diff --git a/README.md b/README.md
index 082fd0c..04fbe8c 100644
--- a/README.md
+++ b/README.md
@@ -31,12 +31,12 @@ Needs **labconstrictor-tools 0.3.0a1 or newer** in the app's environment (the ru
 ## What it does
 * Pick an app and a tool. Numbers (range, unit), choices, checkboxes, text, files and folders become fields; parameters of a group sit under a heading, advanced ones in a collapsed section, optional ones without a default have a "set" box (unticked = the tool gets nothing), and `enabled_when` greys fields out.
 * **Image inputs**: the image open in QuPath, any image of the open project, or a file. QuPath's image is exported losslessly as TIFF (the whole image, or the part chosen under **Image area**, see below). The pixel size of the chosen image or typed file fills the tool's pixel-size field (see **Pixel size** below).
-* Results open in a window: values, tables (as a table: the first 100 000 rows, then "table 'name' (N rows, first M shown; the full table is in P)", the Napari wording; cells with commas, quotes and line breaks are read as CSV says), images (a preview, the path and an "Open in QuPath" button), alignment matrices, files, messages (also shown under the status line) and points.
+* Results open in a window: values, tables (as a table: the first 100 000 rows, then "table 'name' (N rows, first M shown; the full table is in P)", the Napari wording; cells with commas, quotes and line breaks are read as CSV says, by one reader (`LcCsv`) for tables and points: a record is one row or one point however many lines it spans, and a malformed file, a points file without `y` and `x` columns or with a coordinate that is not a finite number is said in one sentence naming the record, never shown or placed partly), images (a preview, the path and an "Open in QuPath" button), alignment matrices, files, messages (also shown under the status line) and points.
 * **Interaction hints** of the manifest: a `choices_from` parameter is a dropdown filled by another tool of the app (a text field when that tool cannot answer), `clear_after_run` parameters are reset after a successful run, a `Collapsed` group is a folded section, and an output with `Replace()` reuses the results window of the tool instead of opening a new one.
 * **Channel selector**: an image input declared with `PickChannel()` gets a Channel chooser (the channel names of the chosen image, or of a file); the tool receives only that channel.
 * **Points** found in the image that is open in QuPath become a point annotation named `<app>:<output>` (replaced by the next run when the output declares `Replace()`); points of any other image are shown as a table.
 * "No match" is a message, not an error. Progress bar, Cancel (a tool that ignores it is killed after 3 s), worker kept between runs (or not), details of the last run, no worker left behind when the window closes.
-* **Trust checks** on every registry entry (same rules as the Python registry and the Fiji script): the entry names its five text fields; the app name is a plain name; the interpreter lies inside the install prefix (which is not a filesystem root); the entry and its schema file are owned by you (in a shared folder also by root) and not writable by group or others; the schema sits next to the entry; the interpreter, its folder and the prefix are not writable by everybody (a sticky folder like `/tmp` excepted); tool ids and parameter names are plain names, parameter names Python identifiers (a parameter name becomes a file name). An entry that fails is listed under "skipped" with its reason and never started. On Windows the owner and permission checks do not apply.
+* **Trust checks** on every registry entry (same rules as the Python registry and the Fiji script): the entry names its five text fields; the app name is a plain name; the interpreter lies inside the install prefix (which is not a filesystem root); the entry and its schema file are owned by you (in a shared folder also by root) and not writable by group or others; the schema sits next to the entry; the interpreter, its folder and the prefix are not writable by everybody (a sticky folder like `/tmp` excepted); tool ids and parameter names are plain names, parameter names Python identifiers (a parameter name becomes a file name); a `choice` parameter lists its choices and every declared output has a plain name and a text type (the cached schema is checked as far as this host reads it, the Fiji script's rules plus the output shape). An entry that fails is listed under "skipped" with its reason and never started. On Windows the owner and permission checks do not apply.
 * **Results and run records, and their clean-up** (SPEC_WRONG_SCIENCE section 3). Each run makes a results folder `~/.labconstrictor/results/<time>_<6 hex>_<app>_<tool>` (names made safe, like the command line) and a run record folder `~/.labconstrictor/runs/<time>_<app>_<tool>`. **This host never deletes anything there.** It writes the two marker files of the spec: `.lc-owner.json` first, when the folder is made (a QuPath that dies mid-run leaves an owned, unfinished folder that nobody removes), and `.lc-done.json` last, atomically, when the run ends: `ok` (completed), `cancelled` (the tool honoured Cancel, or the worker had to be killed after Cancel was pressed, or the window was closed during the run), `failed` (the tool failed, or the worker died with no Cancel pressed). The status comes from the Tools helper `labconstrictor_tools.runs.done_status`. Then it starts `labconstrictor-tools prune` (`<the app's Python> -m labconstrictor_tools prune`) in a subprocess and does not wait for it: the newest 20 finished results and the newest 50 run records are kept, and Tools removes the older ones, **only** folders that carry a valid owner marker and a done marker. Folders from older versions (no marker), foreign folders, folders of runs that are still going or that crashed with QuPath (no done marker), links and files are never removed and do not use up the quota. A prune that cannot start, or that fails, is written to the log (`prune could not be started ...` / `prune ended with exit code N`) and never fails or delays the run; the folders then stay until a `prune` works. The older folders written by earlier versions of this script have no marker, so they are never cleaned up automatically (Tools has a follow-up item for an explicit `clean --legacy`).
 * **Run record** `runs/<...>/run.json`: built by the Tools helper `labconstrictor_tools.runs.build_record` and written with `record_json` (this script keeps no copy of the layout), plus `"host": "qupath"`, the `run_id` and `started_utc` of the run, and the `_calibration` input. A crash after Cancel keeps its crash text there (status `CRASHED`). If the record cannot be built (the app's Python cannot start, the helper fails) the status line says `(the run record could not be written (...); its folders stay as they are and are never removed)`. Every log line is also appended to the shared `~/.labconstrictor/logs/labconstrictor.log` (Tools line format, `qupath:` prefix, 1 MB rotation with 5 backups), so `labconstrictor-tools logs` and `support-bundle` see QuPath runs.
 * **Same rules as the other hosts** (the host-parity inventory of labconstrictor-tools): a form shows parameters in the Napari/Fiji order (a group gathered where it first appears; a Collapsed group is folded where it first appears; advanced last); `clear_after_run` resets every type of field; `enabled_when` follows text, number, choice, yes/no and "set" drivers (`""` counts as unset, numbers compare as numbers); a whole-number box holds ±(2^53 - 1) at most, declared limits or not (the largest whole number a double holds exactly, Tools `notebook.MAX_FORM_INTEGER`), a decimal box without declared limits ±1e15, and **a typed number beyond a limit is refused, never put at the limit** (see **Number limits** below); a choice of integers is sent as an integer; a missing input says `'L' is required`; NaN is refused with `'L' must be a finite number`; a folder input must be a folder; a worker that is idle for 10 minutes is closed; a worker ended after Cancel reads `cancelled (worker stopped)`; a worker that died is explained with the Tools sentences (a missing package first, then the exit code; exit code 3 is called an import failure only when the worker's last words contain `cannot import tool module`, Tools PR #124: the Windows C runtime also ends a process with 3 for `abort()` and a raised SIGSEGV); a tool with a parameter type this host does not know is refused alone (`this tool cannot be shown: ...`); two tools with one label are listed as `label (id)` and the apps are sorted by name; `Copy as command` writes Python text the way `repr` does (a newline cannot break the snippet) and says `there is no clipboard to copy to` when there is none; message results show `- ` items as bullets; a result file that is missing, or a result type this version does not know, is said in one sentence.
@@ -159,7 +159,7 @@ The `gui_test_parity_*` bodies need the registered `interactions` app (its Pytho
 
 `BODY=gui_test_parity_messages_body.groovy tests/run_gui_test.sh` opens a 3-plane TIFF (written with tifffile from `/home/tester/v-napari`) and checks that a refusal is the sentence alone, that a z-stack is refused for a `YX` tool with the Tools sentence and the way out, that a series, z, t and channel counts are named, and when nothing is refused (18 checks).
 
-`BODY=gui_test_parity_results_body.groovy tests/run_gui_test.sh` builds result tables of 150 000, 100 000, 2 001 and a few rows, with quoted commas, doubled quotes and multi-line cells, and checks the rows shown and the sentence (12 checks).
+`BODY=gui_test_parity_results_body.groovy tests/run_gui_test.sh` builds result tables of 150 000, 100 000, 2 001 and a few rows, with quoted commas, doubled quotes and multi-line cells, and checks the rows shown and the sentence, then the CSV reader on points files and malformed files (issue 17) (12 + 14 checks).
 
 `BODY=gui_test_calibration_body.groovy tests/run_gui_test.sh` runs CAL-01..CAL-20 and CAL-T1..CAL-T9 of `conformance.json` through the form (a file input, project images and the image open in QuPath, one real worker run each for a required and an optional field) and checks the request and the `_calibration` input, not only the field; the images are written by `tests/calibration_fixtures.py` (tifffile) with the Python of the registered `frame` app.
 
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
index 6ea0dca..369cf37 100644
--- a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LabConstrictorTools.groovy
@@ -792,6 +792,11 @@ class LcRegistry {
             for (p in tool.inputs) {
                 if (!(p instanceof Map) || !identifier(p.name) || !(p.label instanceof String))
                     return "tool '" + tool.id + "' has a parameter without an identifier name and a text label"
+                if (p.type == "choice" && !(p.choices instanceof List && p.choices)) return "tool '" + tool.id + "': choice parameter '" + p.name + "' has no choices"      // as the Fiji script
+            }
+            for (o in tool.outputs) {      // the results window reads `name`, `type` and `replace` of each declared output
+                if (!(o instanceof Map) || !plainName(o.name) || !(o.type instanceof String))
+                    return "tool '" + tool.id + "' has an output without a plain name and a text type"
             }
         }
         return null
@@ -2515,7 +2520,13 @@ class LcDialog {
                 messageLabel.visible = true; messageLabel.managed = true
                 break
             case "points":
-                box.children.addAll(boldLabel((r.name ?: "points") + " (points)"), new Label(placePoints(appName, r)), tableView(r.path as String, (r.name ?: "points") as String))
+                String placed
+                try { placed = placePoints(appName, r) }
+                catch (LcCsvError problem) {
+                    LcLog.warn("points '" + r.name + "' not placed", problem)
+                    placed = "Not placed on an image: " + problem.message
+                }
+                box.children.addAll(boldLabel((r.name ?: "points") + " (points)"), wrapped(placed), tableView(r.path as String, (r.name ?: "points") as String))
                 break
             case "shapes":
                 box.children.addAll(boldLabel((r.name ?: "shapes") + " (outlines)"), wrapped(placeShapes(appName, r)))
@@ -2663,16 +2674,10 @@ class LcDialog {
             LcLog.once("points-not-placed:" + appName + ":" + r.name, "points '" + r.name + "' not placed: they were not found in the image open in QuPath (table only)")
             return notPlacedSentence(r, "points")
         }
-        def lines = new File(r.path as String).readLines("UTF-8")
-        def header = splitCsv(lines[0])
-        def yi = header.indexOf("y"), xi = header.indexOf("x")
         def area = areaFor(r)
-        def ys = [], xs = []
-        lines.drop(1).each { line ->          // pixel centres, moved by the Image area's offset
-            def cells = splitCsv(line)
-            ys << LcArea.slideY(area, (cells[yi] as double) + 0.5d)
-            xs << LcArea.slideX(area, (cells[xi] as double) + 0.5d)
-        }
+        Map found = LcCsv.points(r.path as String)          // an LcCsvError (malformed file, missing column, bad coordinate) places nothing; addResult says why
+        def ys = found.ys.collect { LcArea.slideY(area, (it as double) + 0.5d) }      // pixel centres, moved by the Image area's offset
+        def xs = found.xs.collect { LcArea.slideX(area, (it as double) + 0.5d) }
         def name = appName + ":" + r.name
         def hierarchy = data.hierarchy
         def previous = hierarchy.annotationObjects.findAll { it.name == name }
@@ -2777,8 +2782,13 @@ class LcDialog {
 
     /** The first LcConst.TABLE_ROWS_SHOWN rows of a CSV file as a table; under it "table 'name' (N rows, first M shown)" (the Napari sentence) and the path. */
     static Node tableView(String csvPath, String name) {
-        def csv = readCsv(csvPath, LcConst.TABLE_ROWS_SHOWN + 1)      // the header and the rows that are shown
-        def rows = csv.rows
+        Map csv
+        try { csv = LcCsv.read(csvPath, LcConst.TABLE_ROWS_SHOWN + 1) }      // the header and the rows that are shown
+        catch (LcCsvError problem) {
+            LcLog.warn("table '" + name + "' cannot be shown", problem)
+            return wrapped("table '" + name + "' cannot be shown: " + problem.message)      // the sentence names the record; the file is left as it is
+        }
+        List<List<String>> rows = csv.rows as List<List<String>>
         if (rows.isEmpty()) return new Label("(empty table)")
         def table = new TableView<List<String>>()
         rows[0].eachWithIndex { String h, int i ->
@@ -2789,54 +2799,8 @@ class LcDialog {
         rows.drop(1).each { table.items.add(it) }
         table.prefHeight = LcConst.TABLE_HEIGHT
         int shown = rows.size() - 1
-        def counted = shown + csv.hidden
-        return new VBox(4, table, new Label("table '" + name + "' (" + (csv.hidden ? counted + " rows, first " + shown + " shown; the full table is in " + csvPath : counted + " rows") + ")  " + csvPath))
-    }
-
-    /** A CSV file as records: [rows: the first `keep` records (cells as text), hidden: how many more there are]. A quoted cell may hold commas, doubled quotes and line breaks. */
-    static Map readCsv(String csvPath, int keep) {
-        def rows = [], row = [], cell = new StringBuilder()
-        int hidden = 0
-        boolean quoted = false, any = false
-        def endRecord = {
-            row << cell.toString(); cell.setLength(0)
-            if (rows.size() < keep) rows << row else hidden++
-            row = []; any = false
-        }
-        new File(csvPath).withReader("UTF-8") { reader ->
-            int previous = -1
-            int c = reader.read()
-            for (; c != -1; c = reader.read()) {
-                any = true
-                if (quoted) {
-                    if (c == 34) { quoted = false } else cell.append((char) c)
-                } else if (c == 34 && previous == 34) {         // a doubled quote inside a quoted cell: one quote
-                    cell.append('"'); quoted = true
-                } else if (c == 34) { quoted = true }
-                else if (c == 44) { row << cell.toString(); cell.setLength(0) }
-                else if (c == 10) { endRecord() }
-                else if (c != 13) cell.append((char) c)
-                previous = c
-            }
-        }
-        if (any) endRecord()
-        return [rows: rows, hidden: hidden]
-    }
-
-    /** One CSV line into cells: commas separate, double quotes group, a doubled quote is one quote (no multi-line cells). */
-    static List<String> splitCsv(String line) {
-        def out = [], cur = new StringBuilder()
-        boolean quoted = false
-        for (int i = 0; i < line.length(); i++) {
-            char c = line.charAt(i)
-            if (quoted) {
-                if (c == ('"' as char)) { if (i + 1 < line.length() && line.charAt(i + 1) == ('"' as char)) { cur.append('"'); i++ } else quoted = false } else cur.append(c)
-            } else if (c == ('"' as char)) quoted = true
-            else if (c == (',' as char)) { out << cur.toString(); cur.setLength(0) }
-            else cur.append(c)
-        }
-        out << cur.toString()
-        return out
+        long counted = (csv.count as long) - 1        // the records of the file without the header
+        return new VBox(4, table, new Label("table '" + name + "' (" + (counted > shown ? counted + " rows, first " + shown + " shown; the full table is in " + csvPath : counted + " rows") + ")  " + csvPath))
     }
 }
 
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcCsv.groovy b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcCsv.groovy
new file mode 100644
index 0000000..cb221c1
--- /dev/null
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/LcCsv.groovy
@@ -0,0 +1,85 @@
+// ---------------------------------------------------------------------------------------------------- CSV (RFC 4180) for result tables and points (issue #17)
+/** A CSV file this host cannot read. The message is the whole sentence the person reads (it names the record and the line); nothing is guessed to make a bad file fit. */
+class LcCsvError extends IllegalArgumentException {
+    LcCsvError(String sentence) { super(sentence) }
+}
+
+/** The CSV reader of the results: one record is one table row or one point, however many lines it spans. The Toolkit writes UTF-8 CSV (docs/PROTOCOL.md): a quoted cell holds commas,
+ *  doubled quotes ("" is one quote) and line breaks; CRLF and LF both end a record; the last record needs no line break; a leading byte order mark is dropped. A quote that is not
+ *  opened at the start of a cell, a cell with text after its closing quote, or a quote that is never closed is an LcCsvError, not a guess. */
+class LcCsv {
+    static final int QUOTE = 34, COMMA = 44, LINE_FEED = 10, CARRIAGE_RETURN = 13, BYTE_ORDER_MARK = 0xFEFF
+
+    /** The file as records: [rows: the first `keep` records (cells as text), count: all the records of the file]. Every record is read, so a bad one beyond `keep` is still reported. */
+    static Map read(String csvPath, int keep) {
+        try {
+            return new File(csvPath).withReader("UTF-8") { Reader reader -> read(reader, keep) } as Map
+        } catch (LcCsvError problem) {
+            throw new LcCsvError(csvPath + ": " + problem.message)
+        }
+    }
+
+    /** The same from any reader (the file name is not part of the sentence). */
+    static Map read(Reader reader, int keep) {
+        List<List<String>> rows = []
+        List<String> row = []
+        StringBuilder cell = new StringBuilder()
+        long count = 0, line = 1, recordLine = 1
+        boolean quoted = false, closed = false, any = false         // inside quotes / just after the closing quote / something of the record was read
+        Closure endRecord = {
+            row << cell.toString(); cell.setLength(0)
+            count++
+            if (rows.size() < keep) rows << row
+            row = []; closed = false; any = false
+        }
+        int c = reader.read()
+        if (c == BYTE_ORDER_MARK) c = reader.read()
+        for (; c != -1; c = reader.read()) {
+            if (quoted) {
+                if (c == QUOTE) { quoted = false; closed = true } else cell.append((char) c)
+            } else if (c != CARRIAGE_RETURN) {          // a carriage return outside quotes is part of CRLF
+                any = true
+                if (c == LINE_FEED) endRecord()
+                else if (c == COMMA) { row << cell.toString(); cell.setLength(0); closed = false }
+                else if (closed && c == QUOTE) { cell.append('"'); quoted = true; closed = false }       // a doubled quote inside a quoted cell: one quote
+                else if (closed) throw new LcCsvError("record " + (count + 1) + " (line " + recordLine + "): text after the closing quote of a cell")
+                else if (c == QUOTE) {
+                    if (cell.length() > 0) throw new LcCsvError("record " + (count + 1) + " (line " + recordLine + "): a quote inside a cell that was not opened with one")
+                    quoted = true
+                } else cell.append((char) c)
+            }
+            if (c == LINE_FEED) { line++; if (!quoted && !any) recordLine = line }
+        }
+        if (quoted) throw new LcCsvError("record " + (count + 1) + " (line " + recordLine + "): a quoted cell is never closed")
+        if (any) endRecord()
+        return [rows: rows, count: count]
+    }
+
+    /** The points of a CSV file with the columns `y` and `x` (pixel coordinates; other columns are metadata and may hold any text): [ys: List<Double>, xs: List<Double>], one pair per record.
+     *  A missing column, a record with another number of cells than the header, and a coordinate that is not a finite number are an LcCsvError that names the record. */
+    static Map points(String csvPath) {
+        Map csv = read(csvPath, Integer.MAX_VALUE)
+        List<List<String>> rows = csv.rows as List<List<String>>
+        if (rows.isEmpty()) throw new LcCsvError(csvPath + ": the points file is empty (it needs a header with the columns y and x)")
+        List<String> header = rows[0]
+        int yi = header.indexOf("y"), xi = header.indexOf("x")
+        if (yi < 0 || xi < 0) throw new LcCsvError(csvPath + ": the points file has no " + (yi < 0 && xi < 0 ? "'y' and 'x' columns" : (yi < 0 ? "'y' column" : "'x' column")) + " (header: " + header.join(",") + ")")
+        List<Double> ys = [], xs = []
+        rows.drop(1).eachWithIndex { List<String> cells, int index ->
+            String where = csvPath + ": record " + (index + 2)
+            if (cells.size() != header.size()) throw new LcCsvError(where + " has " + cells.size() + " cell(s), the header has " + header.size())
+            ys << coordinate(cells[yi], "y", where)
+            xs << coordinate(cells[xi], "x", where)
+        }
+        return [ys: ys, xs: xs]
+    }
+
+    /** One coordinate cell as a finite number, or an LcCsvError that says which cell. */
+    private static double coordinate(String text, String column, String where) {
+        double value
+        try { value = Double.parseDouble(text.trim()) }
+        catch (NumberFormatException problem) { throw new LcCsvError(where + ": '" + column + "' is '" + text + "', not a number") }
+        if (Double.isNaN(value) || Double.isInfinite(value)) throw new LcCsvError(where + ": '" + column + "' is '" + text + "', not a finite number")
+        return value
+    }
+}
diff --git a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
index 07ba6c1..362efb4 100644
--- a/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
+++ b/src/main/resources/org/cellmigrationlab/labconstrictor/qupath/parts.txt
@@ -6,3 +6,4 @@ LcRetention.groovy
 LcRunIdentity.groovy
 LcWorkers.groovy
 LcAppHosts.groovy
+LcCsv.groovy
diff --git a/tests/adversarial_app/adv_lc_tools.py b/tests/adversarial_app/adv_lc_tools.py
index 80d38dd..c6f1666 100644
--- a/tests/adversarial_app/adv_lc_tools.py
+++ b/tests/adversarial_app/adv_lc_tools.py
@@ -30,6 +30,11 @@ def dims(ndim: int = 2, rows: int = 3, text_length: int = 10, fail: bool = False
     return np.ones(shape, np.uint8), pts, ("word " * text_length) + "<b>not bold</b> [link](http://example.com) **bold**"
 
 @tool("Spots")
-def spots(image: Image, rows: int = 3) -> Annotated[PointsOut, Name("pts"), ApplyTo("image"), Replace()]:
+def spots(image: Image, rows: int = 3, note: str = "") -> Annotated[PointsOut, Name("pts"), ApplyTo("image"), Replace()]:
     import pandas as pd
-    return pd.DataFrame({"y": np.arange(rows, dtype=float) * 10, "x": np.arange(rows, dtype=float) * 10}) if rows else pd.DataFrame({"y": [], "x": []})
+    if not rows:
+        return pd.DataFrame({"y": [], "x": []})
+    frame = pd.DataFrame({"y": np.arange(rows, dtype=float) * 10, "x": np.arange(rows, dtype=float) * 10})
+    if note:  # a metadata column whose text may hold line breaks, commas and quotes: the Toolkit writes it as one quoted CSV cell (issue 17)
+        frame["note"] = note.replace("|", "\n")  # a text field of the form is one line, so a "|" in the text stands for the line break
+    return frame
diff --git a/tests/gui_test_adversarial_body.groovy b/tests/gui_test_adversarial_body.groovy
index 0964693..7238ce7 100644
--- a/tests/gui_test_adversarial_body.groovy
+++ b/tests/gui_test_adversarial_body.groovy
@@ -94,6 +94,16 @@ Thread.start("lc-gui-test") {
         def anns = fx { qupath.imageData.hierarchy.annotationObjects.collect { it.name + ":" + it.ROI.numPoints } }
         println "ANNOTATIONS " + anns
         expect("replace_leaves_one_annotation", anns.count { it.startsWith("adv:pts:") } == 1, anns)
+
+        // ---- issue 17: a points record whose metadata cell holds a line break, a comma, quotes and non-ASCII text is ONE point (the Toolkit writes it as one quoted CSV record)
+        def note = "first line\nsecond, \"quoted\" \u00e9\u4e2d"
+        fx { dlg.setters["rows"](3); dlg.setters["note"](note.replace("\n", "|")) }      // the tool turns the "|" into a line break (a form field holds one line)
+        fx { dlg.run() }; Thread.sleep(2000); waitIdle(dlg, 120)
+        println "STATUS_NOTE " + status(dlg)
+        def noted = fx { qupath.imageData.hierarchy.annotationObjects.findAll { it.name == "adv:pts" }.collect { a -> a.ROI.allPoints.collect { [it.x, it.y] } } }
+        expect("issue17_multiline_metadata_gives_one_point_per_record", noted.size() == 1 && noted[0] == [[0.5d, 0.5d], [10.5d, 10.5d], [20.5d, 20.5d]], noted)
+        def noteTable = fx { resultStages().collectMany { it.scene.root.lookupAll(".table-view").toList() }.find { it.items && it.columns*.text == ["y", "x", "note"] } }
+        expect("issue17_multiline_metadata_stays_in_one_table_row", noteTable != null && fx { noteTable.items.size() == 3 && noteTable.items.every { it[2] == note } }, noteTable == null ? "no table" : fx { noteTable.items })
     } catch (Throwable t) { t.printStackTrace(); results["EXCEPTION"] = false }
     finally { println "RESULTS " + results; Thread.sleep(500); System.exit(results && results.every { it.value } ? 0 : 1) }
 }
diff --git a/tests/gui_test_parity_results_body.groovy b/tests/gui_test_parity_results_body.groovy
index 42e93b4..db2419f 100644
--- a/tests/gui_test_parity_results_body.groovy
+++ b/tests/gui_test_parity_results_body.groovy
@@ -101,6 +101,27 @@ Thread.start("lc-gui-test") {
         expect("csv_last_row_without_newline_and_empty_quoted_cell", items[2] == ["last", "", "3"], items[2])
         expect("csv_header_is_the_columns", fx { odd.children[0].columns*.text } == ["name", "note", "n"], fx { odd.children[0].columns*.text })
         expect("empty_file_is_an_empty_table", fx { LcDialog.tableView(csv("empty.csv", ""), "e") }.with { it instanceof Label && it.text == "(empty table)" }, "")
+
+        // ---- issue 17: one reader (LcCsv) for tables and points; a quoted line break never makes a second record, a malformed file is a sentence, not a guess
+        def errorOf = { Closure c -> try { c(); return null } catch (LcCsvError e) { return e.message } }
+        def noteFile = csv("points_note.csv", "y,x,note\n1,2,\"first line\nsecond line\"\n3.5,4.5,\"a,b \"\"q\"\" \u00e9\u4e2d\"\n5,6,\n")
+        def found = LcCsv.points(noteFile)
+        expect("issue17_points_multiline_record_is_one_point", found.ys == [1d, 3.5d, 5d] && found.xs == [2d, 4.5d, 6d], found)
+        def noteRows = LcCsv.read(noteFile, 100)
+        expect("issue17_read_keeps_the_full_multiline_text", noteRows.count == 4 && noteRows.rows[1] == ["1", "2", "first line\nsecond line"] && noteRows.rows[2][2] == "a,b \"q\" \u00e9\u4e2d" && noteRows.rows[3][2] == "", noteRows)
+        expect("issue17_rows_beyond_keep_are_counted_by_record", LcCsv.read(noteFile, 2).with { it.rows.size() == 2 && it.count == 4 }, "")
+        expect("issue17_byte_order_mark_is_dropped", LcCsv.read(csv("bom.csv", "\ufeffy,x\n1,2\n"), 10).rows[0] == ["y", "x"], "")
+        expect("issue17_crlf_and_missing_last_newline", LcCsv.read(csv("crlf.csv", "y,x\r\n1,2\r\n3,4"), 10).rows == [["y", "x"], ["1", "2"], ["3", "4"]], "")
+        expect("issue17_points_without_x_column_is_a_sentence", errorOf { LcCsv.points(csv("no_x.csv", "y,z\n1,2\n")) }?.contains("has no 'x' column"), errorOf { LcCsv.points(csv("no_x.csv", "y,z\n1,2\n")) })
+        expect("issue17_points_empty_file_is_a_sentence", errorOf { LcCsv.points(csv("none.csv", "")) }?.contains("the points file is empty"), "")
+        expect("issue17_points_short_record_is_a_sentence", errorOf { LcCsv.points(csv("short.csv", "y,x,n\n1,2,a\n3,4\n")) }?.contains("record 3 has 2 cell(s), the header has 3"), errorOf { LcCsv.points(csv("short.csv", "y,x,n\n1,2,a\n3,4\n")) })
+        expect("issue17_points_text_coordinate_is_a_sentence", errorOf { LcCsv.points(csv("text.csv", "y,x\n1,two\n")) }?.contains("record 2: 'x' is 'two', not a number"), errorOf { LcCsv.points(csv("text.csv", "y,x\n1,two\n")) })
+        expect("issue17_points_nan_coordinate_is_a_sentence", errorOf { LcCsv.points(csv("nan.csv", "y,x\nNaN,2\n")) }?.contains("not a finite number"), "")
+        expect("issue17_unclosed_quote_names_the_record_and_line", errorOf { LcCsv.read(csv("open.csv", "a,b\n1,\"never closed\nstill open\n"), 10) }?.contains("record 2 (line 2): a quoted cell is never closed"), errorOf { LcCsv.read(csv("open.csv", "a,b\n1,\"never closed\nstill open\n"), 10) })
+        expect("issue17_text_after_closing_quote_is_a_sentence", errorOf { LcCsv.read(csv("after.csv", "a\n\"x\"y\n"), 10) }?.contains("record 2 (line 2): text after the closing quote"), "")
+        expect("issue17_stray_quote_in_unquoted_cell_is_a_sentence", errorOf { LcCsv.read(csv("stray.csv", "a\nx\"y\n"), 10) }?.contains("a quote inside a cell that was not opened with one"), "")
+        def badTable = fx { LcDialog.tableView(csv("bad_table.csv", "a,b\n1,\"open\n"), "bad") }
+        expect("issue17_malformed_table_says_why_instead_of_showing_rows", badTable instanceof Label && fx { badTable.text.startsWith("table 'bad' cannot be shown: ") && badTable.text.contains("a quoted cell is never closed") }, fx { badTable.text })
         tmpDir.deleteDir()
 
     } catch (Throwable t) { t.printStackTrace(); results["EXCEPTION"] = false }
diff --git a/tests/gui_test_parity_trust_body.groovy b/tests/gui_test_parity_trust_body.groovy
index 2b8f97f..52eb143 100644
--- a/tests/gui_test_parity_trust_body.groovy
+++ b/tests/gui_test_parity_trust_body.groovy
@@ -57,6 +57,26 @@ mk("trust_param_name_space") { e, p -> } { s -> s.tools[0].inputs[0].name = "a b
 mk("trust_tool_id_path") { e, p -> } { s -> s.tools[0].id = "../x" }
 mk("trust_protocol_2") { e, p -> } { s -> s.protocol = 2 }
 mk("trust_tool_no_outputs") { e, p -> } { s -> s.tools[0].remove("outputs") }
+// issue 20: malformed entries and cached schemas are refused with a reason before they reach the app selector or the form
+mk("trust_tools_none") { e, p -> } { s -> s.tools = null }
+mk("trust_tools_not_list") { e, p -> } { s -> s.tools = "x" }
+mk("trust_tool_not_object") { e, p -> } { s -> s.tools = [3] }
+mk("trust_tool_no_label") { e, p -> } { s -> s.tools[0].remove("label") }
+mk("trust_inputs_not_list") { e, p -> } { s -> s.tools[0].inputs = "x" }
+mk("trust_param_not_object") { e, p -> } { s -> s.tools[0].inputs = [7] }
+mk("trust_param_name_missing") { e, p -> } { s -> s.tools[0].inputs[0].remove("name") }
+mk("trust_param_name_not_text") { e, p -> } { s -> s.tools[0].inputs[0].name = 5 }
+mk("trust_param_no_label") { e, p -> } { s -> s.tools[0].inputs[0].remove("label") }
+mk("trust_choice_without_choices") { e, p -> } { s -> s.tools[0].inputs[0].type = "choice" }
+mk("trust_choice_empty_choices") { e, p -> } { s -> s.tools[0].inputs[0].type = "choice"; s.tools[0].inputs[0].choices = [] }
+mk("trust_output_not_object") { e, p -> } { s -> s.tools[0].outputs = ["x"] }
+mk("trust_output_no_name") { e, p -> } { s -> s.tools[0].outputs = [[type: "table"]] }
+mk("trust_output_name_path") { e, p -> } { s -> s.tools[0].outputs = [[name: "../x", type: "table"]] }
+mk("trust_output_no_type") { e, p -> } { s -> s.tools[0].outputs = [[name: "t"]] }
+mk("trust_pythonpath_item_not_text") { e, p -> e.pythonpath = [1] }
+mk("trust_runtime_path_not_text") { e, p -> e.runtime_path = 5 }
+mk("trust_module_empty") { e, p -> e.module = "" }
+mk("trust_choice_and_outputs_ok") { e, p -> } { s -> s.tools[0].inputs[0].type = "choice"; s.tools[0].inputs[0].choices = ["a", "b"]; s.tools[0].outputs = [[name: "t", type: "table"], [name: "pts", type: "points", replace: true]] }
 mk("trust_tools_old") { e, p -> } { s -> s.tools_version = "0.2.0rc1" }
 mk("trust_tools_no_feature") { e, p -> } { s -> s.features = ["app_hosts_v1", "reserved_inputs_v1"] }
 mk("trust_tools_no_hosts_feature") { e, p -> } { s -> s.features = ["reserved_inputs_v1", "retention_prune"] }
@@ -96,6 +116,25 @@ refused("trust_param_name_space", "parameter without an identifier name")
 refused("trust_tool_id_path", "a tool has an unexpected structure")
 refused("trust_protocol_2", "schema protocol 2 is not supported (this host speaks [1])")
 refused("trust_tool_no_outputs", "a tool has an unexpected structure")
+refused("trust_tools_none", "schema has no list of tools")
+refused("trust_tools_not_list", "schema has no list of tools")
+refused("trust_tool_not_object", "a tool has an unexpected structure")
+refused("trust_tool_no_label", "a tool has an unexpected structure")
+refused("trust_inputs_not_list", "a tool has an unexpected structure")
+refused("trust_param_not_object", "parameter without an identifier name")
+refused("trust_param_name_missing", "parameter without an identifier name")
+refused("trust_param_name_not_text", "parameter without an identifier name")
+refused("trust_param_no_label", "parameter without an identifier name and a text label")
+refused("trust_choice_without_choices", "choice parameter 'x_1' has no choices")
+refused("trust_choice_empty_choices", "choice parameter 'x_1' has no choices")
+refused("trust_output_not_object", "has an output without a plain name and a text type")
+refused("trust_output_no_name", "has an output without a plain name and a text type")
+refused("trust_output_name_path", "has an output without a plain name and a text type")
+refused("trust_output_no_type", "has an output without a plain name and a text type")
+refused("trust_pythonpath_item_not_text", "field 'pythonpath' must be a list of strings")
+refused("trust_runtime_path_not_text", "field 'runtime_path' must be a string")
+refused("trust_module_empty", "field 'module' must be a non-empty string")
+expect("trust_valid_choice_and_outputs_load", loaded.contains("trust_choice_and_outputs_ok") && problemOf("trust_choice_and_outputs_ok") == null, problemOf("trust_choice_and_outputs_ok"))
 // the compatibility rules (LcCompat, the vectors of conformance.json): an app whose Tools lacks what this host needs is not offered, with one sentence; an unparsable version only warns
 refused("trust_tools_old", "this app's labconstrictor-tools 0.2.0rc1 is older than the 0.3.0a1 this host needs: update it")
 refused("trust_tools_no_feature", "this app's labconstrictor-tools lacks retention_prune: update it")