diff --git a/README.md b/README.md
index a137add..9132ca7 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ Needs **labconstrictor-tools 0.3.0a1 or newer** in the app's environment (the ru
 * **Trust checks** on every registry entry (same rules as the Python registry and the Fiji script): the entry names its five text fields; the app name is a plain name; the interpreter lies inside the install prefix (which is not a filesystem root); the entry and its schema file are owned by you (in a shared folder also by root) and not writable by group or others; the schema sits next to the entry; the interpreter, its folder and the prefix are not writable by everybody (a sticky folder like `/tmp` excepted); tool ids and parameter names are plain names, parameter names Python identifiers (a parameter name becomes a file name). An entry that fails is listed under "skipped" with its reason and never started. On Windows the owner and permission checks do not apply.
 * **Results and run records, and their clean-up** (SPEC_WRONG_SCIENCE section 3). Each run makes a results folder `~/.labconstrictor/results/<time>_<6 hex>_<app>_<tool>` (names made safe, like the command line) and a run record folder `~/.labconstrictor/runs/<time>_<app>_<tool>`. **This host never deletes anything there.** It writes the two marker files of the spec: `.lc-owner.json` first, when the folder is made (a QuPath that dies mid-run leaves an owned, unfinished folder that nobody removes), and `.lc-done.json` last, atomically, when the run ends: `ok` (completed), `cancelled` (the tool honoured Cancel, or the worker had to be killed after Cancel was pressed, or the window was closed during the run), `failed` (the tool failed, or the worker died with no Cancel pressed). The status comes from the Tools helper `labconstrictor_tools.runs.done_status`. Then it starts `labconstrictor-tools prune` (`<the app's Python> -m labconstrictor_tools prune`) in a subprocess and does not wait for it: the newest 20 finished results and the newest 50 run records are kept, and Tools removes the older ones, **only** folders that carry a valid owner marker and a done marker. Folders from older versions (no marker), foreign folders, folders of runs that are still going or that crashed with QuPath (no done marker), links and files are never removed and do not use up the quota. A prune that cannot start, or that fails, is written to the log (`prune could not be started ...` / `prune ended with exit code N`) and never fails or delays the run; the folders then stay until a `prune` works. The older folders written by earlier versions of this script have no marker, so they are never cleaned up automatically (Tools has a follow-up item for an explicit `clean --legacy`).
 * **Run record** `runs/<...>/run.json`: built by the Tools helper `labconstrictor_tools.runs.build_record` and written with `record_json` (this script keeps no copy of the layout), plus `"host": "qupath"`, the `run_id` and `started_utc` of the run, and the `_calibration` input. A crash after Cancel keeps its crash text there (status `CRASHED`). If the record cannot be built (the app's Python cannot start, the helper fails) the status line says `(the run record could not be written (...); its folders stay as they are and are never removed)`. Every log line is also appended to the shared `~/.labconstrictor/logs/labconstrictor.log` (Tools line format, `qupath:` prefix, 1 MB rotation with 5 backups), so `labconstrictor-tools logs` and `support-bundle` see QuPath runs.
-* **Same rules as the other hosts** (the host-parity inventory of labconstrictor-tools): a form shows parameters in the Napari/Fiji order (a group gathered where it first appears; a Collapsed group is folded where it first appears; advanced last); `clear_after_run` resets every type of field; `enabled_when` follows text, number, choice, yes/no and "set" drivers (`""` counts as unset, numbers compare as numbers); a whole-number box holds ±(2^53 - 1) at most, declared limits or not (the largest whole number a double holds exactly, Tools `notebook.MAX_FORM_INTEGER`; a typed number beyond it stops at the limit), a decimal box without declared limits ±1e15; a choice of integers is sent as an integer; a missing input says `'L' is required`; NaN is refused with `'L' must be a finite number`; a folder input must be a folder; a worker that is idle for 10 minutes is closed; a worker ended after Cancel reads `cancelled (worker stopped)`; a worker that died is explained with the Tools sentences (a missing package first, then the exit code); a tool with a parameter type this host does not know is refused alone (`this tool cannot be shown: ...`); two tools with one label are listed as `label (id)` and the apps are sorted by name; `Copy as command` writes Python text the way `repr` does (a newline cannot break the snippet) and says `there is no clipboard to copy to` when there is none; message results show `- ` items as bullets; a result file that is missing, or a result type this version does not know, is said in one sentence.
+* **Same rules as the other hosts** (the host-parity inventory of labconstrictor-tools): a form shows parameters in the Napari/Fiji order (a group gathered where it first appears; a Collapsed group is folded where it first appears; advanced last); `clear_after_run` resets every type of field; `enabled_when` follows text, number, choice, yes/no and "set" drivers (`""` counts as unset, numbers compare as numbers); a whole-number box holds ±(2^53 - 1) at most, declared limits or not (the largest whole number a double holds exactly, Tools `notebook.MAX_FORM_INTEGER`), a decimal box without declared limits ±1e15, and **a typed number beyond a limit is refused, never put at the limit** (see **Number limits** below); a choice of integers is sent as an integer; a missing input says `'L' is required`; NaN is refused with `'L' must be a finite number`; a folder input must be a folder; a worker that is idle for 10 minutes is closed; a worker ended after Cancel reads `cancelled (worker stopped)`; a worker that died is explained with the Tools sentences (a missing package first, then the exit code; exit code 3 is called an import failure only when the worker's last words contain `cannot import tool module`, Tools PR #124: the Windows C runtime also ends a process with 3 for `abort()` and a raised SIGSEGV); a tool with a parameter type this host does not know is refused alone (`this tool cannot be shown: ...`); two tools with one label are listed as `label (id)` and the apps are sorted by name; `Copy as command` writes Python text the way `repr` does (a newline cannot break the snippet) and says `there is no clipboard to copy to` when there is none; message results show `- ` items as bullets; a result file that is missing, or a result type this version does not know, is said in one sentence.
 
 ## Pixel size (calibration)
 A tool parameter linked to an image with `PixelSizeOf` (micrometres per pixel) is a text box with a button "Use the image's calibration". It follows the chosen image, the typed file and the image open in QuPath until you type a value (then your value stays, also when the image changes; press the button, or empty the box, to take the image's calibration again).
@@ -59,6 +59,13 @@ The tool receives only the area; **results come back on the right place of the s
 
 The downsample of an export is 1 for now and is kept next to the offset (`downsample`, always 1.0), so the later resolution step changes one place.
 
+## Number limits (SPEC_WRONG_SCIENCE section 6)
+* A whole-number box accepts ±(2^53 - 1) = ±9007199254740991 (`conformance.json` `limits.form_integer_max`) and a decimal box ±1e15 (`limits.unbounded_float`) when the tool declares no `Min` / `Max`; a declared bound is used as declared (a whole-number bound beyond 2^53 - 1 is cut to it).
+* **The text in the box is the value.** A whole number is read as an exact integer (no double ever holds it), a decimal number is compared with the limits as its exact decimal text (so `1.0000000000000002e15` and even `1.00000000000000001e15` are beyond 1e15), and the request carries exactly what was typed (`9007199254740991` stays `9007199254740991`). Surrounding spaces are not part of the number; `+5` and `007` are 5 and 7.
+* **Beyond a limit is refused, never clamped.** A number outside the limits (default or declared) starts no run and sends nothing: the status line says `'L' must be <= 9007199254740991` / `'L' must be >= -9007199254740991` (the worker's templates, `conformance.json` `messages.number_above_maximum` / `number_below_minimum`; a decimal limit is written the Python way, `'L' must be <= 1000000000000000.0`; a declared Max of 10 gives `'L' must be <= 10`). The typed text stays in the box, so what is refused is what is seen. This is said when the box loses focus or Enter is pressed, and again when Run is pressed. The arrows stop at the limits and never change typed text. Before this the box put a typed number at the nearest limit, so a typed 9007199254740993 was sent as 9007199254740991 and a declared Max of 10 turned 11 into 10.
+* Text that is not a number is refused too: `'L': '12x' is not a number`, `'L': '5.0' is not a whole number` (a whole-number box), `'L' must be a finite number` (`nan`, `inf`), `'L' is required` (empty). SPEC 6 gives only the integer sentence; the others are this host's wording (the float sentence and the not-a-number sentences are not in the spec).
+* A linked pixel size (`PixelSizeOf`) is its own text field with its own rules (positive and finite, see Pixel size); it does not use these limits.
+
 ## Run identity (SPEC_WRONG_SCIENCE section 4)
 A run is placed on the image it was exported from, never on whatever is open when it ends.
 
@@ -116,7 +123,9 @@ The `gui_test_parity_*` bodies need the registered `interactions` app (its Pytho
 
 `BODY=gui_test_parity_pixel_body.groovy LC_HOME=<scratch folder named lhome_pixel> tests/run_gui_test.sh` reads the pixel size of files (ImageJ unit, centimetre TIFF unit), keeps a typed value, says non-square pixels, reports an unreadable file (15 checks).
 
-`BODY=gui_test_parity_form_body.groovy LC_HOME=<scratch folder named lhome_form> tests/run_gui_test.sh` registers a synthetic app and checks the form order, ClearAfterRun for every type, EnabledWhen for every driver, number limits (whole numbers up to 2^53 - 1, held and typed), integer choices, required and non-finite inputs (55 checks).
+`BODY=gui_test_numbers_body.groovy LC_HOME=<scratch folder named lhome_numbers> tests/run_gui_test.sh` runs NUM-01..05 of `conformance.json` against the `Numbers` tool of the `runs` test app (it reports the text and the Python type of what its request carried): the limits and the sentences are read from the conformance file, a typed number beyond a limit is refused with no run and no request and its text stays in the box, a declared Max, decimals that a double cannot tell apart, the text rules, an optional number, Enter and focus lost, and the arrows.
+
+`BODY=gui_test_parity_form_body.groovy LC_HOME=<scratch folder named lhome_form> tests/run_gui_test.sh` registers a synthetic app and checks the form order, ClearAfterRun for every type, EnabledWhen for every driver, number limits (whole numbers up to 2^53 - 1, held; a typed number beyond the limit refused), integer choices, required and non-finite inputs (55 checks).
 
 `BODY=gui_test_parity_host_body.groovy LC_HOME=<scratch folder named lhome_host> tests/run_gui_test.sh` checks the tool chooser, an unsupported parameter type, folder inputs, the Python literal (also read back by Python), bullets, missing result files, a failing clipboard and the crash sentences (fake interpreters that print and exit); a missing image file is refused with the sentence, a missing table is left to the worker, a clipboard that refuses or throws is said (49 checks).
 
diff --git a/docs/user-guide.md b/docs/user-guide.md
index f0be880..18446ad 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -35,6 +35,7 @@ Choose **Extensions > LabConstrictor tools...**, pick an app and a tool, and pre
 - Results and run records are kept in `~/.labconstrictor/results` and `~/.labconstrictor/runs`. The extension never deletes them; after each run it starts `labconstrictor-tools prune`, which keeps the newest 20 results and 50 run records and removes only folders LabConstrictor made and finished. Folders from older versions of the extension are not removed automatically.
 - The app's `labconstrictor-tools` must be 0.3.0a1 or newer; with an older one the run is refused and the status line says to update it.
 - If you open another image while a tool runs, the results are not drawn on the new image: the status line says where the files are.
+- A number you type that is outside the allowed range (or is not a number) is refused with a sentence like `'Threshold' must be <= 10`; it is never changed to fit, and the run does not start.
 - `labconstrictor-tools doctor` shows which apps are registered.
 
 Source and issues: [LabConstrictor-QuPath](https://github.com/CellMigrationLab/LabConstrictor-QuPath).
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
index ccb548c..14ce249 100644
--- a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
@@ -79,7 +79,8 @@ class LcConst {
     static final String FILE_INPUT_NOTE = "file input: results are in the file's pixel frame"      // conformance.json messages.file_input_note (SPEC 1.3)
     static final String SIZE_MISMATCH_TEMPLATE = "'{name}' is {w} x {h} but '{source}' was exported as {w2} x {h2}; shown at the pixel origin, not aligned"      // messages.size_mismatch (SPEC 1.1.7)
     static final List<Long> NATIVE_CRASH_CODES = [-11L, 139L, 3221225477L, -1073741819L]   // segmentation fault (Linux, macOS) and the Windows access violation, unsigned (Python) and signed (Java)
-    static final int EXIT_TOOL_IMPORT_FAILED = 3         // the worker's exit code when the app's tool module cannot be imported
+    static final int EXIT_TOOL_IMPORT_FAILED = 3         // the worker's exit code when the app's tool module cannot be imported ...
+    static final String IMPORT_FAILED_MARKER = "cannot import tool module"      // ... and what the worker prints last on stderr then (log.IMPORT_FAILED_MARKER): code 3 alone is not proof, the Windows C runtime also ends a process with 3
     static final List<Integer> NON_PRINTABLE_TYPES = [Character.CONTROL, Character.FORMAT, Character.SURROGATE, Character.PRIVATE_USE, Character.UNASSIGNED,
                                                       Character.LINE_SEPARATOR, Character.PARAGRAPH_SEPARATOR, Character.SPACE_SEPARATOR].collect { it as int }   // Unicode categories Python's str.isprintable() rejects
     static final int RESULTS_DIR_ATTEMPTS = 20           // tries to find an unused results folder name before giving up (cli.RESULTS_DIR_ATTEMPTS)
@@ -891,7 +892,7 @@ class LcWorker {
         if (text.contains("ModuleNotFoundError") || text.contains("ImportError")) return "a Python package is missing or broken in the app's environment (see the traceback above)"
         if (code in [-9, 137]) return "the worker was killed (out of memory? the OS OOM killer ends big image jobs this way)"
         if ((code as Long) in LcConst.NATIVE_CRASH_CODES) return "the worker crashed natively (segmentation fault in a compiled library)"
-        return code == LcConst.EXIT_TOOL_IMPORT_FAILED ? "the app's tool module failed to import (see the traceback above)" : "the worker process stopped unexpectedly"
+        return (code == LcConst.EXIT_TOOL_IMPORT_FAILED && text.contains(LcConst.IMPORT_FAILED_MARKER)) ? "the app's tool module failed to import (see the traceback above)" : "the worker process stopped unexpectedly"
     }
 
     /** What to tell the person when the worker ends without answering: the likely cause (hintForExit), the exit code, then the worker's own last words. */
@@ -973,29 +974,6 @@ class LcWorker {
     }
 }
 
-// ---------------------------------------------------------------------------------------------------- whole-number box
-/** The value factory of an integer box. JavaFX's own IntegerSpinnerValueFactory stops at 2^31 - 1; this one holds any whole number between `min` and `max`
- *  (up to +-LcConst.FORM_INTEGER_LIMIT). A typed number outside the range is put at the nearest limit (a GUI holds the value inside the range); text that is not a whole number
- *  is a NumberFormatException, which LcDialog.commitSpinner reports. */
-class LcLongValueFactory extends SpinnerValueFactory<Long> {
-    final long min
-    final long max
-
-    LcLongValueFactory(long min, long max, long initial) {
-        this.min = min
-        this.max = max
-        setConverter(new javafx.util.StringConverter<Long>() {
-            String toString(Long value) { return value == null ? "" : value.toString() }
-            Long fromString(String text) { return Math.max(min, Math.min(max, Long.parseLong(text.trim()))) }
-        })
-        setValue(Math.max(min, Math.min(max, initial)))
-    }
-
-    void decrement(int steps) { setValue(Math.max(min, getValue() - steps)) }      // getValue(): inside this class `value` is the factory's private field, not the number
-
-    void increment(int steps) { setValue(Math.min(max, getValue() + steps)) }
-}
-
 // ---------------------------------------------------------------------------------------------------- the dialog (the form, the request, running, results, copy as command)
 /** The tools dialog. State (maps of controls, getters, setters) is rebuilt for every tool; the tests read some of it. */
 class LcDialog {
@@ -1481,33 +1459,53 @@ class LcDialog {
         return new HBox(12, *buttons, box)
     }
 
-    /** A spinner (optionally with a slider) of whole numbers; with no declared limits it accepts +-LcConst.FORM_INTEGER_LIMIT, and a declared bound beyond that is cut to it. */
+    /** A spinner (optionally with a slider) of whole numbers; with no declared limits it accepts +-LcConst.FORM_INTEGER_LIMIT, and a declared bound beyond that is cut to it.
+     *  The text in the box is the value (LcNumbers): a number beyond a limit or text that is not a whole number is refused (LcNumberError), never put at the nearest limit. */
     Map integerControl(Map p) {
         long lo = p.minimum != null ? Math.max((p.minimum as Number).longValue(), -LcConst.FORM_INTEGER_LIMIT) : -LcConst.FORM_INTEGER_LIMIT      // Number.longValue() saturates, so a huge bound is cut, never wrapped
         long hi = p.maximum != null ? Math.min((p.maximum as Number).longValue(), LcConst.FORM_INTEGER_LIMIT) : LcConst.FORM_INTEGER_LIMIT
         long initial = p.default != null ? (p.default as Number).longValue() : Math.max(lo, Math.min(hi, 0L))
-        def spinner = new Spinner<Long>(new LcLongValueFactory(lo, hi, initial))
+        String label = p.label as String
+        LcIntegerFactory factory = new LcIntegerFactory(label, lo, hi, initial)
+        def spinner = new Spinner<Long>(factory)
         spinner.editable = true
-        commitOnFocusLost(spinner, p.label as String)
+        followValue(spinner)
+        commitOnFocusLost(spinner, label)
         controls[p.name] = spinner
         Node node = spinner
         if (wantsSlider(p)) node = sliderBeside(spinner, lo, hi, initial) { double b -> spinner.valueFactory.value = Math.round(b) }
-        return [node: node, get: { spinner.value }, set: { spinner.valueFactory.value = (it as Number).longValue() }]
+        return [node: node, get: { LcNumbers.integer(label, spinner.editor.text, lo, hi) }, set: { setNumber(spinner, (it as Number).longValue()) }]
     }
 
-    /** A spinner (optionally with a slider); with no declared limits it accepts +-LcConst.FLOAT_LIMIT. The step is 1% of a range of 100 or less, else 1. */
+    /** A spinner (optionally with a slider) of decimal numbers; with no declared limits it accepts +-LcConst.FLOAT_LIMIT. The step is 1% of a range of 100 or less, else 1. Same rules as
+     *  integerControl: the text is the value, and a number beyond a limit is refused, never clamped. */
     Map floatControl(Map p) {
-        def lo = p.minimum != null ? p.minimum as double : -LcConst.FLOAT_LIMIT
-        def hi = p.maximum != null ? p.maximum as double : LcConst.FLOAT_LIMIT
-        def initial = p.default != null ? p.default as double : Math.max(lo, Math.min(hi, 0d))
-        def step = (hi - lo) <= 100 && p.maximum != null ? (hi - lo) / 100 : 1d
-        def spinner = new Spinner<Double>(lo, hi, initial, step)
+        Number lo = p.minimum != null ? p.minimum as Number : -LcConst.FLOAT_LIMIT
+        Number hi = p.maximum != null ? p.maximum as Number : LcConst.FLOAT_LIMIT
+        double initial = p.default != null ? p.default as double : Math.max(lo.doubleValue(), Math.min(hi.doubleValue(), 0d))
+        double step = (hi.doubleValue() - lo.doubleValue()) <= 100 && p.maximum != null ? (hi.doubleValue() - lo.doubleValue()) / 100 : 1d
+        String label = p.label as String
+        LcDoubleFactory factory = new LcDoubleFactory(label, lo, hi, initial, step)
+        def spinner = new Spinner<Double>(factory)
         spinner.editable = true
-        commitOnFocusLost(spinner, p.label as String)
+        followValue(spinner)
+        commitOnFocusLost(spinner, label)
         controls[p.name] = spinner
         Node node = spinner
-        if (wantsSlider(p)) node = sliderBeside(spinner, lo, hi, initial) { double b -> spinner.valueFactory.value = b }
-        return [node: node, get: { spinner.value }, set: { spinner.valueFactory.value = it as double }]
+        if (wantsSlider(p)) node = sliderBeside(spinner, lo.doubleValue(), hi.doubleValue(), initial) { double b -> spinner.valueFactory.value = b }
+        return [node: node, get: { LcNumbers.decimal(label, spinner.editor.text, lo, hi) }, set: { setNumber(spinner, it as double) }]
+    }
+
+    /** Puts a value into the box: the value AND its text (a value equal to the old one fires no change, and the text must not keep what was typed before). */
+    static void setNumber(Spinner spinner, Object value) {
+        spinner.valueFactory.value = value
+        spinner.editor.text = spinner.valueFactory.converter.toString(value)
+    }
+
+    /** The box shows the text of its value whenever the value changes (the spinner's skin does this too, but a box that has no skin yet must hold its text as well: the text is what a run reads). */
+    static void followValue(Spinner spinner) {
+        spinner.editor.text = spinner.valueFactory.converter.toString(spinner.valueFactory.value)
+        spinner.valueFactory.valueProperty().addListener({ o, a, b -> spinner.editor.text = spinner.valueFactory.converter.toString(b) } as javafx.beans.value.ChangeListener)
     }
 
     /** A slider is only offered when asked for, the parameter is not optional and both limits are known. */
@@ -1677,19 +1675,23 @@ class LcDialog {
         return [node: node, get: { field.text }, set: { field.text = it as String }]
     }
 
-    /** A spinner only takes typed text on Enter; this also takes it when the box loses focus. */
+    /** A spinner only takes typed text on Enter; this also takes it when the box loses focus. Enter is handled here too, so that text the box refuses is said in the status line (commitSpinner) instead of
+     *  raising the converter's error inside JavaFX's own key handler. */
     void commitOnFocusLost(Spinner spinner, String label = null) {
         spinner.focusedProperty().addListener({ o, a, focused -> if (!focused) commitSpinner(spinner, label) } as javafx.beans.value.ChangeListener)
+        spinner.editor.addEventFilter(javafx.scene.input.KeyEvent.KEY_PRESSED, { javafx.scene.input.KeyEvent e ->
+            if (e.code == javafx.scene.input.KeyCode.ENTER) { commitSpinner(spinner, label); e.consume() }
+        } as javafx.event.EventHandler)
     }
 
-    /** Takes what was typed into the box; text that is not a number keeps the old value, and the person is told. */
+    /** Takes what was typed into the box (focus lost, Enter). Text the box refuses (not a number, beyond a limit) is said at once in the status line and stays in the box, and it is refused
+     *  again when Run is pressed: the value is never changed to fit. */
     void commitSpinner(Spinner spinner, String label = null) {
         try {
             spinner.increment(0)
-        } catch (RuntimeException e) {      // JavaFX reports unparseable text as NumberFormatException or as a RuntimeException around a ParseException
-            if (!(e instanceof NumberFormatException) && !(e.cause instanceof java.text.ParseException)) throw e
-            LcLog.warn("'" + (label ?: "number") + "': '" + spinner.editor?.text + "' is not a number (kept " + spinner.value + ")", e)
-            status?.text = "Check '" + (label ?: "number") + "': '" + spinner.editor?.text + "' is not a number; " + spinner.value + " is used."
+        } catch (LcNumberError e) {
+            LcLog.warn(e.message + " (the box keeps what was typed; the run is refused until it is changed)", e)
+            status?.text = e.message
         }
     }
 
@@ -1719,7 +1721,11 @@ class LcDialog {
     void hookEnabled(Map p) {
         def cond = p.enabled_when
         if (controls[cond.param] == null || controls[p.name] == null) return
-        def update = { wrappers[p.name].disable = !ruleSatisfied(cond, getters[cond.param]()) }
+        def update = {
+            def driver = null
+            try { driver = getters[cond.param]() } catch (LcNumberError e) { LcLog.once("enabled-driver:" + cond.param, "'" + cond.param + "' holds text the box refuses (" + e.message + "): '" + p.name + "' is greyed out until it is fixed") }
+            wrappers[p.name].disable = !ruleSatisfied(cond, driver)
+        }
         onChange(cond.param as String, update)
         update()
     }
@@ -1980,7 +1986,9 @@ class LcDialog {
         def values = new LinkedHashMap()
         for (p in currentTool.inputs) {
             def v
-            try { v = getters[p.name]() } catch (Exception e) { LcLog.warn("could not read '" + p.name + "'", e); status.text = "Check '" + p.label + "': " + e.message; return null }
+            try { v = getters[p.name]() }
+            catch (LcNumberError e) { LcLog.warn("run refused: " + e.message); status.text = e.message; return null }      // a typed number the box refuses (SPEC 6.2): the sentence alone, nothing is sent
+            catch (Exception e) { LcLog.warn("could not read '" + p.name + "'", e); status.text = "Check '" + p.label + "': " + e.message; return null }
             if (p.pixel_size_of && links[p.name] != null) {      // a linked pixel size (SPEC 2.3): the state decides; the declared default is never a stand-in
                 def link = links[p.name]
                 if (link.invalid != null) { status.text = "'" + p.label + "': '" + link.invalid + "' is not a number"; return null }
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcNumbers.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcNumbers.groovy
new file mode 100644
index 0000000..898ab49
--- /dev/null
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcNumbers.groovy
@@ -0,0 +1,127 @@
+// ---------------------------------------------------------------------------------------------------- number fields (SPEC_WRONG_SCIENCE section 6)
+/** A typed number this host refuses. The message is the whole sentence the person reads in the status line; for a limit it is the worker's template (HOST_PARITY I06,
+ *  conformance messages.number_above_maximum and number_below_minimum): `'L' must be <= 9007199254740991`. Nothing is ever clamped to make it fit: the run does not start and
+ *  nothing is sent. */
+class LcNumberError extends IllegalArgumentException {
+    LcNumberError(String sentence) { super(sentence) }
+}
+
+/** What a number box accepts and how its text is read. The TEXT in the box is the value (SPEC 6.2: "a GUI box that cannot hold such a number uses a text-backed widget; it must not
+ *  silently shorten a value"): a whole number is read as an exact integer (no double ever holds it), a decimal number is compared with the limits as the exact decimal text, so a number
+ *  one unit beyond a limit is refused even where a double could not tell them apart. */
+class LcNumbers {
+    static final String ABOVE_TEMPLATE = "'{label}' must be <= {maximum}"       // conformance messages.number_above_maximum
+    static final String BELOW_TEMPLATE = "'{label}' must be >= {minimum}"       // messages.number_below_minimum
+    static final java.util.regex.Pattern INTEGER_TEXT = ~/^[+-]?[0-9]+$/
+    static final java.util.regex.Pattern FLOAT_TEXT = ~/^[+-]?([0-9]+([.][0-9]*)?|[.][0-9]+)([eE][+-]?[0-9]+)?$/
+    static final java.util.regex.Pattern NOT_FINITE_TEXT = ~/(?i)^[+-]?(nan|inf|infinity)$/
+    static final double PLAIN_BELOW = 1e16d             // Python writes a float in plain digits below this (repr(1e15) is 1000000000000000.0, repr(1e16) is 1e+16) ...
+    static final double PLAIN_ABOVE = 1e-4d             // ... and above this (repr(0.0001) is 0.0001, repr(0.00001) is 1e-05)
+
+    /** The sentence for a number beyond a limit: `'L' must be <= 9007199254740991` / `'L' must be >= -9007199254740991` (`limit` as the bound is written: a whole number plain, a decimal one the Python way). */
+    static String above(String label, Number limit) { return ABOVE_TEMPLATE.replace("{label}", label).replace("{maximum}", limitText(limit)) }
+
+    static String below(String label, Number limit) { return BELOW_TEMPLATE.replace("{label}", label).replace("{minimum}", limitText(limit)) }
+
+    /** A bound as the worker's sentence writes it: a whole number as it is, a decimal number as Python's repr writes it. */
+    static String limitText(Number limit) { return (limit instanceof Double || limit instanceof Float) ? pythonFloat(limit as double) : String.valueOf(limit) }
+
+    /** Python's `repr` of a float: `5.0`, `1000000000000000.0`, `1e+16`, `1e-05`, `0.325`. */
+    static String pythonFloat(double value) {
+        double size = Math.abs(value)
+        if (value == 0d || (size >= PLAIN_ABOVE && size < PLAIN_BELOW)) {
+            String plain = new BigDecimal(Double.toString(value)).stripTrailingZeros().toPlainString()
+            return plain.contains(".") ? plain : plain + ".0"
+        }
+        BigDecimal exact = new BigDecimal(Double.toString(value)).stripTrailingZeros()
+        int exponent = exact.precision() - exact.scale() - 1
+        String mantissa = exact.movePointLeft(exponent).stripTrailingZeros().toPlainString()
+        return mantissa + "e" + (exponent < 0 ? "-" : "+") + String.format("%02d", Math.abs(exponent))
+    }
+
+    /** The text a float box shows for a value: plain digits where that is short, else Java's scientific form (both read back exactly). */
+    static String floatText(double value) {
+        double size = Math.abs(value)
+        return (value == 0d || (size >= PLAIN_ABOVE && size < PLAIN_BELOW)) ? new BigDecimal(Double.toString(value)).stripTrailingZeros().toPlainString() : Double.toString(value)
+    }
+
+    /** The text in a whole-number box as the exact integer it says, between `min` and `max`; anything else is a refusal with its sentence. */
+    static long integer(String label, String text, long min, long max) {
+        String typed = text == null ? "" : text.trim()
+        if (typed.isEmpty()) throw new LcNumberError("'" + label + "' is required")
+        if (NOT_FINITE_TEXT.matcher(typed).matches()) throw new LcNumberError("'" + label + "' must be a finite number")
+        if (!INTEGER_TEXT.matcher(typed).matches())
+            throw new LcNumberError("'" + label + "': '" + typed + "' is " + (FLOAT_TEXT.matcher(typed).matches() ? "not a whole number" : "not a number"))
+        BigInteger value = new BigInteger(typed.startsWith("+") ? typed.substring(1) : typed)
+        if (value > BigInteger.valueOf(max)) throw new LcNumberError(above(label, max))
+        if (value < BigInteger.valueOf(min)) throw new LcNumberError(below(label, min))
+        return value.longValueExact()
+    }
+
+    /** The text in a decimal box as the double it says, between `min` and `max`; the limits are compared with the exact decimal text, never with a rounded double. */
+    static double decimal(String label, String text, Number min, Number max) {
+        String typed = text == null ? "" : text.trim()
+        if (typed.isEmpty()) throw new LcNumberError("'" + label + "' is required")
+        if (NOT_FINITE_TEXT.matcher(typed).matches()) throw new LcNumberError("'" + label + "' must be a finite number")
+        if (!FLOAT_TEXT.matcher(typed).matches()) throw new LcNumberError("'" + label + "': '" + typed + "' is not a number")
+        BigDecimal value
+        try { value = new BigDecimal(typed.startsWith("+") ? typed.substring(1) : typed) }
+        catch (NumberFormatException e) {      // an exponent too large for BigDecimal itself: beyond every limit, on the side of its sign
+            throw new LcNumberError(typed.startsWith("-") ? below(label, min) : above(label, max))
+        }
+        if (value > new BigDecimal(max.toString())) throw new LcNumberError(above(label, max))
+        if (value < new BigDecimal(min.toString())) throw new LcNumberError(below(label, min))
+        return value.doubleValue()
+    }
+}
+
+/** The value factory of a whole-number box. JavaFX's own IntegerSpinnerValueFactory stops at 2^31 - 1; this one holds any whole number between `min` and `max` (up to
+ *  +-LcConst.FORM_INTEGER_LIMIT). The converter refuses text outside the range (LcNumberError) instead of putting it at the nearest limit: a typed number is never changed to fit. The arrows
+ *  stop at the limits (they are the only thing that moves a value by itself). */
+class LcIntegerFactory extends SpinnerValueFactory<Long> {
+    final long min
+    final long max
+
+    LcIntegerFactory(String label, long min, long max, long initial) {
+        this.min = min
+        this.max = max
+        setConverter(new javafx.util.StringConverter<Long>() {
+            String toString(Long value) { return value == null ? "" : value.toString() }
+            Long fromString(String text) { return LcNumbers.integer(label, text, min, max) }
+        })
+        setValue(initial)      // a start value outside the limits (a tool's own default) stays as it is: the run refuses it with its sentence
+    }
+
+    void decrement(int steps) { if (steps != 0) setValue(Math.max(min, getValue() - steps)) }      // getValue(): inside this class `value` is the factory's private field, not the number
+
+    void increment(int steps) { if (steps != 0) setValue(Math.min(max, getValue() + steps)) }
+}
+
+/** The value factory of a decimal box: the same rules as LcIntegerFactory (the converter refuses text beyond the limits, the arrows stop at them). The limits are the declared ones or
+ *  +-LcConst.FLOAT_LIMIT; `min` and `max` are their doubles. */
+class LcDoubleFactory extends SpinnerValueFactory<Double> {
+    final double min
+    final double max
+    final double step
+
+    LcDoubleFactory(String label, Number minBound, Number maxBound, double initial, double step) {
+        this.min = minBound.doubleValue()
+        this.max = maxBound.doubleValue()
+        this.step = step
+        setConverter(new javafx.util.StringConverter<Double>() {
+            String toString(Double value) { return value == null ? "" : LcNumbers.floatText(value) }
+            Double fromString(String text) { return LcNumbers.decimal(label, text, minBound, maxBound) }
+        })
+        setValue(initial)
+    }
+
+    private void move(int steps) {
+        if (steps == 0) return
+        double moved = BigDecimal.valueOf(getValue()).add((BigDecimal.valueOf(step) * BigDecimal.valueOf(steps))).doubleValue()
+        setValue(Math.max(min, Math.min(max, moved)))
+    }
+
+    void decrement(int steps) { move(-steps) }
+
+    void increment(int steps) { move(steps) }
+}
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
index 9ccf7aa..740de51 100644
--- a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
@@ -1,4 +1,5 @@
 LabConstrictorTools.groovy
 LcCompat.groovy
+LcNumbers.groovy
 LcRetention.groovy
 LcRunIdentity.groovy
diff --git a/tests/gui_test_numbers_body.groovy b/tests/gui_test_numbers_body.groovy
new file mode 100644
index 0000000..fc55e1b
--- /dev/null
+++ b/tests/gui_test_numbers_body.groovy
@@ -0,0 +1,179 @@
+// ================================================================== GUI test body: number limits (SPEC_WRONG_SCIENCE section 6; NUM-01..05, HOST_PARITY A06, A07, I06)
+// (appended to the tool script by tests/run_gui_test.sh). Needs the `runs` test app (tests/runs_app, registered by tests/ci_setup_apps.sh in LC_SHARED_HOME; copied into the scratch LC_HOME,
+// a folder named lhome_numbers). The tool `Numbers` reports what its request carried (the text of each number and its Python type), so a case checks the REAL request, not the box.
+// The limits and the sentences are read from conformance.json (limits.form_integer_max, limits.unbounded_float, messages.number_above_maximum / number_below_minimum, number_limits.cases);
+// a number typed into a box that is beyond a limit is refused, never clamped: no run starts, nothing is sent, the text stays in the box and the status names the field and the limit.
+import javafx.embed.swing.SwingFXUtils
+import javax.imageio.ImageIO
+import java.util.concurrent.CountDownLatch
+import java.awt.image.BufferedImage
+import javafx.stage.Window
+
+def SHARED_HOME = new File(System.getenv("LC_SHARED_HOME") ?: System.getenv("LC_HOME"))
+def results = [:]
+def fx = { Closure c ->
+    if (Platform.isFxApplicationThread()) return c()
+    def latch = new CountDownLatch(1); def box = [null, null]
+    Platform.runLater { try { box[0] = c() } catch (Throwable t) { box[1] = t } finally { latch.countDown() } }
+    latch.await()
+    if (box[1] != null) throw box[1]
+    return box[0]
+}
+def expect = { String name, boolean ok, Object detail = "" ->
+    results[name] = ok
+    println((ok ? "PASS " : "FAIL ") + name + (ok ? "" : " -> " + detail))
+}
+def waitIdle = { dlg, int seconds = 300 ->
+    def end = System.currentTimeMillis() + seconds * 1000
+    while (System.currentTimeMillis() < end) { Thread.sleep(200); if (!dlg.running && fx { !dlg.runButton.disable }) return true }
+    return false
+}
+def status = { dlg -> fx { dlg.status.text } }
+def pick = { dlg, app, tool -> fx { dlg.appBox.value = app }; fx { dlg.toolBox.value = tool }; Thread.sleep(500) }
+def settle = { LcRetention.pruneThreads*.join(20000); LcRetention.pruneThreads.clear() }
+
+Thread.start("lc-gui-test") {
+    try {
+        def home = new File(System.getenv("LC_HOME")); assert home.path.contains("lhome_numbers")
+        home.deleteDir(); def apps = new File(home, "apps"); apps.mkdirs()
+        def srcApps = new File(SHARED_HOME, "apps")
+        new File(apps, "runs.schema.json").text = new File(srcApps, "runs.schema.json").text
+        new File(apps, "runs.json").text = LcJson.toJson(LcJson.parse(new File(srcApps, "runs.json")) + [schema_path: new File(apps, "runs.schema.json").path])
+        ["chmod", "644", new File(apps, "runs.json").path, new File(apps, "runs.schema.json").path].execute().waitFor()
+        def PY = (LcJson.parse(new File(apps, "runs.json")) as Map).python as String
+        def confPath = System.getenv("LC_CONFORMANCE") ?: [PY, "-m", "labconstrictor_tools.conformance", "--path"].execute().text.trim()
+        def CONF = LcJson.parse(new File(confPath))
+        def NUM = CONF.wrong_science.number_limits
+        def numCase = { String id -> def c = NUM.cases.find { it.id == id }; assert c != null : "conformance.json has no case " + id; c }
+        LcRetention.pruneCommandFor = { Map entry -> [PY, "-c", "pass"] as List<String> }      // the retention body checks prune; nothing is removed here
+        def INT_MAX = 9007199254740991L
+
+        // ---- the data this test stands on exists
+        expect("conformance_has_NUM_01_to_05", (1..5).every { numCase(String.format("NUM-%02d", it)) != null } && NUM.limits == ["form_integer_max", "unbounded_float"], NUM.limits)
+        expect("the_limits_are_the_conformance_limits", LcConst.FORM_INTEGER_LIMIT == CONF.limits.form_integer_max.value && LcConst.FORM_INTEGER_LIMIT == INT_MAX && LcConst.FLOAT_LIMIT == (CONF.limits.unbounded_float.value as double), [CONF.limits.form_integer_max, CONF.limits.unbounded_float])
+        expect("the_sentences_are_the_conformance_templates", LcNumbers.ABOVE_TEMPLATE == CONF.messages.number_above_maximum.template && LcNumbers.BELOW_TEMPLATE == CONF.messages.number_below_minimum.template, [CONF.messages.number_above_maximum, CONF.messages.number_below_minimum])
+
+        def dlg = fx { lcShow() }
+        Thread.sleep(800)
+        pick(dlg, "runs", "Numbers")
+        def spinnerOf = { String n -> fx { dlg.controls[n] } }
+        def typeIn = { String n, String text -> fx { def sp = dlg.controls[n]; sp.editor.text = text; null } }
+        def textOf = { String n -> fx { dlg.controls[n].editor.text } }
+        def runsRoot = new File(home, "runs"), resultsRoot = new File(home, "results")
+        def count = { [(runsRoot.list() ?: []).size(), (resultsRoot.list() ?: []).size()] }
+        def seen = { (LcJson.parseText((fx { dlg.lastReport } as String).split("\n\nworker output:")[0]) as Map).outputs?.results?.find { it.type == "values" }?.values }
+        def pidOf = { fx { dlg.worker?.proc?.pid() } }
+        // press Run: returns [started: a run reached the worker, status: the status line]
+        def press = {
+            def before = count(); def pidBefore = pidOf()
+            fx { dlg.run() }; Thread.sleep(1000); waitIdle(dlg, 120); settle()
+            [started: count() != before, status: status(dlg), pid: pidOf(), pidBefore: pidBefore]
+        }
+        def reset = { fx { dlg.setters["whole"](0); dlg.setters["ratio"](0d); dlg.setters["capped"](1); null } }
+        def refused = { String field, String text, String sentence, String name ->
+            reset(); typeIn(field, text)
+            def r = press()
+            expect(name + "_is_refused_with_the_sentence", r.status == sentence, [r.status, sentence])
+            expect(name + "_starts_no_run_and_sends_nothing", !r.started, r)
+            expect(name + "_leaves_the_typed_text_in_the_box", textOf(field) == text, textOf(field))
+        }
+        def accepted = { String field, String text, Closure check, String name ->
+            reset(); typeIn(field, text)
+            def r = press()
+            expect(name + "_runs", r.started && r.status.startsWith("done"), r)
+            def s = seen()
+            expect(name + "_the_request_carries_exactly_that_number", s != null && check(s), s)
+        }
+
+        // ---- NUM-01: 9007199254740991 is accepted and the request carries exactly that integer
+        accepted("whole", "9007199254740991", { s -> s.whole == "9007199254740991" && s.whole_type == "int" }, "NUM-01")
+        def rec = LcJson.parse(new File((runsRoot.listFiles() as List).max { it.name }, "run.json")) as Map
+        expect("NUM-01_the_run_record_has_the_exact_integer", rec.inputs.whole == INT_MAX && rec.inputs.whole instanceof Long, rec.inputs)
+        expect("NUM-01_copy_as_command_has_the_exact_integer", fx { dlg.copyAsCommand("terminal") }.contains("9007199254740991") && fx { dlg.copyAsCommand("python") }.contains("9007199254740991"), "")
+        // ---- NUM-02 / NUM-03: one beyond is refused, never clamped (not 9007199254740991, not 2147483647)
+        refused("whole", "9007199254740992", "'Whole' must be <= 9007199254740991", "NUM-02")
+        expect("NUM-02_the_value_was_never_clamped", fx { dlg.controls["whole"].value } != INT_MAX && fx { dlg.controls["whole"].value } != 2147483647L, fx { dlg.controls["whole"].value })
+        refused("whole", "-9007199254740992", "'Whole' must be >= -9007199254740991", "NUM-03")
+        expect("NUM-02_the_sentence_is_the_conformance_template_filled", "'Whole' must be <= 9007199254740991" == CONF.messages.number_above_maximum.template.replace("{label}", "Whole").replace("{maximum}", "9007199254740991") && numCase("NUM-02").expect.contains("must be <= 9007199254740991"), numCase("NUM-02"))
+        accepted("whole", "-9007199254740991", { s -> s.whole == "-9007199254740991" && s.whole_type == "int" }, "NUM-03_the_lower_limit_itself")
+        refused("whole", "99999999999999999999999", "'Whole' must be <= 9007199254740991", "NUM-02_a_number_beyond_a_long")
+        refused("whole", "-99999999999999999999999", "'Whole' must be >= -9007199254740991", "NUM-03_a_number_beyond_a_long")
+        // ---- NUM-04: a decimal box: 1e15 accepted, 1.0000000000000002e15 refused (also when a double could not tell them apart)
+        accepted("ratio", "1e15", { s -> s.ratio == "1000000000000000.0" && s.ratio_type == "float" }, "NUM-04_1e15")
+        refused("ratio", "1.0000000000000002e15", "'Ratio' must be <= 1000000000000000.0", "NUM-04_1_0000000000000002e15")
+        refused("ratio", "1.00000000000000001e15", "'Ratio' must be <= 1000000000000000.0", "NUM-04_a_text_a_double_rounds_to_1e15")
+        refused("ratio", "1e400", "'Ratio' must be <= 1000000000000000.0", "NUM-04_1e400")
+        refused("ratio", "1e99999999999", "'Ratio' must be <= 1000000000000000.0", "NUM-04_an_exponent_beyond_BigDecimal")
+        accepted("ratio", "-1e15", { s -> s.ratio == "-1000000000000000.0" }, "NUM-04_minus_1e15")
+        refused("ratio", "-1.0000000000000002e15", "'Ratio' must be >= -1000000000000000.0", "NUM-04_minus_1_0000000000000002e15")
+        accepted("ratio", "0.1", { s -> s.ratio == "0.1" && s.ratio_type == "float" }, "NUM-04_0_1_is_not_rounded")
+        accepted("ratio", "123456789012345.67", { s -> s.ratio == "123456789012345.67" }, "NUM-04_a_long_decimal")
+        // ---- NUM-05: a declared Max of 10 refuses 11 (it used to be put at 10 and sent)
+        accepted("capped", "10", { s -> s.capped == "10" }, "NUM-05_the_declared_maximum_itself")
+        refused("capped", "11", "'Capped' must be <= 10", "NUM-05_11")
+        expect("NUM-05_the_conformance_case_says_refuse", numCase("NUM-05").expect.contains("refused"), numCase("NUM-05"))
+        accepted("capped", "-5", { s -> s.capped == "-5" }, "NUM-05_below_zero_has_no_declared_minimum")
+
+        // ---- the text rules: what is a number
+        accepted("whole", "+5", { s -> s.whole == "5" }, "text_plus_five")
+        accepted("whole", "007", { s -> s.whole == "7" }, "text_leading_zeros")
+        accepted("whole", " 12 ", { s -> s.whole == "12" }, "text_surrounding_spaces_are_not_part_of_the_number")
+        refused("whole", "5.0", "'Whole': '5.0' is not a whole number", "text_a_decimal_in_a_whole_number_box")
+        refused("whole", "1e3", "'Whole': '1e3' is not a whole number", "text_an_exponent_in_a_whole_number_box")
+        refused("whole", "12x", "'Whole': '12x' is not a number", "text_not_a_number")
+        refused("whole", "1,5", "'Whole': '1,5' is not a number", "text_a_decimal_comma")
+        refused("whole", "1_000", "'Whole': '1_000' is not a number", "text_an_underscore")
+        refused("whole", "", "'Whole' is required", "text_empty")
+        refused("ratio", "nan", "'Ratio' must be a finite number", "text_nan")
+        refused("ratio", "-Infinity", "'Ratio' must be a finite number", "text_infinity")
+        refused("whole", "NaN", "'Whole' must be a finite number", "text_nan_in_a_whole_number_box")
+
+        // ---- an optional number: unticked sends nothing; ticked is read like any other box
+        reset(); fx { dlg.checks["maybe"].selected = false; null }
+        def r0 = press()
+        expect("optional_unticked_sends_none", r0.started && seen()?.maybe == null, seen())
+        fx { dlg.checks["maybe"].selected = true; null }
+        typeIn("maybe", "9007199254740992")
+        def r1 = press()
+        expect("optional_ticked_beyond_the_limit_is_refused", !r1.started && r1.status == "'Maybe' must be <= 9007199254740991", r1)
+        typeIn("maybe", "5")
+        def r2 = press()
+        expect("optional_ticked_with_a_number_is_sent", r2.started && seen()?.maybe == "5", [r2, seen()])
+        fx { dlg.checks["maybe"].selected = false; null }
+
+        // ---- the box itself: focus lost and Enter say it at once, the arrows stop at the limits and never move text that was typed
+        reset(); typeIn("whole", "9007199254740993")
+        fx { dlg.commitSpinner(dlg.controls["whole"], "Whole"); null }
+        expect("focus_lost_says_the_sentence_at_once_and_keeps_the_text", status(dlg) == "'Whole' must be <= 9007199254740991" && textOf("whole") == "9007199254740993" && fx { dlg.controls["whole"].value } == 0L, [status(dlg), textOf("whole")])
+        fx { dlg.status.text = "idle"; null }
+        fx {
+            def editor = dlg.controls["whole"].editor
+            javafx.event.Event.fireEvent(editor, new javafx.scene.input.KeyEvent(javafx.scene.input.KeyEvent.KEY_PRESSED, "", "", javafx.scene.input.KeyCode.ENTER, false, false, false, false))
+            null
+        }
+        expect("enter_says_the_sentence_too", status(dlg) == "'Whole' must be <= 9007199254740991" && textOf("whole") == "9007199254740993", status(dlg))
+        fx { dlg.setters["whole"](INT_MAX); dlg.controls["whole"].increment(1); null }
+        expect("the_arrow_never_passes_the_upper_limit", fx { dlg.getters["whole"]() } == INT_MAX && textOf("whole") == "9007199254740991", textOf("whole"))
+        fx { dlg.setters["whole"](-INT_MAX); dlg.controls["whole"].decrement(5); null }
+        expect("the_arrow_never_passes_the_lower_limit", fx { dlg.getters["whole"]() } == -INT_MAX, textOf("whole"))
+        fx { dlg.setters["capped"](10); dlg.controls["capped"].increment(1); null }
+        expect("the_arrow_stops_at_a_declared_maximum", fx { dlg.getters["capped"]() } == 10L, textOf("capped"))
+        fx { dlg.setters["ratio"](1e15d); dlg.controls["ratio"].increment(1); null }
+        expect("a_decimal_arrow_stops_at_the_limit", fx { dlg.getters["ratio"]() } == 1e15d, textOf("ratio"))
+        fx { dlg.setters["ratio"](0.1d); dlg.controls["ratio"].increment(1); null }
+        expect("a_decimal_arrow_adds_without_float_noise", textOf("ratio") == "1.1", textOf("ratio"))
+        reset()
+
+        // ---- the helper functions themselves
+        expect("unit_python_float_text", [[5d, "5.0"], [1e15d, "1000000000000000.0"], [1e16d, "1e+16"], [0.325d, "0.325"], [1e-5d, "1e-05"], [1.5e20d, "1.5e+20"], [0.0001d, "0.0001"], [-1e15d, "-1000000000000000.0"], [0d, "0.0"]].every { LcNumbers.pythonFloat(it[0] as double) == it[1] },
+                [5d, 1e15d, 1e16d, 1e-5d, 1.5e20d].collect { LcNumbers.pythonFloat(it) })
+        expect("unit_float_text_reads_back_exactly", [0.1d, 1e15d, 123456789012345.67d, 1e-7d, 5e-324d, 0.30000000000000004d].every { (LcNumbers.floatText(it) as double) == it }, "")
+        def sentences = []
+        for (def probe : [["9007199254740992", 0L], ["-9007199254740992", 0L]]) { try { LcNumbers.integer("L", probe[0], -INT_MAX, INT_MAX) } catch (LcNumberError e) { sentences << e.message } }
+        expect("unit_integer_refusals", sentences == ["'L' must be <= 9007199254740991", "'L' must be >= -9007199254740991"] && LcNumbers.integer("L", "9007199254740991", -INT_MAX, INT_MAX) == INT_MAX, sentences)
+        expect("unit_a_declared_decimal_bound_is_written_the_python_way", { try { LcNumbers.decimal("L", "2", 0.5d, 1.5d); "" } catch (LcNumberError e) { e.message } }.call() == "'L' must be <= 1.5" && { try { LcNumbers.decimal("L", "0", 0.5d, 1.5d); "" } catch (LcNumberError e) { e.message } }.call() == "'L' must be >= 0.5" &&
+                { try { LcNumbers.decimal("L", "5", 1, 3); "" } catch (LcNumberError e) { e.message } }.call() == "'L' must be <= 3", "")
+
+    } catch (Throwable t) { t.printStackTrace(); results["EXCEPTION"] = false }
+    finally { println "RESULTS " + results; Thread.sleep(500); System.exit(results && results.every { it.value } ? 0 : 1) }
+}
diff --git a/tests/gui_test_parity_form_body.groovy b/tests/gui_test_parity_form_body.groovy
index 6994982..587dfcd 100644
--- a/tests/gui_test_parity_form_body.groovy
+++ b/tests/gui_test_parity_form_body.groovy
@@ -165,16 +165,19 @@ Thread.start("lc-gui-test") {
         expect("an_integer_above_a_billion_is_accepted", fx { dlg.getters["free_int"]() } == 2000000000, fx { dlg.getters["free_int"]() })
         fx { dlg.setters["free_int"](LIMIT) }
         expect("the_largest_integer_is_held_exactly_and_sent_as_it_is", fx { dlg.getters["free_int"]() } == LIMIT && LcJson.toJson([free_int: fx { dlg.getters["free_int"]() }]) == '{"free_int":9007199254740991}', fx { dlg.getters["free_int"]() })
+        // a typed integer beyond the limit is REFUSED, never put at the limit (SPEC 6.2; it used to stop at 2^53 - 1): the status says it, the run reads the text and refuses it
+        def typedRefusal = { String n -> try { fx { dlg.getters[n]() }; null } catch (LcNumberError e) { e.message } }
         fx { spin("free_int").editor.text = "9007199254740993"; dlg.commitSpinner(spin("free_int"), "Free int") }
-        expect("a_typed_integer_beyond_the_limit_stops_at_it", fx { dlg.getters["free_int"]() } == LIMIT, fx { dlg.getters["free_int"]() })
-        fx { spin("free_int").editor.text = "9007199254740993"; spin("free_int").commitValue() }      // Enter in the box commits without the arrow code
-        expect("a_typed_integer_beyond_the_limit_stops_at_it_on_enter", fx { dlg.getters["free_int"]() } == LIMIT, fx { dlg.getters["free_int"]() })
+        expect("a_typed_integer_beyond_the_limit_is_refused_not_clamped", typedRefusal("free_int") == "'Free int' must be <= 9007199254740991" && status(dlg) == "'Free int' must be <= 9007199254740991" && spin("free_int").editor.text == "9007199254740993", [typedRefusal("free_int"), status(dlg)])
+        fx { dlg.status.text = "idle"; spin("free_int").editor.text = "9007199254740993"; javafx.event.Event.fireEvent(spin("free_int").editor, new javafx.scene.input.KeyEvent(javafx.scene.input.KeyEvent.KEY_PRESSED, "", "", javafx.scene.input.KeyCode.ENTER, false, false, false, false)) }      // Enter in the box: its own handler says it in the status
+        expect("a_typed_integer_beyond_the_limit_is_refused_on_enter_too", typedRefusal("free_int") == "'Free int' must be <= 9007199254740991" && status(dlg) == "'Free int' must be <= 9007199254740991", [typedRefusal("free_int"), status(dlg)])
+        fx { dlg.setters["free_int"](LIMIT) }
         fx { spin("free_int").increment(1) }
         expect("the_arrow_never_passes_the_limit", fx { dlg.getters["free_int"]() } == LIMIT, fx { dlg.getters["free_int"]() })
         fx { spin("free_int").editor.text = "-9007199254740991"; dlg.commitSpinner(spin("free_int"), "Free int"); spin("free_int").decrement(3) }
         expect("the_arrow_never_passes_the_lower_limit", fx { dlg.getters["free_int"]() } == -LIMIT, fx { dlg.getters["free_int"]() })
         fx { spin("free_int").editor.text = "12x"; dlg.commitSpinner(spin("free_int"), "Free int") }
-        expect("a_typed_non_integer_is_said_and_the_value_kept", status(dlg).contains("not a number") && fx { dlg.getters["free_int"]() } == -LIMIT, status(dlg))
+        expect("a_typed_non_integer_is_said_and_refused_and_the_value_kept", status(dlg).contains("not a number") && fx { spin("free_int").value } == -LIMIT && typedRefusal("free_int") == "'Free int': '12x' is not a number", status(dlg))
         fx { dlg.setters["free_int"](2000000000) }
         fx { dlg.setters["free_float"](5e14d) }
         expect("a_float_above_1e12_is_accepted", fx { dlg.getters["free_float"]() } == 5e14d, fx { dlg.getters["free_float"]() })
diff --git a/tests/gui_test_parity_host_body.groovy b/tests/gui_test_parity_host_body.groovy
index f1f11fa..fa1c5bd 100644
--- a/tests/gui_test_parity_host_body.groovy
+++ b/tests/gui_test_parity_host_body.groovy
@@ -183,7 +183,13 @@ Thread.start("lc-gui-test") {
         expect("hint_killed", [-9, 137].every { LcWorker.hintForExit(it, "") == "the worker was killed (out of memory? the OS OOM killer ends big image jobs this way)" })
         expect("hint_native_crash_in_all_four_forms", [-11, 139, -1073741819].every { LcWorker.hintForExit(it, "") == "the worker crashed natively (segmentation fault in a compiled library)" } && LcWorker.hintForExit(null, "") != null)
         expect("hint_unsigned_windows_access_violation", (3221225477L as Long) in LcConst.NATIVE_CRASH_CODES)
-        expect("hint_tool_import_failed", LcWorker.hintForExit(3, "") == "the app's tool module failed to import (see the traceback above)")
+        // exit code 3 is an import failure only with the marker the worker prints last (Tools PR #124; the Windows C runtime also ends a process with 3 for abort() and a raised SIGSEGV)
+        def IMPORT = "the app's tool module failed to import (see the traceback above)"
+        expect("hint_tool_import_failed_needs_the_marker", LcWorker.hintForExit(3, "LabConstrictor worker: cannot import tool module 'x' (details above)") == IMPORT && LcWorker.hintForExit(3, "") != IMPORT && LcWorker.hintForExit(3, "boom") == "the worker process stopped unexpectedly")
+        expect("hint_code_3_without_the_marker_is_the_plain_sentence", LcWorker.hintForExit(3, "") == "the worker process stopped unexpectedly" && LcWorker.hintForExit(3, null) == "the worker process stopped unexpectedly" && LcWorker.hintForExit(3, "abort() has been called") == "the worker process stopped unexpectedly")
+        expect("hint_the_marker_with_another_code_is_not_an_import_failure", LcWorker.hintForExit(1, "cannot import tool module 'x'") == "the worker process stopped unexpectedly" && LcWorker.hintForExit(null, "cannot import tool module 'x'") == "the worker process stopped unexpectedly")
+        expect("hint_a_missing_package_still_wins_over_code_3_and_the_marker", LcWorker.hintForExit(3, "ModuleNotFoundError: No module named 'x'\ncannot import tool module 'x'").startsWith("a Python package is missing"))
+        expect("hint_the_marker_is_the_tools_marker", LcConst.IMPORT_FAILED_MARKER == "cannot import tool module" && LcConst.EXIT_TOOL_IMPORT_FAILED == 3)
         expect("hint_unknown_cause_is_a_plain_sentence", LcWorker.hintForExit(1, "boom") == "the worker process stopped unexpectedly")
         def fake = { String name, String stderr, int code ->
             def f = new File(WP + "/" + name); f.text = "#!/bin/sh\necho \"" + stderr + "\" >&2\nexit " + code + "\n"; f.setExecutable(true); f
@@ -193,8 +199,10 @@ Thread.start("lc-gui-test") {
         expect("live_crash_missing_package", c1.startsWith("a Python package is missing or broken in the app's environment (see the traceback above) (exit code 1). ") && c1.contains("No module named 'foo'"), c1)
         def c2 = crashOf(fake("fake_killed.sh", "", 137))
         expect("live_crash_killed", c2 == "the worker was killed (out of memory? the OS OOM killer ends big image jobs this way) (exit code 137)", c2)
-        def c3 = crashOf(fake("fake_import.sh", "tool module broke", 3))
-        expect("live_crash_import_failed_with_the_last_words", c3.startsWith("the app's tool module failed to import (see the traceback above) (exit code 3). tool module broke"), c3)
+        def c3 = crashOf(fake("fake_import.sh", "LabConstrictor worker: cannot import tool module broke (details above)", 3))
+        expect("live_crash_import_failed_with_the_last_words", c3.startsWith("the app's tool module failed to import (see the traceback above) (exit code 3). LabConstrictor worker: cannot import tool module broke"), c3)
+        def c3plain = crashOf(fake("fake_abort.sh", "abort() has been called", 3))
+        expect("live_crash_code_3_without_the_marker_is_not_called_an_import_failure", c3plain == "the worker process stopped unexpectedly (exit code 3). abort() has been called", c3plain)
 
     } catch (Throwable t) { t.printStackTrace(); results["EXCEPTION"] = false }
     finally { println "RESULTS " + results; Thread.sleep(500); System.exit(results && results.every { it.value } ? 0 : 1) }
diff --git a/tests/run_gui_ci.sh b/tests/run_gui_ci.sh
index 0e47ed8..0d7f2f9 100755
--- a/tests/run_gui_ci.sh
+++ b/tests/run_gui_ci.sh
@@ -19,6 +19,7 @@ declare -A needs=(
   [gui_test_frame_body.groovy]="frame"
   [gui_test_calibration_body.groovy]="frame"
   [gui_test_retention_body.groovy]="runs"
+  [gui_test_numbers_body.groovy]="runs"
   [gui_test_identity_body.groovy]="runs frame"
 )
 for b in area buttons channel copy fallbacks interactions region shapes widgets; do needs[gui_test_${b}_body.groovy]="interactions"; done
@@ -27,7 +28,8 @@ needs[gui_test_parity_cancel_body.groovy]="LabConstrictorPlayground interactions
 # bodies that write their own registry and results (they empty LC_HOME first, so each gets a scratch LC_HOME named as the body asserts; the registered apps stay in LC_SHARED_HOME)
 declare -A scratch=([gui_test_parity_trust_body.groovy]=lhome_trust [gui_test_parity_form_body.groovy]=lhome_form [gui_test_parity_host_body.groovy]=lhome_host
   [gui_test_parity_lifecycle_body.groovy]=lhome_life [gui_test_parity_pixel_body.groovy]=lhome_pixel [gui_test_parity_support_body.groovy]=lhome_support
-  [gui_test_retention_body.groovy]=lhome_retention [gui_test_identity_body.groovy]=lhome_identity)
+  [gui_test_retention_body.groovy]=lhome_retention [gui_test_identity_body.groovy]=lhome_identity
+  [gui_test_numbers_body.groovy]=lhome_numbers)
 SHARED_HOME="$LC_HOME"; export LC_SHARED_HOME="$SHARED_HOME"
 # bodies that are skipped (not failed) while their apps are not registered: the bridge of these two apps is not on their main branch yet
 optional="gui_test_body.groovy"