #16)
+// (appended to the tool script by tests/run_gui_test.sh). Needs the `runs` and `frame` test apps (registered by tests/ci_setup_apps.sh in LC_SHARED_HOME; copied into the scratch LC_HOME,
+// a folder named lhome_identity). A run is placed on the image that was exported, not on whatever is open when it ends: the DELAYED tool of `runs` blocks on a gate file the test creates, so the
+// test changes the open image, the selection, the tool or the app while the run goes, and releases it. The sentences and the code are read from conformance.json (messages.target_unavailable,
+// messages.target_changed_size, host_internal_codes, run_identity). RUN-05 (a Napari layer is moved) does not apply to QuPath: an ImageData has no transform.
+import javafx.embed.swing.SwingFXUtils
+import javax.imageio.ImageIO
+import java.util.concurrent.CountDownLatch
+import java.awt.image.BufferedImage
+import javafx.stage.Window
+
+def FIXTURES = System.getProperty("lc.test.fixtures", new File("tests/fixtures").absolutePath)
+def BLOBS = FIXTURES + "/blobs.tif", ASYM = FIXTURES + "/asym.tif", ASYM_ZT = FIXTURES + "/asym_zt.tif"
+def SHARED_HOME = new File(System.getenv("LC_SHARED_HOME") ?: System.getenv("LC_HOME"))
+def results = [:]
+def fx = { Closure c ->
+    if (Platform.isFxApplicationThread()) return c()
+    def latch = new CountDownLatch(1); def box = [null, null]
+    Platform.runLater { try { box[0] = c() } catch (Throwable t) { box[1] = t } finally { latch.countDown() } }
+    latch.await()
+    if (box[1] != null) throw box[1]
+    return box[0]
+}
+def expect = { String name, boolean ok, Object detail = "" ->
+    results[name] = ok
+    println((ok ? "PASS " : "FAIL ") + name + (ok ? "" : " -> " + detail))
+}
+def waitIdle = { dlg, int seconds = 300 ->
+    def end = System.currentTimeMillis() + seconds * 1000
+    while (System.currentTimeMillis() < end) { Thread.sleep(200); if (!dlg.running && fx { !dlg.runButton.disable }) return true }
+    return false
+}
+def waitFor = { Closure cond, int seconds = 60 -> def end = System.currentTimeMillis() + seconds * 1000; while (System.currentTimeMillis() < end) { if (cond()) return true; Thread.sleep(100) }; return false }
+def status = { dlg -> fx { dlg.status.text } }
+def pick = { dlg, app, tool -> fx { dlg.appBox.value = app }; fx { dlg.toolBox.value = tool }; Thread.sleep(500) }
+def settle = { LcRetention.pruneThreads*.join(20000); LcRetention.pruneThreads.clear() }
+def gateOf = { String name -> new File(System.getProperty("java.io.tmpdir"), "lc_gate_" + name + "_" + System.nanoTime()) }
+def busy = { dlg -> waitFor({ fx { dlg.worker != null && dlg.worker.currentTask != null } }, 30) }
+def release = { File gate -> gate.text = "go" }
+
+Thread.start("lc-gui-test") {
+    try {
+        def home = new File(System.getenv("LC_HOME")); assert home.path.contains("lhome_identity")
+        home.deleteDir(); def apps = new File(home, "apps"); apps.mkdirs()
+        def srcApps = new File(SHARED_HOME, "apps")
+        ["runs", "frame"].each { name ->
+            new File(apps, name + ".schema.json").text = new File(srcApps, name + ".schema.json").text
+            new File(apps, name + ".json").text = LcJson.toJson(LcJson.parse(new File(srcApps, name + ".json")) + [schema_path: new File(apps, name + ".schema.json").path])
+            ["chmod", "644", new File(apps, name + ".json").path, new File(apps, name + ".schema.json").path].execute().waitFor()
+        }
+        def PY = (LcJson.parse(new File(apps, "runs.json")) as Map).python as String
+        def confPath = System.getenv("LC_CONFORMANCE") ?: [PY, "-m", "labconstrictor_tools.conformance", "--path"].execute().text.trim()
+        def CONF = LcJson.parse(new File(confPath))
+        def runCase = { String id -> def c = CONF.wrong_science.run_identity.fixtures.find { it.id == id }; assert c != null : "conformance.json has no case " + id; c }
+        expect("conformance_has_RUN_01_to_07", (1..7).every { runCase(String.format("RUN-%02d", it)) != null }, CONF.wrong_science.run_identity.keySet())
+        expect("the_sentences_are_the_conformance_sentences", LcRun.TARGET_UNAVAILABLE == CONF.messages.target_unavailable.template && LcRun.TARGET_CHANGED_SIZE == CONF.messages.target_changed_size.template, [CONF.messages.target_unavailable, CONF.messages.target_changed_size])
+        expect("the_code_is_the_conformance_code_and_RUN_07_names_it", LcRun.CODE_TARGET_UNAVAILABLE in CONF.host_internal_codes && runCase("RUN-07").code == LcRun.CODE_TARGET_UNAVAILABLE && runCase("RUN-07").message == "target_changed_size" && runCase("RUN-04").message == "target_unavailable", CONF.host_internal_codes)
+        def sentence = { String key, String runId, String source, String path -> CONF.messages[key].template.replace("{run_id}", runId).replace("{source}", source).replace("{path}", path) }
+
+        // ---- a project with the two images A (blobs.tif, 80 x 60) and B (asym.tif, 12 x 8)
+        def entries = [:]
+        fx {
+            def dir = new File(System.getProperty("java.io.tmpdir"), "qp_project_identity"); dir.deleteDir()
+            qupath.lib.gui.prefs.PathPrefs.imageTypeSettingProperty().set(qupath.lib.gui.prefs.PathPrefs.ImageTypeSetting.AUTO_ESTIMATE)
+            def project = qupath.lib.projects.Projects.createProject(dir, BufferedImage)
+            [["blobs.tif", BLOBS], ["asym.tif", ASYM], ["asym_zt.tif", ASYM_ZT]].each { n, f ->
+                def s = qupath.lib.images.servers.ImageServers.buildServer(f); def e = project.addImage(s.getBuilder()); e.setImageName(n); entries[n] = e
+            }
+            project.syncChanges(); qupath.setProject(project)
+        }
+        def openImage = { String name ->
+            fx { qupath.imageData?.setChanged(false); qupath.openImageEntry(qupath.project.imageList.find { it.imageName == name }); null }       // unsaved annotations would ask "save changes?" and wait for a click
+            Thread.sleep(2500)
+            fx { qupath.imageData.hierarchy.clearAll(); null }
+        }
+        def hierarchy = { fx { qupath.imageData.hierarchy } }
+        def marksOn = { def data -> fx { data.hierarchy.annotationObjects.findAll { it.name?.startsWith("runs:marks") } } }
+        def resultsRoot = new File(home, "results"), runsRoot = new File(home, "runs")
+        def newest = { File root -> (root.listFiles() ?: []).findAll { it.isDirectory() }.max { it.name } }
+        LcRetention.pruneCommandFor = { Map entry -> [PY, "-c", "pass"] as List<String> }      // no real prune here (the retention body checks it)
+        openImage("blobs.tif")
+        def dataA = fx { qupath.imageData }
+        def dlg = fx { lcShow() }
+        Thread.sleep(800)
+        pick(dlg, "runs", "Delayed points")
+        def chooserA = fx { dlg.imageBoxes["image"].value as String }
+        expect("the_chooser_names_the_open_image", chooserA == "Current image: blobs.tif", chooserA)
+
+        // ---- RUN-06 (first half) and the plain run: the points land on A, carry the run id, the app and the tool of this run
+        def gate0 = gateOf("plain"); release(gate0)
+        fx { dlg.setters["gate"](gate0.path); dlg.setters["y"](10d); dlg.setters["x"](20d) }
+        fx { dlg.run() }; Thread.sleep(500); waitIdle(dlg, 120); settle()
+        def idA = fx { dlg.runSnapshot.runId }
+        def a1 = marksOn(dataA)
+        expect("RUN-06_run_1_draws_its_point_on_A", status(dlg).startsWith("done") && a1.size() == 1 && Math.abs(a1[0].ROI.centroidX - 20.5d) < 1e-9 && Math.abs(a1[0].ROI.centroidY - 10.5d) < 1e-9, [status(dlg), a1.size()])
+        expect("RUN-06_the_point_carries_the_run_id_the_app_and_the_tool", a1[0].metadata["labconstrictor.run_id"] == idA && a1[0].metadata["labconstrictor.app"] == "runs" && a1[0].metadata["labconstrictor.tool"] == "delayed_points" && idA ==~ /^[0-9a-f-]{36}$/, a1[0].metadata)
+        expect("the_run_record_has_the_same_run_id", (LcJson.parse(new File(newest(runsRoot), "run.json")) as Map).run_id == idA, "")
+
+        // ---- RUN-01 / RUN-04: start on A, open B while the tool runs: nothing is drawn on B, nothing on A (A is not open any more), the files are kept, the status is the conformance sentence
+        fx { hierarchy().clearAll() }
+        def gate1 = gateOf("r1")
+        fx { dlg.setters["gate"](gate1.path) }
+        def before1 = [resultsRoot.list().size(), runsRoot.list().size()]
+        fx { dlg.run() }
+        busy(dlg)
+        def run1 = fx { dlg.runSnapshot }
+        openImage("asym.tif")
+        def dataB = fx { qupath.imageData }
+        release(gate1); waitIdle(dlg, 120); settle()
+        def sentence1 = sentence("target_unavailable", run1.runId, "blobs.tif", run1.resultsPath)
+        expect("RUN-01_the_status_is_the_target_unavailable_sentence", status(dlg) == sentence1, [status(dlg), sentence1])
+        expect("RUN-01_nothing_is_drawn_on_B", marksOn(dataB).isEmpty() && fx { dataB.hierarchy.annotationObjects.isEmpty() }, marksOn(dataB)*.name)
+        expect("RUN-01_nothing_is_drawn_on_A_either_it_is_not_open", marksOn(dataA).isEmpty(), marksOn(dataA)*.name)
+        expect("RUN-04_the_outputs_are_kept_in_the_owned_results_folder", new File(run1.resultsPath, "marks.csv").isFile() && new File(run1.resultsPath, ".lc-done.json").isFile() && run1.resultsPath.startsWith(resultsRoot.path), run1.resultsPath)
+        expect("RUN-04_the_run_record_is_written_with_the_run_id", resultsRoot.list().size() == before1[0] + 1 && runsRoot.list().size() == before1[1] + 1 && (LcJson.parse(new File(newest(runsRoot), "run.json")) as Map).run_id == run1.runId, "")
+        expect("RUN-04_the_code_is_logged_and_no_exception_was_raised", LcLog.recent.any { it.contains("[target_unavailable]") && it.contains(run1.runId) } && !(fx { dlg.lastReport } as String).contains("host_error"), LcLog.recent.takeRight(3))
+        expect("RUN-04_the_results_window_still_lists_the_points_table", fx { dlg.lastResultStage?.scene?.root != null } && fx { dlg.lastResultStage.userData } == run1.runId, "")
+        expect("RUN-01_the_chooser_follows_the_open_image", fx { dlg.imageBoxes["image"].value as String } == "Current image: asym.tif" && fx { dlg.formSources.keySet().findAll { it.startsWith("Current image") }.toList() } == ["Current image: asym.tif"], fx { dlg.imageBoxes["image"].value })
+
+        // ---- RUN-06 (second half): the next run is on B and lands on B with its own run id; A's earlier point is not touched
+        def gate2 = gateOf("r6b"); release(gate2)
+        fx { dlg.setters["gate"](gate2.path); dlg.setters["y"](2d); dlg.setters["x"](3d) }
+        fx { dlg.run() }; Thread.sleep(500); waitIdle(dlg, 120); settle()
+        def idB = fx { dlg.runSnapshot.runId }
+        def bMarks = marksOn(dataB)
+        expect("RUN-06_run_2_lands_on_B_with_its_own_run_id", status(dlg).startsWith("done") && bMarks.size() == 1 && idB != idA && idB != run1.runId && bMarks[0].metadata["labconstrictor.run_id"] == idB && Math.abs(bMarks[0].ROI.centroidX - 3.5d) < 1e-9, [status(dlg), bMarks*.metadata])
+        expect("RUN-06_A_got_nothing_from_run_2", marksOn(dataA).isEmpty(), marksOn(dataA)*.name)
+
+        // ---- RUN-01 (else-branch): A is still open in a second viewer: the points go to A (the image the run started on), not to the image that is active
+        def second = fx { try { qupath.viewerManager.setGridSize(1, 2); qupath.allViewers.size() == 2 } catch (Throwable t) { println "TWO VIEWERS: " + t; false } }
+        if (second) {
+            fx { qupath.viewerManager.setActiveViewer(qupath.allViewers[0]); null }
+            openImage("blobs.tif")
+            fx { LcRun.refreshChoosers(dlg); null }
+            def a2 = fx { qupath.imageData }
+            def gate3 = gateOf("r1b")
+            fx { dlg.setters["gate"](gate3.path); dlg.setters["y"](5d); dlg.setters["x"](6d) }
+            fx { dlg.run() }; busy(dlg)
+            fx { qupath.viewerManager.setActiveViewer(qupath.allViewers[1]); null }
+            fx { qupath.openImageEntry(qupath.project.imageList.find { it.imageName == "asym.tif" }); null }; Thread.sleep(2500)
+            release(gate3); waitIdle(dlg, 120); settle()
+            def onA = marksOn(a2)
+            expect("RUN-01_A_still_open_in_another_viewer_gets_the_points_and_the_active_B_gets_nothing", status(dlg).startsWith("done") && onA.size() == 1 && marksOn(fx { qupath.imageData }).isEmpty() && onA[0].metadata["labconstrictor.run_id"] == fx { dlg.runSnapshot.runId }, [status(dlg), onA.size()])
+            fx { qupath.viewerManager.resetGridSize(); qupath.viewerManager.setActiveViewer(qupath.allViewers[0]); qupath.allViewers.drop(1).each { it.imageData?.setChanged(false); it.setImageData(null) }; null }      // one viewer again: the hidden ones hold no image
+        } else println "UNSUPPORTED RUN-01_second_viewer: this harness cannot show two viewers"
+        openImage("blobs.tif")
+        fx { LcRun.refreshChoosers(dlg); null }
+
+        // ---- RUN-04 (closed, not replaced): A is closed with no other image
+        def gate4 = gateOf("r4"); fx { dlg.setters["gate"](gate4.path); dlg.setters["y"](1d); dlg.setters["x"](1d) }
+        fx { dlg.run() }; busy(dlg)
+        def run4 = fx { dlg.runSnapshot }
+        fx { qupath.allViewers.each { it.imageData?.setChanged(false); it.setImageData(null) }; null }; Thread.sleep(500)      // closed in every viewer
+        release(gate4); waitIdle(dlg, 120); settle()
+        expect("RUN-04_closing_A_gives_the_target_unavailable_sentence_and_keeps_the_files", status(dlg) == sentence("target_unavailable", run4.runId, "blobs.tif", run4.resultsPath) && new File(run4.resultsPath, "marks.csv").isFile(), status(dlg))
+        fx { dlg.run() }; Thread.sleep(500)
+        expect("a_run_with_no_image_open_is_refused_not_started_on_another_entry", status(dlg).contains("'blobs.tif' is no longer the image open in QuPath (no image is open): choose the image again") && !fx { dlg.running } && fx { dlg.imageBoxes["image"].value as String } == "Current image: blobs.tif", status(dlg))
+        openImage("blobs.tif")
+        fx { LcRun.refreshChoosers(dlg); null }
+        expect("the_chooser_names_the_image_again_when_it_is_reopened", fx { dlg.imageBoxes["image"].value as String } == "Current image: blobs.tif", fx { dlg.imageBoxes["image"].value })
+
+        // ---- RUN-03: switch the tool while the run goes: the result carries the tool and app of the run, and the end of the run does not clear the fields of the tool that is shown now
+        def gate3 = gateOf("r3"); fx { dlg.setters["gate"](gate3.path); dlg.setters["y"](7d) ; dlg.setters["x"](8d) }
+        fx { dlg.run() }; busy(dlg)
+        def run3 = fx { dlg.runSnapshot }
+        pick(dlg, "runs", "Quick values")
+        fx { dlg.setters["n"](5) }
+        release(gate3); waitIdle(dlg, 120); settle()
+        def drawn3 = marksOn(fx { qupath.imageData })
+        expect("RUN-03_the_result_is_placed_and_carries_the_tool_and_app_of_the_run", drawn3.size() == 1 && drawn3[0].name == "runs:marks" && drawn3[0].metadata["labconstrictor.tool"] == "delayed_points" && drawn3[0].metadata["labconstrictor.app"] == "runs" && drawn3[0].metadata["labconstrictor.run_id"] == run3.runId, [drawn3*.metadata, status(dlg)])
+        expect("RUN-03_the_form_of_the_other_tool_is_not_cleared_by_the_end_of_the_run", fx { dlg.currentTool.id } == "quick_values" && fx { dlg.getters["n"]() } == 5 && !fx { LcRun.formShowsToolOf(dlg) }, [fx { dlg.currentTool.id }, fx { dlg.getters["n"]() }])
+        expect("RUN-03_the_run_record_names_the_tool_of_the_run", (LcJson.parse(new File(newest(runsRoot), "run.json")) as Map).with { app == "runs" && tool == "delayed_points" && run_id == run3.runId }, "")
+        // ... and the app: start on `runs`, switch to the `frame` app, release: the result is still the run's
+        pick(dlg, "runs", "Delayed points")
+        fx { hierarchy().clearAll() }
+        def gate3b = gateOf("r3b"); fx { dlg.setters["gate"](gate3b.path); dlg.setters["y"](9d) ; dlg.setters["x"](9d) }
+        fx { dlg.run() }; busy(dlg)
+        def run3b = fx { dlg.runSnapshot }
+        pick(dlg, "frame", "Frame probe")
+        release(gate3b); waitIdle(dlg, 120); settle()
+        def drawn3b = marksOn(fx { qupath.imageData })
+        expect("RUN-03_switching_the_app_keeps_the_app_and_tool_of_the_run", drawn3b.size() == 1 && drawn3b[0].metadata["labconstrictor.app"] == "runs" && drawn3b[0].metadata["labconstrictor.tool"] == "delayed_points" && drawn3b[0].metadata["labconstrictor.run_id"] == run3b.runId && fx { dlg.currentTool.id } == "probe", [drawn3b*.metadata, status(dlg)])
+
+        // ---- RUN-02: the selection changes while the export goes on: the crop and the mask are those of the click
+        pick(dlg, "frame", "Frame probe")
+        fx { hierarchy().clearAll() }
+        def rect = { double x, double y, double w, double h -> qupath.lib.objects.PathObjects.createAnnotationObject(qupath.lib.roi.ROIs.createRectangleROI(x, y, w, h, qupath.lib.regions.ImagePlane.getDefaultPlane())) }
+        def r1 = fx { rect(10, 5, 20, 10) }, r2 = fx { rect(40, 30, 7, 9) }
+        fx { hierarchy().addObjects([r1, r2]); hierarchy().selectionModel.setSelectedObjects([r1], null); null }
+        def changeSelectionAt = { List<String> stages -> LcRun.barrier = { String stage -> if (stage in stages) { Platform.runLater { hierarchy().selectionModel.setSelectedObjects([r2], null) }; Thread.sleep(800) } } }
+        // (a) Image area: Selected annotation(s): the crop is r1's box (20 x 10), though r2 (7 x 9) is selected from the moment the run thread starts
+        fx { dlg.selectionBoxes["region"].selected = false; dlg.areaBoxes["image"].value = "Selected annotation(s)"; dlg.setters["y"](1d); dlg.setters["x"](1d); null }
+        changeSelectionAt(["prepare", "export"])
+        fx { dlg.run() }; Thread.sleep(500); waitIdle(dlg, 120); settle()
+        LcRun.barrier = null
+        def seen = (LcJson.parseText((fx { dlg.lastReport } as String).split("\n\nworker output:")[0]) as Map).outputs?.results?.find { it.type == "values" }?.values
+        expect("RUN-02_the_exported_crop_is_the_selection_of_the_click", seen != null && seen.image_shape == [10, 20] && fx { hierarchy().selectionModel.selectedObjects.toList() } == [r2], [seen, status(dlg)])
+        expect("RUN-02_the_results_are_placed_with_the_offset_of_the_click", fx { hierarchy().annotationObjects.findAll { it.name?.startsWith("frame:marks") }.collectMany { it.ROI.allPoints } }.with { size() == 1 && Math.abs(get(0).x - 11.5d) < 1e-9 && Math.abs(get(0).y - 6.5d) < 1e-9 }, status(dlg))
+        // (b) RegionOf ("use the selection"): the mask is r1 (200 pixels), not r2 (63)
+        fx { hierarchy().selectionModel.setSelectedObjects([r1], null); dlg.areaBoxes["image"].value = "Whole image"; dlg.selectionBoxes["region"].selected = true; null }
+        changeSelectionAt(["prepare", "export"])
+        fx { dlg.run() }; Thread.sleep(500); waitIdle(dlg, 120); settle()
+        LcRun.barrier = null
+        def seenMask = (LcJson.parseText((fx { dlg.lastReport } as String).split("\n\nworker output:")[0]) as Map).outputs?.results?.find { it.type == "values" }?.values
+        expect("RUN-02_the_mask_is_the_selection_of_the_click", seenMask != null && seenMask.mask_pixels.size() == 200 && seenMask.mask_shape == [60, 80], seenMask?.mask_shape)
+        fx { dlg.selectionBoxes["region"].selected = false; null }
+
+        // ---- RUN-07: A stays open but its data changes shape while the tool runs (QuPath has no way to do this but a script that replaces the server: the test does it with reflection)
+        pick(dlg, "runs", "Delayed points")
+        fx { hierarchy().clearAll() }
+        def dataCur = fx { qupath.imageData }
+        def gate7 = gateOf("r7"); fx { dlg.setters["gate"](gate7.path) }
+        fx { dlg.run() }; busy(dlg)
+        def run7 = fx { dlg.runSnapshot }
+        def realServer = dataCur.server
+        def other = qupath.lib.images.servers.ImageServers.buildServer(ASYM)
+        def field = qupath.lib.images.ImageData.getDeclaredField("server"); field.setAccessible(true); field.set(dataCur, other)
+        release(gate7); waitIdle(dlg, 120); settle()
+        field.set(dataCur, realServer)
+        expect("RUN-07_the_status_is_the_changed_size_sentence_not_the_no_longer_open_one", status(dlg) == sentence("target_changed_size", run7.runId, "blobs.tif", run7.resultsPath) && !status(dlg).contains("no longer open"), status(dlg))
+        expect("RUN-07_nothing_is_drawn_anywhere", marksOn(dataCur).isEmpty() && marksOn(fx { qupath.imageData }).isEmpty(), marksOn(dataCur)*.name)
+        expect("RUN-07_files_are_kept_in_the_owned_folder_and_the_record_is_written", new File(run7.resultsPath, "marks.csv").isFile() && new File(run7.resultsPath, ".lc-done.json").isFile() && (LcJson.parse(new File(newest(runsRoot), "run.json")) as Map).run_id == run7.runId, "")
+        expect("RUN-07_the_code_is_target_unavailable", LcLog.recent.any { it.contains("[target_unavailable]") && it.contains("changed size") && it.contains(run7.runId) }, LcLog.recent.takeRight(3))
+        def gate8 = gateOf("r8"); release(gate8); fx { dlg.setters["gate"](gate8.path); dlg.setters["y"](3d); dlg.setters["x"](3d) }
+        fx { dlg.run() }; Thread.sleep(500); waitIdle(dlg, 120); settle()
+        expect("RUN-07_the_image_with_its_real_shape_takes_results_again", status(dlg).startsWith("done") && marksOn(dataCur).size() == 1, status(dlg))
+
+        // ---- the chooser text is never identity: a run whose chooser names an image that is not the open one is refused before anything starts
+        def count = [resultsRoot.list().size(), runsRoot.list().size()]
+        def refusal = null
+        try { fx { dlg.imageChoiceAtRun = [image: "Current image: asym_zt.tif"]; LcRun.take(dlg, [image: [source: { null }]]) } } catch (LcRefusal e) { refusal = e.message }
+        expect("a_stale_chooser_label_is_refused", refusal != null && refusal.contains("'asym_zt.tif' is no longer the image open in QuPath") && refusal.contains("choose the image again"), refusal)
+        expect("a_refused_freeze_made_no_folder", resultsRoot.list().size() == count[0] && runsRoot.list().size() == count[1], count)
+
+    } catch (Throwable t) { t.printStackTrace(); results["EXCEPTION"] = false }
+    finally { println "RESULTS " + results; Thread.sleep(500); System.exit(results && results.every { it.value } ? 0 : 1) }
+}
diff --git a/tests/gui_test_parity_form_body.groovy b/tests/gui_test_parity_form_body.groovy
index 6ec7415..6994982 100644
--- a/tests/gui_test_parity_form_body.groovy
+++ b/tests/gui_test_parity_form_body.groovy
@@ -62,7 +62,7 @@ Thread.start("lc-gui-test") {
         def home = new File(System.getenv("LC_HOME")); assert home.path.contains("lhome_form")
         home.deleteDir(); def apps = new File(home, "apps"); apps.mkdirs()
         def P = { String name, String type, Map more = [:] -> [name: name, label: name.capitalize().replace("_", " "), type: type, required: more.required != false && !more.nullable] + more }
-        def schema = [protocol: 1, tools: [
+        def schema = [protocol: 1, tools_version: "0.3.0a1", features: ["reserved_inputs_v1", "retention_prune"], tools: [
             [id: "order", label: "Order", description: "", outputs: [], inputs: [
                 P("a", "string"), P("x1", "integer", [group: "G1", default: 1]), P("b", "string"), P("x2", "float", [group: "G1", default: 2.5]),
                 P("c1", "integer", [group: "C", group_collapsed: true, default: 3]), P("d", "string"), P("c2", "float", [group: "C", group_collapsed: true, default: 4.5]),
diff --git a/tests/gui_test_parity_host_body.groovy b/tests/gui_test_parity_host_body.groovy
index 27d311c..f1f11fa 100644
--- a/tests/gui_test_parity_host_body.groovy
+++ b/tests/gui_test_parity_host_body.groovy
@@ -63,7 +63,7 @@ Thread.start("lc-gui-test") {
         home.deleteDir(); def apps = new File(home, "apps"); apps.mkdirs()
         def P = { String name, String type, Map more = [:] -> [name: name, label: name.capitalize().replace("_", " "), type: type, required: more.required != false && !more.nullable] + more }
         def writeApp = { String app, List tools, String file = app ->      // `file`: the name of the registry file, which need not be the app's name
-            new File(apps, file + ".schema.json").text = LcJson.toJson([protocol: 1, tools: tools])
+            new File(apps, file + ".schema.json").text = LcJson.toJson([protocol: 1, tools_version: "0.3.0a1", features: ["reserved_inputs_v1", "retention_prune"], tools: tools])
             new File(apps, file + ".json").text = LcJson.toJson([schema: 1, name: app, display_name: app, version: "", prefix: INTERACTIONS.prefix, python: PY,
                     module: "labconstrictor_tools.examples.interactions", pythonpath: [], runtime_path: "", schema_path: new File(apps, file + ".schema.json").path])
             ["chmod", "644", new File(apps, file + ".json").path, new File(apps, file + ".schema.json").path].execute().waitFor()
diff --git a/tests/gui_test_parity_pixel_body.groovy b/tests/gui_test_parity_pixel_body.groovy
index 7f5f0b4..dfdaf37 100644
--- a/tests/gui_test_parity_pixel_body.groovy
+++ b/tests/gui_test_parity_pixel_body.groovy
@@ -64,7 +64,7 @@ Thread.start("lc-gui-test") {
         def home = new File(System.getenv("LC_HOME")); assert home.path.contains("lhome_pixel")
         home.deleteDir(); def apps = new File(home, "apps"); apps.mkdirs()
         def P = { String name, String type, Map more = [:] -> [name: name, label: name.capitalize().replace("_", " "), type: type, required: more.required != false] + more }
-        new File(apps, "pixelapp.schema.json").text = LcJson.toJson([protocol: 1, tools: [[id: "relocalize", label: "Relocalize 2D", description: "", outputs: [], inputs: [
+        new File(apps, "pixelapp.schema.json").text = LcJson.toJson([protocol: 1, tools_version: "0.3.0a1", features: ["reserved_inputs_v1", "retention_prune"], tools: [[id: "relocalize", label: "Relocalize 2D", description: "", outputs: [], inputs: [
             P("reference", "image"), P("query", "image"),
             P("reference_pixel_size_um", "float", [default: 0.65, pixel_size_of: "reference", unit: "um"]), P("query_pixel_size_um", "float", [default: 0.325, pixel_size_of: "query", unit: "um"])]]]])
         new File(apps, "pixelapp.json").text = LcJson.toJson([schema: 1, name: "pixelapp", display_name: "pixelapp", version: "", prefix: INTERACTIONS.prefix, python: PY,
diff --git a/tests/gui_test_parity_support_body.groovy b/tests/gui_test_parity_support_body.groovy
index 92e8cf7..ff130f6 100644
--- a/tests/gui_test_parity_support_body.groovy
+++ b/tests/gui_test_parity_support_body.groovy
@@ -126,9 +126,9 @@ Thread.start("lc-gui-test") {
         expect("the_record_keeps_results_but_not_the_host_folder", rec.results instanceof List && !rec.results.isEmpty() && !rec.inputs.containsKey("_job_dir"), [rec.results, rec.inputs])
         expect("the_record_keeps_the_interpreter_diagnostics_and_timings", rec.interpreter != null && rec.timings != null, [rec.interpreter, rec.timings])
         // other endings, written directly: failure with its code and traceback, cancellation, crash; the big matrix is left out
-        def folderOf = { Map outcome -> LcRuns.record([entry: [version: "1.2"], app: "interactions", tool: "x/y z", inputs: [a: 1L, _job_dir: "/tmp/j"], outcome: outcome, seconds: 1.234, stderr: "e" * 5000]) }
+        def folderOf = { Map outcome -> LcRuns.record([entry: INTERACTIONS, app: "interactions", tool: "x/y z", inputs: [a: 1L, _job_dir: "/tmp/j"], outcome: outcome, seconds: 1.234, stderr: "e" * 5000]) }
         def failed = LcJson.parse(new File(folderOf([responseType: "FAILURE", error: "[bad_parameter] no", code: "bad_parameter", trace: "Traceback (most recent call last)"]), "run.json"))
-        expect("a_failed_run_has_status_code_and_traceback", failed.status == "FAILED" && failed.code == "bad_parameter" && failed.error == "[bad_parameter] no" && failed.traceback == "Traceback (most recent call last)" && failed.app_version == "1.2" && failed.seconds == 1.23d, failed)
+        expect("a_failed_run_has_status_code_and_traceback", failed.status == "FAILED" && failed.code == "bad_parameter" && failed.error == "[bad_parameter] no" && failed.traceback == "Traceback (most recent call last)" && failed.app_version == INTERACTIONS.version && failed.seconds == 1.23d, failed)
         expect("a_record_keeps_the_last_4000_characters_of_the_worker_output", failed.stderr_tail.size() == 4000, failed.stderr_tail.size())
         expect("a_cancelled_run_is_canceled_and_a_crash_is_crashed", LcJson.parse(new File(folderOf([responseType: "CANCELATION"]), "run.json")).status == "CANCELED" && LcJson.parse(new File(folderOf([responseType: "CRASH", error: "x"]), "run.json")).status == "CRASHED")
         def withMatrix = LcJson.parse(new File(folderOf([responseType: "COMPLETION", outputs: [results: [[type: "affine", matrix_yx: [[1, 0, 0]], name: "m"]]]]), "run.json"))
@@ -151,7 +151,7 @@ Thread.start("lc-gui-test") {
         (1..60).each { new File(runsDir, String.format("20200101T0000%02d000000_a_b", it)).mkdirs() }
         new File(runsDir, "notes").mkdirs()
         def oldRecords = (runsDir.listFiles() ?: []).findAll { it.isDirectory() }*.name.sort()
-        def written = (1..60).collect { LcRuns.record([entry: [:], app: "interactions", tool: "t", inputs: [:], outcome: [responseType: "COMPLETION"], seconds: 0d, stderr: ""]) }
+        def written = (1..60).collect { LcRuns.record([entry: INTERACTIONS, app: "interactions", tool: "t", inputs: [:], outcome: [responseType: "COMPLETION"], seconds: 0d, stderr: ""]) }
         def after = (runsDir.listFiles() ?: []).findAll { it.isDirectory() }*.name.sort()
         expect("no_run_record_is_deleted", after.containsAll(oldRecords) && written.every { it != null && new File(it, "run.json").isFile() } && after.size() >= oldRecords.size() + 60, [oldRecords.size(), after.size()])
         expect("the_oldest_records_and_a_foreign_folder_survive", new File(runsDir, "20200101T000001000000_a_b").isDirectory() && new File(runsDir, "notes").isDirectory())
diff --git a/tests/gui_test_retention_body.groovy b/tests/gui_test_retention_body.groovy
new file mode 100644
index 0000000..717de97
--- /dev/null
+++ b/tests/gui_test_retention_body.groovy
@@ -0,0 +1,266 @@
+// ================================================================== GUI test body: retention markers, the prune subprocess, run records (SPEC_WRONG_SCIENCE section 3; HRET-01..06, RET-10, RET-11, QuPath #14)
+// (appended to the tool script by tests/run_gui_test.sh). Needs the `runs` test app (tests/runs_app, registered by tests/ci_setup_apps.sh in LC_SHARED_HOME; copied into the scratch LC_HOME,
+// a folder named lhome_retention). The host never prunes: it writes `.lc-owner.json` and `.lc-done.json` and starts the Tools CLI `prune` as a subprocess. Most checks replace that subprocess by
+// a recorder (a command that logs what it saw, LcRetention.pruneCommandFor), one block runs the REAL `labconstrictor-tools prune` against folders that must survive, and the folders are
+// also judged by Tools itself (`prune --dry-run --json`: eligible folders are listed as kept). The cases are the fixtures_hosts of conformance.json (LC_CONFORMANCE, else
+// `python -m labconstrictor_tools.conformance --path`).
+import javafx.embed.swing.SwingFXUtils
+import javax.imageio.ImageIO
+import java.util.concurrent.CountDownLatch
+import java.awt.image.BufferedImage
+import javafx.stage.Window
+
+def FIXTURES = System.getProperty("lc.test.fixtures", new File("tests/fixtures").absolutePath)
+def BLOBS = FIXTURES + "/blobs.tif"
+def SHARED_HOME = new File(System.getenv("LC_SHARED_HOME") ?: System.getenv("LC_HOME"))
+def results = [:]
+def fx = { Closure c ->
+    if (Platform.isFxApplicationThread()) return c()
+    def latch = new CountDownLatch(1); def box = [null, null]
+    Platform.runLater { try { box[0] = c() } catch (Throwable t) { box[1] = t } finally { latch.countDown() } }
+    latch.await()
+    if (box[1] != null) throw box[1]
+    return box[0]
+}
+def expect = { String name, boolean ok, Object detail = "" ->
+    results[name] = ok
+    println((ok ? "PASS " : "FAIL ") + name + (ok ? "" : " -> " + detail))
+}
+def waitIdle = { dlg, int seconds = 300 ->
+    def end = System.currentTimeMillis() + seconds * 1000
+    while (System.currentTimeMillis() < end) { Thread.sleep(200); if (!dlg.running && fx { !dlg.runButton.disable }) return true }
+    return false
+}
+def waitFor = { Closure cond, int seconds = 60 -> def end = System.currentTimeMillis() + seconds * 1000; while (System.currentTimeMillis() < end) { if (cond()) return true; Thread.sleep(100) }; return false }
+def status = { dlg -> fx { dlg.status.text } }
+def pick = { dlg, app, tool -> fx { dlg.appBox.value = app }; fx { dlg.toolBox.value = tool }; Thread.sleep(500) }
+def settle = { LcRetention.pruneThreads*.join(20000); LcRetention.pruneThreads.clear() }       // the prune subprocesses of the runs so far have ended
+def run = { dlg -> fx { dlg.run() }; Thread.sleep(800); def ok = waitIdle(dlg, 120); settle(); ok }
+def gateOf = { String name -> new File(System.getProperty("java.io.tmpdir"), "lc_gate_" + name + "_" + System.nanoTime()).path }
+def busy = { dlg -> waitFor({ fx { dlg.worker != null && dlg.worker.currentTask != null } }, 30) }
+
+Thread.start("lc-gui-test") {
+    try {
+        // ---- a scratch LC_HOME with a copy of the `runs` app, and the conformance data
+        def home = new File(System.getenv("LC_HOME")); assert home.path.contains("lhome_retention")
+        home.deleteDir(); def apps = new File(home, "apps"); apps.mkdirs()
+        def srcApps = new File(SHARED_HOME, "apps")
+        def installApp = { String name, Closure edit = null ->
+            def schema = LcJson.parse(new File(srcApps, "runs.schema.json")) as Map
+            if (edit != null) edit(schema)
+            new File(apps, name + ".schema.json").text = LcJson.toJson(schema)
+            def entry = LcJson.parse(new File(srcApps, "runs.json")) as Map
+            new File(apps, name + ".json").text = LcJson.toJson(entry + [name: name, schema_path: new File(apps, name + ".schema.json").path])
+            ["chmod", "644", new File(apps, name + ".json").path, new File(apps, name + ".schema.json").path].execute().waitFor()
+        }
+        installApp("runs")
+        def RUNS = LcJson.parse(new File(apps, "runs.json")) as Map
+        def PY = RUNS.python as String
+        def confPath = System.getenv("LC_CONFORMANCE") ?: [PY, "-m", "labconstrictor_tools.conformance", "--path"].execute().text.trim()
+        def CONF = LcJson.parse(new File(confPath))
+        def RET = CONF.wrong_science.retention
+        def hostCase = { String id -> def c = RET.fixtures_hosts.find { it.id == id }; assert c != null : "conformance.json has no host case " + id; c }
+        expect("conformance_has_the_host_retention_cases", ["HRET-01", "HRET-02", "HRET-03", "HRET-04", "HRET-05", "HRET-06", "RET-10", "RET-11"].every { hostCase(it) != null } && RET.markers.owner_file == LcRetention.OWNER_FILE && RET.markers.done_file == LcRetention.DONE_FILE, RET.keySet())
+        expect("the_markers_are_the_conformance_markers", RET.markers.done_statuses == LcRetention.STATUSES && LcRetention.HOST in RET.markers.hosts && "result" in RET.markers.owner_kinds && "run" in RET.markers.owner_kinds, RET.markers)
+        expect("the_quotas_are_the_conformance_limits", CONF.limits.results_kept.value == 20 && CONF.limits.run_records_kept.value == 50)
+
+        fx {
+            def dir = new File(System.getProperty("java.io.tmpdir"), "qp_project_retention"); dir.deleteDir()
+            qupath.lib.gui.prefs.PathPrefs.imageTypeSettingProperty().set(qupath.lib.gui.prefs.PathPrefs.ImageTypeSetting.AUTO_ESTIMATE)
+            def project = qupath.lib.projects.Projects.createProject(dir, BufferedImage)
+            def server = qupath.lib.images.servers.ImageServers.buildServer(BLOBS)
+            def entry = project.addImage(server.getBuilder()); entry.setImageName("blobs.tif")
+            project.syncChanges(); qupath.setProject(project); qupath.openImageEntry(entry); entry
+        }
+        Thread.sleep(2500)
+        def resultsRoot = new File(home, "results"), runsRoot = new File(home, "runs")
+        def pruneLog = new File(home, "prune_calls.log")
+        def RECORDER = "import json, os, sys\nhome = os.environ['LC_HOME']\ndone = {}\nfor root in ('results', 'runs'):\n    d = os.path.join(home, root)\n    for n in (sorted(os.listdir(d)) if os.path.isdir(d) else []):\n        done[root + '/' + n] = os.path.exists(os.path.join(d, n, '.lc-done.json'))\nopen(sys.argv[1], 'a').write(json.dumps({'argv': sys.argv[2:], 'done': done}) + '\\n')\n"
+        def useRecorder = { LcRetention.pruneCommandFor = { Map entry -> [PY, "-c", RECORDER, pruneLog.path, "prune"] as List<String> } }
+        def useRealPrune = { LcRetention.pruneCommandFor = null }
+        useRecorder()
+        def calls = { pruneLog.isFile() ? pruneLog.readLines().collect { LcJson.parseText(it) as Map } : [] }
+        def dlg = fx { lcShow() }
+        Thread.sleep(800)
+        def names = { File root -> (root.listFiles() ?: []).findAll { it.isDirectory() }*.name.sort() }
+        def json = { File f -> f.isFile() ? (LcJson.parse(f) as Map) : [missing: f.path] }      // a missing marker is a failed check, not a dead body
+def readText = { File f -> f.isFile() ? f.getText("UTF-8") : "<missing " + f.path + ">" }
+        def newest = { File root -> (root.listFiles() ?: []).findAll { it.isDirectory() && !it.name.startsWith(".") }.max { it.name } }
+        def owned = { File root -> (root.listFiles() ?: []).findAll { it.isDirectory() && new File(it, ".lc-owner.json").isFile() } }
+        // folders Tools itself would treat as eligible (they carry valid markers): the dry run of the real prune lists them as kept (or deleted), never as skipped
+        def toolsView = {
+            def pr = new ProcessBuilder([PY, "-m", "labconstrictor_tools", "prune", "--dry-run", "--json"]).redirectErrorStream(true).start()
+            def text = pr.inputStream.getText("UTF-8"); pr.waitFor()
+            def report = LcJson.parseText(text) as Map
+            report.roots.collectEntries { r -> [(r.kind): [eligible: (r.kept + r.deleted) as List, skipped: r.skipped.collectEntries { [(it.name): it.reason] }]] }
+        }
+
+        // ---- HRET-03: one run: both folders have a valid owner marker first and, after the run, a valid done marker with the right status; Tools judges them eligible
+        pick(dlg, "runs", "Quick values")
+        run(dlg)
+        expect("HRET-03_run_completes", status(dlg).startsWith("done"), status(dlg))
+        def resFolder = newest(resultsRoot), runFolder = newest(runsRoot)
+        expect("HRET-03_results_folder_is_named_like_the_command_line", resFolder != null && resFolder.name ==~ /^\d{8}T\d{6}_[0-9a-f]{6}_runs_quick_values$/, resFolder?.name)
+        for (def pair : [[resFolder, "result"], [runFolder, "run"]]) {
+            File f = pair[0]; String kind = pair[1]
+            def owner = json(new File(f, ".lc-owner.json")), done = json(new File(f, ".lc-done.json"))
+            expect("HRET-03_" + kind + "_owner_marker_is_valid", owner.lc_marker == 1L && owner.lc_marker instanceof Long && owner.kind == kind && owner.name == f.name && owner.host == "qupath" && owner.pid == ProcessHandle.current().pid() &&
+                    owner.token ==~ /^[A-Za-z0-9_-]{8,64}$/ && owner.created ==~ /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/ && owner.keySet() as List == RET.markers.owner_fields, owner)
+            expect("HRET-03_" + kind + "_done_marker_says_ok", done.status == "ok" && done.finished ==~ /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/ && done.keySet() as List == RET.markers.done_fields, done)
+        }
+        expect("HRET-03_no_temporary_marker_file_is_left", [resFolder, runFolder].every { f -> f.list().every { !it.contains(".tmp-") } }, [resFolder.list(), runFolder.list()])
+        def view = toolsView()
+        expect("HRET-03_tools_itself_finds_both_folders_eligible", resFolder.name in view.result.eligible && runFolder.name in view.run.eligible && !view.result.skipped.containsKey(resFolder.name) && !view.run.skipped.containsKey(runFolder.name), view)
+        def rec = json(new File(runFolder, "run.json"))
+        expect("HRET-03_run_record_is_the_tools_record_with_the_run_identity", rec.status == "COMPLETE" && rec.app == "runs" && rec.tool == "quick_values" && rec.host == "qupath" && rec.run_id ==~ /^[0-9a-f-]{36}$/ && rec.started_utc ==~ /^\d{4}-.*Z$/ && rec.finished_utc.endsWith("Z") && !rec.inputs.containsKey("_job_dir"), rec.keySet())
+
+        // ---- HRET-04: the prune subprocess starts after the done files exist; a failing command and one that cannot start do not fail the run
+        def first = calls()
+        expect("HRET-04_the_recorder_saw_prune_after_the_done_files", first.size() == 1 && first[0].argv == ["prune"] && first[0].done["results/" + resFolder.name] == true && first[0].done["runs/" + runFolder.name] == true, first)
+        expect("HRET-04_the_real_command_is_the_tools_cli_in_the_apps_python", { useRealPrune(); def c = LcRetention.pruneCommand(RUNS); useRecorder(); c == [PY, "-m", "labconstrictor_tools", "prune"] }.call(), "")
+        LcRetention.pruneCommandFor = { Map entry -> [PY, "-c", "import sys; sys.exit(3)"] as List<String> }
+        run(dlg)
+        expect("HRET-04_a_failing_prune_does_not_fail_the_run", status(dlg).startsWith("done") && LcLog.recent.any { it.contains("prune ended with exit code 3") }, [status(dlg), LcLog.recent.takeRight(3)])
+        LcRetention.pruneCommandFor = { Map entry -> ["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/nonexistent/prune-command"] as List<String> }
+        run(dlg)
+        expect("HRET-04_a_prune_that_cannot_start_does_not_fail_the_run_and_is_said", status(dlg).startsWith("done") && LcLog.recent.any { it.contains("prune could not be started") }, [status(dlg), LcLog.recent.takeRight(3)])
+        expect("HRET-04_both_failures_are_in_the_shared_log", new File(home, "logs/labconstrictor.log").text.with { it.contains("prune ended with exit code 3") && it.contains("prune could not be started") })
+        expect("HRET-04_a_failing_prune_deletes_nothing_itself", names(resultsRoot).size() == 3 && names(runsRoot).size() == 3, [names(resultsRoot), names(runsRoot)])
+        useRecorder()
+
+        // ---- HRET-01: foreign folders survive 60 runs; HRET-02: done(60) results and done(120) records already there survive 5 more (the recorder stands in for prune)
+        def foreignResult = new File(resultsRoot, "20261008T120000_reanalysis_backup"); foreignResult.mkdirs(); new File(foreignResult, "x.txt").text = "keep"
+        def foreignRun = new File(runsRoot, "0000_keep_this_analysis"); foreignRun.mkdirs(); new File(foreignRun, "x.txt").text = "keep"
+        def seed = { File root, String kind, int n, String tag ->
+            (1..n).collect { i ->
+                def f = new File(root, String.format("20200101T%06d_%s_seed", i, tag)); f.mkdirs(); LcRetention.writeOwner(f, kind); new File(f, "sentinel.txt").text = "old " + i; LcRetention.writeDone(f, "ok"); f
+            }
+        }
+        def seededResults = seed(resultsRoot, "result", 60, "aaaaaa"), seededRuns = seed(runsRoot, "run", 120, "bbbbbb")
+        def before = [names(resultsRoot).size(), names(runsRoot).size()]
+        for (int i = 0; i < 60; i++) { fx { dlg.run() }; Thread.sleep(300); waitIdle(dlg, 120); settle() }
+        def intact = { List<File> list -> list.every { readText(new File(it, "sentinel.txt")).startsWith("old ") } }
+        expect("HRET-01_foreign_folders_survive_60_runs", readText(new File(foreignResult, "x.txt")) == "keep" && readText(new File(foreignRun, "x.txt")) == "keep", names(resultsRoot).take(3))
+        expect("HRET-02_no_old_folder_is_gone_after_60_runs", intact(seededResults) && intact(seededRuns) && names(resultsRoot).size() == before[0] + 60 && names(runsRoot).size() == before[1] + 60, [names(resultsRoot).size(), names(runsRoot).size()])
+        expect("HRET-04_prune_was_started_after_every_run", calls().size() >= 1 + 60, calls().size())
+        expect("HRET-04_each_prune_saw_the_runs_done_files", calls().drop(1).every { c -> c.done.findAll { k, v -> k.startsWith("runs/2026") }.values().every { it } }, calls().last())
+        expect("HRET-02_the_markers_of_all_60_new_folders_are_valid_for_tools", { def v = toolsView(); owned(resultsRoot).findAll { !it.name.contains("seed") }.every { it.name in v.result.eligible } && owned(runsRoot).findAll { !it.name.contains("seed") }.every { it.name in v.run.eligible } }.call(), "")
+
+        // ---- the real prune, started by the host after the run: newest 20 results and 50 records stay, everything else that is not eligible is untouched
+        useRealPrune()
+        def legacy = (1..30).collect { new File(resultsRoot, String.format("20190101T%06d_abcdef_old_tool", it)) }; legacy.each { it.mkdirs(); new File(it, "legacy.txt").text = "legacy" }
+        def unfinished = new File(resultsRoot, "20200202T000000_unfinished_x"); unfinished.mkdirs(); LcRetention.writeOwner(unfinished, "result"); new File(unfinished, "work.txt").text = "active"
+        def renamed = new File(resultsRoot, "20200303T000000_renamed_copy"); renamed.mkdirs(); LcRetention.writeOwner(renamed, "result"); LcRetention.writeDone(renamed, "ok"); new File(renamed, "r.txt").text = "copy"
+        def ownerText = new File(renamed, ".lc-owner.json"); ownerText.text = ownerText.text.replace(renamed.name, "some_other_name")
+        def outside = new File(home, "outside"); outside.mkdirs(); LcRetention.writeOwner(outside, "result"); LcRetention.writeDone(outside, "ok"); new File(outside, "precious.txt").text = "precious"
+        def link = new File(resultsRoot, "20200404T000000_link_x_y"); java.nio.file.Files.createSymbolicLink(link.toPath(), outside.toPath())
+        run(dlg)
+        run(dlg)
+        def survivors = names(resultsRoot)
+        def ownedDone = owned(resultsRoot).findAll { new File(it, ".lc-done.json").isFile() && it != renamed && !java.nio.file.Files.isSymbolicLink(it.toPath()) }
+        expect("real_prune_keeps_exactly_the_newest_20_results", ownedDone.size() == 20, ownedDone.size())
+        def runsKept = owned(runsRoot).findAll { new File(it, ".lc-done.json").isFile() }
+        expect("real_prune_keeps_exactly_the_newest_50_run_records", runsKept.size() == 50, runsKept.size())
+        expect("real_prune_kept_the_newest_by_created_not_the_oldest", ownedDone.every { it.name.contains("runs_quick_values") && !it.name.contains("seed") }, ownedDone*.name.take(3))
+        expect("real_prune_never_touches_legacy_foreign_unfinished_renamed_or_linked_folders", legacy.every { readText(new File(it, "legacy.txt")) == "legacy" } && readText(new File(foreignResult, "x.txt")) == "keep" && readText(new File(foreignRun, "x.txt")) == "keep" &&
+                readText(new File(unfinished, "work.txt")) == "active" && readText(new File(renamed, "r.txt")) == "copy" && java.nio.file.Files.isSymbolicLink(link.toPath()) && readText(new File(outside, "precious.txt")) == "precious" && new File(outside, ".lc-done.json").isFile(), survivors.take(5))
+        expect("real_prune_removed_the_old_owned_ones_through_tools_only", !new File(resultsRoot, "20200101T000001_aaaaaa_seed").exists() && !new File(runsRoot, "20200101T000001_bbbbbb_seed").exists(), "")
+        useRecorder()
+
+        // ---- HRET-05: the person pressed Cancel, the tool ignores it and the worker is killed after the grace period: CRASHED with Cancel is `cancelled`
+        pick(dlg, "runs", "Never returns")
+        fx { dlg.setters["gate"](gateOf("never")) }
+        def cnt = [names(resultsRoot).size(), names(runsRoot).size()]
+        fx { dlg.run() }
+        busy(dlg); Thread.sleep(500)
+        fx { dlg.cancel() }
+        expect("HRET-05_the_run_ends_after_the_grace_period", waitIdle(dlg, 60), status(dlg)); settle()
+        expect("HRET-05_the_status_says_cancelled", status(dlg) == "cancelled (worker stopped)", status(dlg))
+        def r5 = newest(runsRoot), s5 = newest(resultsRoot)
+        def rec5 = json(new File(r5, "run.json"))
+        expect("HRET-05_both_owned_folders_are_cancelled_not_failed", names(runsRoot).size() == cnt[1] + 1 && json(new File(r5, ".lc-done.json")).status == "cancelled" && json(new File(s5, ".lc-done.json")).status == "cancelled", [json(new File(r5, ".lc-done.json")), json(new File(s5, ".lc-done.json"))])
+        expect("HRET-05_the_crash_text_is_in_the_run_record", rec5.status == "CRASHED" && rec5.error instanceof String && rec5.error.contains("worker"), rec5.error)
+        expect("HRET-05_the_case_in_the_conformance_file_says_the_same", hostCase("HRET-05").task_status == "CRASHED" && hostCase("HRET-05").cancel_requested == true && hostCase("HRET-05").done_status == "cancelled" && RET.done_status.crashed_after_cancel == "cancelled")
+
+        // ---- HRET-06: the worker dies with no Cancel pressed: CRASHED without Cancel is `failed`
+        pick(dlg, "runs", "Dies")
+        run(dlg)
+        def r6 = newest(runsRoot), s6 = newest(resultsRoot)
+        expect("HRET-06_the_status_is_the_crash", status(dlg).startsWith("the worker stopped:"), status(dlg))
+        expect("HRET-06_both_owned_folders_are_failed", json(new File(r6, ".lc-done.json")).status == "failed" && json(new File(s6, ".lc-done.json")).status == "failed" && json(new File(r6, "run.json")).status == "CRASHED", [json(new File(r6, ".lc-done.json")), json(new File(s6, ".lc-done.json"))])
+        expect("HRET-06_the_case_in_the_conformance_file_says_the_same", hostCase("HRET-06").task_status == "CRASHED" && hostCase("HRET-06").cancel_requested == false && hostCase("HRET-06").done_status == "failed" && RET.done_status.by_task_status.CRASHED == "failed")
+
+        // ---- RET-11: a failed run and a cooperative cancel leave their owned folders failed / cancelled and the temporary export folder removed; a tool error is failed whatever Cancel did
+        pick(dlg, "runs", "Fails")
+        run(dlg)
+        def r11 = newest(runsRoot)
+        def exportDirOf = { File recFolder -> def img = (json(new File(recFolder, "run.json")).inputs as Map).values().find { it instanceof String && it.contains("lcqupath_") }; img ? new File(img as String).parentFile : null }
+        expect("RET-11_a_failed_run_is_failed", status(dlg).startsWith("failed:") && json(new File(r11, ".lc-done.json")).status == "failed" && json(new File(newest(resultsRoot), ".lc-done.json")).status == "failed", status(dlg))
+        pick(dlg, "runs", "Delayed values")
+        fx { dlg.setters["gate"](gateOf("coop")) }
+        fx { dlg.run() }
+        busy(dlg); Thread.sleep(300)
+        fx { dlg.cancel() }
+        waitIdle(dlg, 60); settle()
+        def r11c = newest(runsRoot)
+        expect("RET-11_a_cancelled_run_is_cancelled", status(dlg) == "cancelled" && json(new File(r11c, ".lc-done.json")).status == "cancelled" && json(new File(newest(resultsRoot), ".lc-done.json")).status == "cancelled" && json(new File(r11c, "run.json")).status == "CANCELED", status(dlg))
+        pick(dlg, "runs", "Delayed points")
+        fx { dlg.setters["gate"](gateOf("tmpdir")) }
+        fx { dlg.run() }
+        busy(dlg)
+        def liveExport = (fx { dlg.runSnapshot }).resultsPath      // the results folder exists while the run goes
+        expect("RET-11_the_results_folder_exists_with_its_owner_marker_while_the_run_goes", new File(liveExport, ".lc-owner.json").isFile() && !new File(liveExport, ".lc-done.json").isFile(), liveExport)
+        fx { dlg.cancel() }
+        waitIdle(dlg, 60); settle()
+        def r11d = newest(runsRoot)
+        expect("RET-11_the_temporary_export_folder_is_removed", exportDirOf(r11d) != null && !exportDirOf(r11d).exists(), exportDirOf(r11d))
+
+        // ---- RET-10: the reported file is under results/, owned, and still there after the window is closed
+        pick(dlg, "runs", "Writes a table")
+        def gate10 = gateOf("table"); new File(gate10).text = "go"
+        fx { dlg.setters["gate"](gate10) }
+        run(dlg)
+        def table = json(new File(newest(runsRoot), "run.json")).results.find { it.type == "table" }
+        expect("RET-10_the_reported_path_is_under_results_and_has_the_data", table != null && new File(table.path as String).isFile() && (table.path as String).startsWith(resultsRoot.path + "/") && new File(table.path as String).text.contains("1,x"), table)
+        fx { dlg.stage.hide() }
+        Thread.sleep(500); settle()
+        expect("RET-10_the_file_is_still_there_after_the_window_closed", new File(table.path as String).isFile() && new File(new File(table.path as String).parentFile, ".lc-done.json").isFile(), table.path)
+        dlg = fx { lcShow() }; Thread.sleep(800)
+
+        // ---- the host has no code that deletes under results/ or runs/ (a scan of the script files; the only delete is the temporary export folder's)
+        def resDir = new File("src/main/resources/org/cellmigrationlab/labconstrictor/qupath")
+        def sources = new File(resDir, "parts.txt").readLines().findAll { it.trim() }.collectEntries { [(it): new File(resDir, it).readLines()] }
+        def deleteWords = ~/deleteDir|deleteOnExit|deleteDirectory|\.delete\(|Files\.delete|walkFileTree|FileUtils|moveToTrash|\brmdir\b|\.deleteRecursively/
+        def hits = sources.collectMany { name, lines -> lines.findAll { it =~ deleteWords && !it.contains("stderrTail.delete(") && !it.trim().startsWith("//") && !it.trim().startsWith("*") && !it.trim().startsWith("/**") }.collect { name + ": " + it.trim() } }
+        println "DELETE HITS " + hits
+        expect("no_code_deletes_a_folder_but_the_temporary_export_one", hits.size() == 1 && hits[0].contains("LcLog") == false && hits[0].contains("!dir.deleteDir()"), hits)
+        def callers = sources.collectMany { name, lines -> lines.findAll { it.contains("deleteTemp(") && !it.contains("static void deleteTemp") }.collect { it.trim() } }
+        expect("the_only_caller_of_it_passes_the_temporary_export_folder", callers.size() >= 1 && callers.every { it.contains("deleteTemp(tmp)") }, callers)
+
+        // ---- Tools too old: the run is refused with the sentence, no folder is made and nothing starts
+        installApp("runs_old") { Map schema -> schema.tools_version = "0.2.0rc1"; schema.features = ["reserved_inputs_v1", "retention_prune"] }
+        installApp("runs_nofeature") { Map schema -> schema.features = ["reserved_inputs_v1"] }
+        installApp("runs_unknown") { Map schema -> schema.remove("tools_version"); schema.remove("features") }
+        fx { dlg.rescan() }
+        def count = [names(resultsRoot).size(), names(runsRoot).size()]
+        for (def pair : [["runs_old", "0.2.0rc1 is older than the 0.3.0a1 this host needs: update it"], ["runs_nofeature", "lacks retention_prune: update it"], ["runs_unknown", "it lists no features"]]) {
+            pick(dlg, pair[0], "Quick values")
+            fx { dlg.run() }
+            Thread.sleep(500)
+            expect("compat_" + pair[0] + "_is_refused_with_a_clear_sentence", status(dlg).startsWith("this app's labconstrictor-tools") && status(dlg).contains(pair[1] as String) && !fx { dlg.running }, status(dlg))
+        }
+        expect("compat_a_refused_run_made_no_folder_and_started_no_worker", names(resultsRoot).size() == count[0] && names(runsRoot).size() == count[1] && fx { dlg.worker == null || dlg.workerApp == "runs" }, count)
+
+        // ---- a record that cannot be built is said, and its folders are neither finished nor removed
+        def entryBad = [python: "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/nonexistent/python", pythonpath: [], runtime_path: ""]
+        def odd = LcRuns.begin("runs", "quick_values")
+        def ended = LcRuns.finish(odd, null, [entry: entryBad, app: "runs", tool: "quick_values", inputs: [:], outcome: [responseType: "COMPLETION"], seconds: 0d, stderr: "", runId: "x", startedUtc: "y"])
+        expect("an_unbuildable_record_is_a_problem_sentence_and_its_folder_stays_unfinished", ended.problem != null && ended.problem.contains("run record could not be written") && odd.isDirectory() && new File(odd, ".lc-owner.json").isFile() && !new File(odd, ".lc-done.json").exists() && !new File(odd, "run.json").exists(), ended)
+        expect("that_problem_is_in_the_log_and_in_the_status", LcLog.recent.any { it.contains("could not write the run record") } && fx { dlg.finish("runs", "Quick values", [responseType: "COMPLETION", recordProblem: ended.problem], 0.1d); dlg.status.text }.contains("run record could not be written"), "")
+        def badDone = null
+        try { LcRetention.writeDone(odd, "weird") } catch (IllegalArgumentException e) { badDone = e.message }
+        expect("a_done_status_outside_the_three_is_refused", badDone != null && badDone.contains("ok, failed, cancelled") && !new File(odd, ".lc-done.json").exists(), badDone)
+
+    } catch (Throwable t) { t.printStackTrace(); results["EXCEPTION"] = false }
+    finally { println "RESULTS " + results; Thread.sleep(500); System.exit(results && results.every { it.value } ? 0 : 1) }
+}
diff --git a/tests/run_gui_ci.sh b/tests/run_gui_ci.sh
index eaaa8be..0e47ed8 100755
--- a/tests/run_gui_ci.sh
+++ b/tests/run_gui_ci.sh
@@ -18,15 +18,16 @@ declare -A needs=(
   [gui_test_playground_body.groovy]="LabConstrictorPlayground"
   [gui_test_frame_body.groovy]="frame"
   [gui_test_calibration_body.groovy]="frame"
-  [gui_test_frame_body.groovy]="frame"
-  [gui_test_calibration_body.groovy]="frame"
+  [gui_test_retention_body.groovy]="runs"
+  [gui_test_identity_body.groovy]="runs frame"
 )
 for b in area buttons channel copy fallbacks interactions region shapes widgets; do needs[gui_test_${b}_body.groovy]="interactions"; done
 for b in parity_form parity_host parity_lifecycle parity_messages parity_pixel parity_results parity_support parity_quote; do needs[gui_test_${b}_body.groovy]="interactions"; done
 needs[gui_test_parity_cancel_body.groovy]="LabConstrictorPlayground interactions"
 # bodies that write their own registry and results (they empty LC_HOME first, so each gets a scratch LC_HOME named as the body asserts; the registered apps stay in LC_SHARED_HOME)
 declare -A scratch=([gui_test_parity_trust_body.groovy]=lhome_trust [gui_test_parity_form_body.groovy]=lhome_form [gui_test_parity_host_body.groovy]=lhome_host
-  [gui_test_parity_lifecycle_body.groovy]=lhome_life [gui_test_parity_pixel_body.groovy]=lhome_pixel [gui_test_parity_support_body.groovy]=lhome_support)
+  [gui_test_parity_lifecycle_body.groovy]=lhome_life [gui_test_parity_pixel_body.groovy]=lhome_pixel [gui_test_parity_support_body.groovy]=lhome_support
+  [gui_test_retention_body.groovy]=lhome_retention [gui_test_identity_body.groovy]=lhome_identity)
 SHARED_HOME="$LC_HOME"; export LC_SHARED_HOME="$SHARED_HOME"
 # bodies that are skipped (not failed) while their apps are not registered: the bridge of these two apps is not on their main branch yet
 optional="gui_test_body.groovy"
diff --git a/tests/run_gui_test.sh b/tests/run_gui_test.sh
index 6878208..1b6d6ec 100755
--- a/tests/run_gui_test.sh
+++ b/tests/run_gui_test.sh
@@ -11,6 +11,8 @@ p = sys.argv[1]; s = open(p).read()
 if "labconstrictor-qupath" not in s:
     open(p, "w").write(s.replace("app.mainclass=qupath.QuPath\n", "app.mainclass=qupath.QuPath\napp.classpath=$APPDIR/labconstrictor-qupath-0.1.0.jar\n", 1))
 PY
-cat src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy "tests/${BODY:-gui_test_body.groovy}" > "${TMPDIR:-/tmp}/lc_gui_test.groovy"
+# the script is joined from the files listed in parts.txt (the same order the extension uses), then the test body is appended
+RES=src/main/resources/org/cellmigrationlab/labconstrictor/qupath
+{ while IFS= read -r part || [ -n "$part" ]; do [ -z "$part" ] || { cat "$RES/$part"; echo; }; done < "$RES/parts.txt"; cat "tests/${BODY:-gui_test_body.groovy}"; } > "${TMPDIR:-/tmp}/lc_gui_test.groovy"
 export QT_QPA_PLATFORM=
 xvfb-run -a -s "-screen 0 1600x1000x24" "$QUPATH/bin/QuPath" -q -Dlc.noshow=true -Dlc.qupath.test.script="${TMPDIR:-/tmp}/lc_gui_test.groovy" -Dlc.test.out="${OUT:-/tmp/qp_shots}" -Dlc.test.fixtures="$PWD/tests/fixtures"
diff --git a/tests/runs_app/runs_lc_tools.py b/tests/runs_app/runs_lc_tools.py
new file mode 100644
index 0000000..9c8d68e
--- /dev/null
+++ b/tests/runs_app/runs_lc_tools.py
@@ -0,0 +1,83 @@
+"""Test tools for run identity (RUN-01..07), retention (HRET-01..06, RET-10, 11) and number limits (NUM-01..05).
+
+A DELAYED tool blocks on a gate file that the test creates (a deterministic barrier: nothing here depends on timing), so the test can change the open image, the selection, the form or
+the app while a run is going and then release it. `never_returns` ignores Cancel (the worker has to be killed), `dies` ends its own process."""
+import os
+import time
+from typing import Annotated, Optional
+
+from labconstrictor_tools import ApplyTo, ClearAfterRun, Image, Max, MessageOut, Name, PointsOut, Scalars, TableOut, ToolError, check_cancel, tool
+
+WAIT_LIMIT_S = 180
+
+
+def _wait_for(gate: str, honour_cancel: bool) -> None:
+    end = time.time() + WAIT_LIMIT_S
+    while gate and not os.path.exists(gate) and time.time() < end:
+        if honour_cancel:
+            check_cancel()
+        time.sleep(0.05)
+
+
+@tool("Delayed points")
+def delayed_points(
+    image: Image, gate: str = "", y: float = 3.0, x: float = 4.0
+) -> tuple[Annotated[PointsOut, Name("marks"), ApplyTo("image")], Annotated[Scalars, Name("seen")]]:
+    """Wait for the gate file, then return one point at (y, x) of the image it received and the shape it received."""
+    shape = [int(n) for n in image.shape]
+    _wait_for(gate, True)
+    return [{"y": float(y), "x": float(x)}], {"image_shape": shape, "tool": "delayed_points"}
+
+
+@tool("Delayed values")
+def delayed_values(gate: str = "") -> Annotated[Scalars, Name("seen")]:
+    """Wait for the gate file, then return a value (a tool the test switches to while another one runs)."""
+    _wait_for(gate, True)
+    return {"tool": "delayed_values"}
+
+
+@tool("Quick values")
+def quick_values(n: Annotated[int, ClearAfterRun()] = 1) -> Annotated[Scalars, Name("seen")]:
+    """Return at once (the other tool of the app). `n` is reset after a run: the test checks that the end of ANOTHER tool's run does not reset it."""
+    return {"tool": "quick_values", "n": int(n)}
+
+
+@tool("Writes a table")
+def writes_table(gate: str = "") -> tuple[Annotated[TableOut, Name("report")], Annotated[MessageOut, Name("done")]]:
+    """Wait for the gate file, then return a table: its file is in the results folder of the run (RET-10)."""
+    _wait_for(gate, True)
+    return {"a": [1, 2, 3], "b": ["x", "y", "z"]}, "report written"
+
+
+@tool("Fails")
+def fails() -> Annotated[Scalars, Name("seen")]:
+    """The tool raises an error (the run ends FAILED)."""
+    raise ToolError("boom", "deliberate failure")
+
+
+@tool("Never returns")
+def never_returns(gate: str = "") -> Annotated[Scalars, Name("seen")]:
+    """Ignore Cancel for as long as the gate file does not exist: the host has to kill the worker (HRET-05)."""
+    _wait_for(gate, False)
+    return {"tool": "never_returns"}
+
+
+@tool("Dies")
+def dies() -> Annotated[Scalars, Name("seen")]:
+    """End the worker process at once, with no Cancel pressed (HRET-06)."""
+    os._exit(7)
+
+
+@tool("Numbers")
+def numbers(
+    whole: int = 0,
+    ratio: float = 0.0,
+    capped: Annotated[int, Max(10)] = 1,
+    maybe: Optional[int] = None,
+) -> Annotated[Scalars, Name("seen")]:
+    """Report the numbers it received, as text and with their Python types (NUM-01..05): the request must carry exactly what was typed."""
+    return {
+        "whole": str(whole), "whole_type": type(whole).__name__,
+        "ratio": repr(ratio), "ratio_type": type(ratio).__name__,
+        "capped": str(capped), "maybe": None if maybe is None else str(maybe),
+    }