diff --git a/docs/AUTHORING.md b/docs/AUTHORING.md
index a5ba13a..2285837 100644
--- a/docs/AUTHORING.md
+++ b/docs/AUTHORING.md
@@ -97,7 +97,7 @@ read with `tifffile`; other formats (PNG, JPEG, ...) are read if the app environ
 ```
 labconstrictor-tools check --module my_app_lc_tools --pythonpath .
 labconstrictor-tools register --name myapp --prefix <app prefix> --module my_app_lc_tools --pythonpath .   # by hand; the installer does it
-labconstrictor-tools run myapp blur image=cells.tif sigma=3 --out results/      # without --out: <LC_HOME>/results/<time>_<app>_<tool> (newest 20 kept)
+labconstrictor-tools run myapp blur image=cells.tif sigma=3 --out results/      # without --out: <LC_HOME>/results/<time>_<app>_<tool> (newest 20 completed kept by `labconstrictor-tools prune`)
 labconstrictor-tools run myapp blur --usage
 ```
 
diff --git a/docs/HOST_FEATURES.md b/docs/HOST_FEATURES.md
index 0c7dd9a..9e661e0 100644
--- a/docs/HOST_FEATURES.md
+++ b/docs/HOST_FEATURES.md
@@ -11,7 +11,7 @@ Hosts: **Napari** (dock widget), **Fiji** (SciJava dialog, Groovy script or jar)
 | `Widget("slider")` / `Widget("radio")` | `FloatSlider`, `Slider`, radio buttons | slider and radio styles | slider beside the box, radio buttons |
 | `Copy as command` (host feature, no manifest change) | button with a menu: terminal line or Python snippet | the Log after each run; menu entry "Copy last run as command" | menu button: terminal line or Python snippet |
 | `EnabledWhen` | greys out | ignored: every field stays editable | greys out |
-| `PixelSizeOf` | prefilled from the layer | prefilled from the calibration | prefilled from the image |
+| `PixelSizeOf` | prefilled from the layer's scale and length unit; a bare scale with pixel units is *not calibrated* (blank, run blocked) | prefilled from the calibration; uncalibrated: blank, run blocked | prefilled from the image; uncalibrated: blank, run blocked |
 | `ChoicesFrom` (dropdown) | yes, updates when its inputs change | yes, from the previous run's values; text field the first time | yes, updates when its inputs change |
 | `ClearAfterRun` | yes | not needed (a fresh dialog every run) | yes |
 | `Replace` | updates the layer or dock in place | closes the previous window, overlay or ROIs | reuses the results window, replaces the annotation |
diff --git a/docs/HOST_PARITY.md b/docs/HOST_PARITY.md
index 513a383..17e10e6 100644
--- a/docs/HOST_PARITY.md
+++ b/docs/HOST_PARITY.md
@@ -52,8 +52,8 @@ Columns: id, rule, reference, Napari, Fiji, QuPath, CLI, notebook, status, note.
 | A03 | Table input | CSV path, worker reads it with pandas (T:convert.py:65-67) | file picker filtered to `*.csv` (N _schema.py:82-87, _widget.py:926) | file field, no filter (F:485-486, 796-798) | text field plus file chooser, no filter (Q:952-963) | `table=path` | text box, hint "path to a CSV file" (NB:67-72) | same | only Napari filters the file dialog. No host can pass an open Fiji Results table or QuPath table |
 | A04 | File input | a `Path`, no existence check (T:convert.py:68-69) | file picker, filter `*` (N _schema.py:86) | file field (F:485, 796-798) | text field plus chooser (Q:952-963) | path text | text box | same | |
 | A05 | Folder input | a `Path`; worker refuses a non-folder with `[folder_not_found] 'L': folder not found: P` (T:convert.py:70-74) | folder picker, no host check (N _schema.py:83-84; _widget.py:926-927) | directory field; host check, same text as the worker (F:487-488, 799-803) | directory chooser; host check is `exists()`: a regular file passes, a missing path says "file not found: P" (Q:952-963, 1288-1291) | worker check | worker check | DIVERGES | reference: the worker text, one source. Fix: QP-2b (QuPath S): `isDirectory()` and the folder template |
-| A06 | Integer input, field with no declared Min/Max | worker accepts any integer; a host box needs finite limits | Qt int box, +-(2^31-1) (N _schema.py:12, 99-107) | Integer item, Java int range (F:496-500) | Spinner of int, +-1 000 000 000 (Q:58, 793-804) | any Python int (cli.py:88-89) | BoundedIntText +-10^9 (NB:21, 74-80) | DIVERGES | reference: +-(2^31-1), the largest value every toolkit's integer box holds. Fix: QP-2c (QuPath S), NB-1 (notebook S). A bound declared above 2^31-1 is cut by `lo as int` in QuPath (Q:797) and in Fiji `as Integer` (F:498) |
-| A07 | Float input, field with no declared Min/Max | worker accepts any finite number | +-1e15 (N _schema.py:13, 100-102) | Double item, no limits (F:558) | +-1e12 (Q:59, 807-819) | any finite (cli.py:90-91) | +-1e9 (NB:22, 82-88) | DIVERGES | reference: +-1e15 (largest, keeps every realistic calibration or area). Fix: QP-2c (QuPath S), NB-1 (notebook S) |
+| A06 | Integer input, field with no declared Min/Max | worker accepts any integer; a host box needs finite limits | Qt int box, +-(2^31-1) (N _schema.py:12, 99-107) | Integer item, Java int range (F:496-500) | Spinner of int, +-1 000 000 000 (Q:58, 793-804) | any Python int (cli.py:88-89) | BoundedIntText +-10^9 (NB:21, 74-80) | DIVERGES | **decided: +-(2^53-1) = +-9007199254740991**; typed or macro values beyond are REFUSED, never clamped (SPEC_WRONG_SCIENCE section 6). Hosts whose box holds only an int (Qt, Java int, spinner) move to a long or text-backed widget. Today a bound above 2^31-1 is cut by `lo as int` in QuPath (Q:797) and `as Integer` in Fiji (F:498). Fix: NP (Napari S), FJ (Fiji S), QP-2c (QuPath S), NB-1 (notebook S) |
+| A07 | Float input, field with no declared Min/Max | worker accepts any finite number | +-1e15 (N _schema.py:13, 100-102) | Double item, no limits (F:558) | +-1e12 (Q:59, 807-819) | any finite (cli.py:90-91) | +-1e9 (NB:22, 82-88) | DIVERGES | **decided: +-1e15**; beyond is REFUSED, never clamped (SPEC_WRONG_SCIENCE section 6). Fix: FJ (Fiji S: add the limit and refusal), QP-2c (QuPath S), NB-1 (notebook S) |
 | A08 | Float arrow step | cosmetic | 1e-4 when a unit is declared or the default is under 1, else 0.01 (N _schema.py:14-15, 103-107) | 1e-4 (F:54, 558) | (max-min)/100 if the range is bounded and at most 100, else 1 (Q:811) | n/a | 1e-4 (NB:23, 86) | intended | affects arrow keys only. QuPath arrow on an unbounded float moves by 1 |
 | A09 | Boolean input | JSON `true`/`false` only; text and numbers refused (T:convert.py:86-90) | checkbox (N _schema.py:90-91) | checkbox (F:490-491) | checkbox (Q:757-762) | `1 0 true false yes no`, any case; else `name: expected true/false, got 'x'` (cli.py:94-97) | checkbox (NB:89-90) | same | |
 | A10 | Boolean as text (macro line / command line) | n/a | n/a | macro: absent = default, bare flag = true, `true 1 yes` / `false 0 no` (F:1292-1297) | n/a | `name=` (empty) is refused (cli.py:94-97) | n/a | intended | the macro convention of ImageJ: a bare flag is true |
@@ -82,7 +82,7 @@ Columns: id, rule, reference, Napari, Fiji, QuPath, CLI, notebook, status, note.
 
 | id | rule | reference | Napari | Fiji | QuPath | CLI | notebook | status | note |
 |---|---|---|---|---|---|---|---|---|---|
-| C01 | Min / Max, value typed outside the range | "bounds, enforced everywhere" (MANIFEST.md); worker refuses with `[invalid_parameter] 'L' must be >= m` / `<= M` (T:convert.py:100-105) | Qt box limited to [min, max] (N _schema.py:101-102) | dialog: SciJava widget (not in the script, not determined); macro: refused (F:1270-1271) | JavaFX spinner with the limits (Q:793-819; clamping of typed text not verified) | refused by the worker, JSON error | Bounded*Text widget keeps the value inside (NB:74-88) | intended | GUIs cannot hold an out-of-range number, text paths refuse. Fix: TOOLS-3 (Tools S): say so in MANIFEST.md |
+| C01 | Min / Max, value typed outside the range | "bounds, enforced everywhere" (MANIFEST.md); worker refuses with `[invalid_parameter] 'L' must be >= m` / `<= M` (T:convert.py:100-105) | Qt box limited to [min, max] (N _schema.py:101-102) | dialog: SciJava widget (not in the script, not determined); macro: refused (F:1270-1271) | JavaFX spinner with the limits (Q:793-819; clamping of typed text not verified) | refused by the worker, JSON error | Bounded*Text widget keeps the value inside (NB:74-88) | intended | GUIs cannot hold an out-of-range number, text paths refuse. **For the unbounded default limits (A06, A07) a typed or macro value beyond +-(2^53-1) / +-1e15 is refused, never clamped (SPEC_WRONG_SCIENCE section 6); the widget must not silently shorten a typed value.** Fix: TOOLS-3 (Tools S): say so in MANIFEST.md |
 | C02 | Unit | label gets ` (unit)` | N _schema.py:58 | F:477 | Q:706 | not shown by `run --usage` (cli.py:65-82) | not shown (NB:60-66) | DIVERGES | reference: the three hosts. Fix: NB-1 (notebook S), TOOLS-4 (CLI S: show the unit in usage) |
 | C03 | Description | tooltip / help text | tooltip on the field (N _schema.py:56-57) | item description (F:375) | tooltip on the label only (Q:708-713) | after the default in usage (cli.py:80) | `control.tooltip` (NB:99) | same | |
 | C04 | Label | schema label | label (N _schema.py:58) | label; "Set"/"Use"/"selection" boxes use it lowercased (F:479, 514, 520) | label (Q:706) | the parameter name, not the label (cli.py:156) | label (NB:60-62) | intended | the CLI addresses parameters by name |
@@ -100,7 +100,7 @@ Columns: id, rule, reference, Napari, Fiji, QuPath, CLI, notebook, status, note.
 | C16 | Axes("YX") given a stack or multi-channel image | `[wrong_dimensions] 'L' must be a 2D image (YX) but got 3D with shape (...)` (T:convert.py:109-117); "a host passes the image as it is" (types.py:200) | passes the array, worker refuses | sends the plane on screen and logs "needs a single 2D plane - using the current plane (i of n)" (F:777-781) | sends plane z 0, t 0 with every channel (Q:1374) | worker refuses | worker refuses | DIVERGES | reference: refuse (no silent choice of data). Fix: FJ-9 (Fiji S: drop the silent plane or gate it behind a documented hint; the durable fix is a PickPlane hint, TOOLS-5 M). Maintainers may prefer to promote Fiji's behaviour: either way write it in PROTOCOL |
 | C17 | PixelSizeOf: prefill | prefilled with the pixel size of the named image in micrometres | follows the layer or the file header until the person edits the field (N _widget.py:773-789) | at dialog build and on every change of the image or file; overwrites a typed value (F:107-139, 551-557) | on image change: overwrites a typed value; a file is not read at all: `imageSources()[box.value]` is null for "File..." (Q:1019-1038) | n/a | n/a | DIVERGES | reference: Napari. Fix: QP-8 (QuPath S: read the file header through `ImageServers.buildServer`, keep edited values), FJ-10 (Fiji S) |
 | C18 | PixelSizeOf: unit conversion to micrometres | micrometres per pixel | any length unit pint knows (N _units.py:138-158) | um, micron(s), micrometer/-metre, nm, mm, cm, m (and inch for files only) (F:78-80, 97) | what QuPath calibration reports in micrometres (`hasPixelSizeMicrons`) (Q:1033) | n/a | n/a | intended | different toolkits. Conformance vector: 0.325 um, 325 nm, 0.000325 mm all give 0.325 |
-| C19 | PixelSizeOf: layer with a scale but no length unit | not specified | scale taken as micrometres, status line "calibration assumed to be in um (layer has no unit)" (N _units.py:138-172, _widget.py:806-809; HOST_FEATURES) | unit "pixel" or unknown: field left alone, a Log line when none (F:82-87, 556-557) | `hasPixelSizeMicrons` false: field left alone | n/a | n/a | intended | documented in napari HOST_FEATURES. Reference should state the rule: assume micrometres only with a visible note |
+| C19 | PixelSizeOf: layer with a scale but no length unit | **unknown** (SPEC_WRONG_SCIENCE 2.1): a bare scale with default pixel units is never read as micrometres | today: scale taken as micrometres, status line "calibration assumed to be in um (layer has no unit)" (N _units.py:138-172, _widget.py:806-809) | unit "pixel" or unknown: field left alone, a Log line when none (F:82-87, 556-557) | `hasPixelSizeMicrons` false: field left alone | n/a | n/a | DIVERGES | reference decided: unknown, the field is cleared (not left alone) and the run is blocked until a value is entered. Fix: Napari `_units.py`/`_widget.py` (stop assuming um), Fiji and QuPath (clear instead of leave alone, Fiji #26, QuPath #15) |
 | C20 | PixelSizeOf: anisotropic pixels | one value; Y and X can differ | warns "pixel size differs: Y .. um, X .. um - the tool takes one value and gets X" (N _units.py:184-188) | silent, uses X (F:87) | silent, uses X (Q:1033) | n/a | n/a | DIVERGES | reference: Napari (a wrong calibration is silent otherwise). Fix: FJ-10 (Fiji S), QP-8 (QuPath S) |
 | C21 | PixelSizeOf: TIFF header units | ImageJ unit text, else TIFF ResolutionUnit | inch and centimetre (N _units.py:193, 229-233) | inch only (F:97) | n/a (no file read, see C17) | n/a | n/a | DIVERGES | reference: Napari. Fix: FJ-10 (Fiji S: add `cm` = 10000 um) |
 | C22 | RegionOf: where the region comes from | the current selection as labels 1..N, 0 outside, behind a "use the selection" box, off by default (types.py:132-137) | selected Shapes layer; its scale must equal the image's (N _export.py:23-76) | ROI Manager selection, else the ROI of the image (F:705-722) | selected annotations, points excluded; only for the image open in QuPath (Q:1237-1255) | n/a | n/a | intended | HOST_FEATURES.md |
@@ -118,7 +118,7 @@ Columns: id, rule, reference, Napari, Fiji, QuPath, CLI, notebook, status, note.
 | D02 | Integer text grammar | digits with optional sign, nothing else | box rejects other keystrokes | macro: `[+-]?\d+`, ASCII, trimmed (F:1262-1263); dialog: SciJava box | box | `int(text)`: accepts `1_000`, ` 5 ` and non-ASCII digits (cli.py:88-93) | n/a | DIVERGES | reference: Fiji macro grammar (strict). Fix: TOOLS-7 (CLI S: strict regex before `int`) |
 | D03 | Float text grammar | decimal number with optional exponent | box | macro: `Double.parseDouble` accepts `1.5f`, `2d`, hex floats and `NaN` (then refused as not finite) (F:1267-1268); dialog: SciJava box | box | `float(text)`: accepts `1_0`, `nan`, `inf`, `infinity` (then the worker refuses) (cli.py:90-91) | n/a | DIVERGES | reference: optional sign, digits with an optional fraction (or only a fraction), optional exponent; nothing else (the regex is in the conformance file). Fix: TOOLS-7 (CLI S), FJ-11 (Fiji S) |
 | D04 | NaN and infinity | `[invalid_parameter] 'L' must be a finite number` (T:convert.py:82-84) | cannot be typed (not determined) | macro: `'L' must be a finite number, got 'x'` (F:1268) | JavaFX may parse `NaN`; Gson then refuses to write it: `host_error` `IllegalArgumentException: JSON forbids NaN` (predicted, Q:126, 1224-1227) | worker refusal | box rejects | DIVERGES | predicted for QuPath. Reference: the worker text. Fix: QP-2f (QuPath S: finite check before sending) |
-| D05 | Huge integers | any Python int | clamped to +-(2^31-1) when unbounded | macro: `'L' is out of range: text` beyond Java int (F:1264) | clamped to +-1e9 when unbounded | accepted, worker range-checks | clamped +-1e9 | DIVERGES | see A06. Reference: accept anything the declared bounds allow in text paths; GUI limit +-(2^31-1) |
+| D05 | Huge integers | any Python int | clamped to +-(2^31-1) when unbounded | macro: `'L' is out of range: text` beyond Java int (F:1264) | clamped to +-1e9 when unbounded | accepted, worker range-checks | clamped +-1e9 | DIVERGES | **decided: refused, never clamped, beyond +-(2^53-1)** (see A06, SPEC_WRONG_SCIENCE section 6); text paths accept everything up to that limit or the declared bounds |
 | D06 | Fractional text for an integer | refused: `'L' must be an integer` (T:convert.py:75-78; `2.0` is accepted because `int(2.0) == 2.0`) | box cannot | macro: `'L' must be a whole number, got 'x'` (F:1262) | box | `name: expected a integer, got 'x'` (cli.py:93) | box | same | outcome the same, wording differs: see I06 |
 
 ### E. Text handling
@@ -231,8 +231,8 @@ Columns: id, rule, reference, Napari, Fiji, QuPath, CLI, notebook, status, note.
 | id | rule | reference | Napari | Fiji | QuPath | CLI | notebook | status | note |
 |---|---|---|---|---|---|---|---|---|---|
 | L01 | Where results go | CLI: `<LC_HOME>/results/<YYYYMMDDTHHMMSS>_<6 hex>_<app>_<tool>`, names made of `A-Za-z0-9_.-` (cli.py:197-237) | temp folder `lcin_*`, removed after the run (N _widget.py:818, 841-843, 1080-1083) | temp folder `lcjob_fiji_*`, removed after the run (F:1473, 1485-1487) | same folder as the CLI, name `<ts>_<6 digits>_<app>_<tool>` with the app and tool text as they are (Q:1395-1402) | as reference | `lcnb_*` in the temp area, never removed (NB:123) | DIVERGES | reference: CLI naming (slug). Napari and Fiji removal is documented (OPERATIONS.md). Fix: QP-18 (QuPath S: slug and 6-hex), NB-7 (notebook S) |
-| L02 | Pruning | keeps the newest 20; only folders whose name matches `^\d{8}T\d{6}_`, never symlinks (cli.py:187, 197, 206-221) | n/a | n/a | keeps 20 but removes every folder in `results/` beyond the newest 20 by name, whatever it is (Q:1400) | as reference | none | DIVERGES | reference: CLI (it never touches a folder it did not create). Fix: QP-18 |
-| L03 | Run record | `<LC_HOME>/runs/<time>_<app>_<tool>/run.json`, newest 50 kept (runs.py:18) | written for every run (N _widget.py:1126) | own writer, same folder and count, `host: "fiji"`, millisecond stamp, prunes every sub-folder of `runs/` (F:46, 923-941) | none (the Details window shows the outcome) | written unless `--no-record` (cli.py:132) | none | DIVERGES | reference: `runs.record`. Fix: QP-19 (QuPath M), FJ-4 (Fiji S: prune only its own pattern) |
+| L02 | Pruning | **decided (SPEC_WRONG_SCIENCE 3): hosts never prune.** Only Tools prunes (`labconstrictor_tools.retention`, CLI `labconstrictor-tools prune`), eligible entries only: owned (`.lc-owner.json`), completed (`.lc-done.json`), real directory, not a symlink or junction; newest 20 results / 50 run records | n/a | n/a | today removes every folder in `results/` beyond the newest 20 by name, whatever it is (Q:1400) | today: only folders matching `^\d{8}T\d{6}_`, never symlinks, prunes before creating (cli.py:187, 197, 206-221) | none | DIVERGES | Fix: TOOLS (retention module and `prune` command), QP-18 (remove the deletion, write markers), hosts start `prune` in a subprocess after the done marker |
+| L03 | Run record | `<LC_HOME>/runs/<time>_<app>_<tool>/run.json`, newest 50 kept (runs.py:18) | written for every run (N _widget.py:1126) | own writer, same folder and count, `host: "fiji"`, millisecond stamp, today prunes every sub-folder of `runs/` (to be removed: hosts never prune, SPEC_WRONG_SCIENCE 3.1) (F:46, 923-941) | none (the Details window shows the outcome) | written unless `--no-record` (cli.py:132) | none | DIVERGES | reference: `runs.record`. Fix: QP-19 (QuPath M), FJ-4 (Fiji S: prune only its own pattern) |
 | L04 | State files | n/a | none | `<LC_HOME>/state/<app>.json` (ChoicesFrom values) and `last_command.json` (F:571, 1438, 1461) | none | none | none | intended | |
 
 ### M. Logging
@@ -305,8 +305,8 @@ Two keys carry the migration: `value` is the reference and `today` is what each
     "region_max_objects": {"value": 65535, "today": {"napari": null, "fiji": 65535, "qupath": 65535}},
     "max_export_bytes": {"value": 4294967296, "today": {"napari": 4294967296, "fiji": null, "qupath": "100000000 pixels per plane"}},
     "max_display_bytes": {"value": 4294967296, "today": {"napari": 4294967296}},
-    "unbounded_integer": {"value": [-2147483648, 2147483647], "today": {"napari": [-2147483648, 2147483647], "qupath": [-1000000000, 1000000000], "notebook": [-1000000000, 1000000000]}},
-    "unbounded_float": {"value": [-1000000000000000, 1000000000000000], "today": {"napari": [-1000000000000000, 1000000000000000], "qupath": [-1000000000000, 1000000000000], "notebook": [-1000000000, 1000000000]}},
+    "form_integer_max": {"value": 9007199254740991, "rule": "typed or macro values beyond +-value are refused, never clamped", "today": {"napari": 2147483647, "fiji": 2147483647, "qupath": 1000000000, "notebook": 1000000000}},
+    "unbounded_float": {"value": 1000000000000000, "rule": "beyond +-value refused, never clamped", "today": {"napari": 1000000000000000, "fiji": null, "qupath": 1000000000000, "notebook": 1000000000}},
     "cancel_grace_s": {"value": 3, "library_default": 10, "today": {"napari": 3, "fiji": 3, "qupath": 3}},
     "worker_close_timeout_s": {"value": 10, "today": {"napari": 2, "fiji": 15, "qupath": 10, "client": 5}},
     "worker_orphan_grace_s": {"value": 10, "today": {"worker": 10}},
@@ -482,13 +482,13 @@ Each `DIVERGES` row names one or more of these. `NB-*` changes are in this repos
 | TOOLS-9 | Tools | S | affine: refuse non-finite matrices in `_as_3x3` (`bad_return`) | H13 |
 | TOOLS-10 | Tools | S | `client.CLOSE_TIMEOUT_S` 5 to 10 (the worker promises 10) | K03 |
 | TOOLS-11 | Tools | S | `_validated_schema`: check tool ids, parameter names (identifiers) and parameter types like Fiji does | O06 |
-| NB-1 | Tools (notebook) | S | unbounded limits +-(2^31-1) / +-1e15; unit in the label | A06, A07, C02 |
+| NB-1 | Tools (notebook) | S | unbounded limits +-(2^53-1) / +-1e15, refuse never clamp; unit in the label | A06, A07, C02 |
 | NB-2 | Tools (notebook) | S | "set" checkbox for every nullable control, omit when off | B04 |
 | NB-3 | Tools (notebook) | S | honour ClearAfterRun | C11 |
 | NB-4 | Tools (notebook) | S | trim typed paths | E01 |
 | NB-5 | Tools (notebook) | S | render message results as Markdown | E04 |
 | NB-6 | Tools (notebook) | S | print a null value as `(not a finite number)` | H02 |
-| NB-7 | Tools (notebook) | S | results into `<LC_HOME>/results` with the CLI pruning, not an unremoved temp folder | H18, L01 |
+| NB-7 | Tools (notebook) | S | results into `<LC_HOME>/results` with markers (cleaned by `labconstrictor-tools prune`), not an unremoved temp folder | H18, L01 |
 | NB-8 | Tools (notebook) | S | `no_match` / `no_result` as a notice | I02 |
 | NB-9 | Tools (notebook) | S | call `log.logger()` so the form writes the shared log | M01 |
 | NP-1 | Napari | M | PickChannel and 2D tools: send the plane on screen (`viewer.dims.current_step`), say so in the status; file: first plane plus a note | C15 |
@@ -504,7 +504,7 @@ Each `DIVERGES` row names one or more of these. `NB-*` changes are in this repos
 | FJ-1 | Fiji | S | `pythonLiteral`: escape `\n \r \t` and non-printables | E03 |
 | FJ-2 | Fiji | S | send absolute paths (`File.absolutePath`) | F05 |
 | FJ-3 | Fiji | M | worker environment as the client (scrub, PYTHONSAFEPATH, working directory) | K09 |
-| FJ-4 | Fiji | S | log: five numbered backups with replace-on-move, level names as Tools; prune only its own run records | L03, M02, M03 |
+| FJ-4 | Fiji | S | log: five numbered backups with replace-on-move, level names as Tools; no pruning of run records (write markers, start `labconstrictor-tools prune`) | L03, M02, M03 |
 | FJ-5 | Fiji | S | a choice returns the declared (typed) choice | A12 |
 | FJ-6 | Fiji | S | messages: `missing_parameter`, `file_not_found` templates | B01, F01 |
 | FJ-7 | Fiji | S | starting value of a required number: nearest allowed to 0 | B07 |
@@ -526,7 +526,7 @@ Each `DIVERGES` row names one or more of these. `NB-*` changes are in this repos
 | QP-1 | QuPath | M | trust checks: port `entryProblem`, `untrustedReason`, `plainName`, `identifier`, `toolId` from the Fiji script (rows O01-O06). Do this first | O01, O02, O03, O04, O05, O06 |
 | QP-2 | QuPath | S | host-side refusals: message only, no class name; file/folder/table checks with the shared templates (sub-items b to f below) | F01, F02, F06, I03 |
 | QP-2b | QuPath | S | folder: `isDirectory()` and the folder template | A05 |
-| QP-2c | QuPath | S | unbounded integer and float limits from the conformance file | A06, A07 |
+| QP-2c | QuPath | S | unbounded integer (+-(2^53-1)) and float (+-1e15) limits from the conformance file; refuse, never clamp | A06, A07 |
 | QP-2d | QuPath | S | parse JSON integers as integers (a `ToNumberPolicy`) | A12 |
 | QP-2e | QuPath | S | `missing_parameter` template | B01 |
 | QP-2f | QuPath | S | refuse non-finite numbers before sending | D04 |
@@ -545,7 +545,7 @@ Each `DIVERGES` row names one or more of these. `NB-*` changes are in this repos
 | QP-15 | QuPath | S | clipboard failure reported | I13 |
 | QP-16 | QuPath | S | a kill after Cancel is reported as cancelled | J08 |
 | QP-17 | QuPath | S | idle timeout 600 s for the kept worker | K02 |
-| QP-18 | QuPath | S | results folder: slugged name, 6 hex, prune only `^\d{8}T\d{6}_` folders | L01, L02 |
+| QP-18 | QuPath | S | results folder: slugged name, 6 hex, markers; remove the host-side deletion, start `labconstrictor-tools prune` | L01, L02 |
 | QP-19 | QuPath | M | run records under `<LC_HOME>/runs`, newest 50 | L03 |
 | QP-20 | QuPath | M | append to the shared `<LC_HOME>/logs/labconstrictor.log` in the Tools line format with rotation | M01 |
 | QP-21 | QuPath | S | tool chooser: `label (id)` for duplicates, sorted apps | P05, P06 |
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index c3b55e9..2034b9c 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -29,7 +29,7 @@
 ## Troubleshooting
 * `labconstrictor-tools doctor` checks every entry (interpreter, schema, protocol, staleness) and prints what to fix.
 * Stale tool list after an app update: run `labconstrictor-tools register ...` again (the installer does this).
-* `labconstrictor-tools run` without `--out` writes its results to `<LC_HOME>/results/<time>_<app>_<tool>` (the newest 20 are kept; Napari and Fiji use their own temporary folders and remove them).
+* `labconstrictor-tools run` without `--out` writes its results to `<LC_HOME>/results/<time>_<app>_<tool>` (the newest 20 completed ones are kept by `labconstrictor-tools prune`, which the hosts start after a run; Napari and Fiji use their own temporary folders and remove them).
 * Every run writes `<LC_HOME>/runs/<time>_<app>_<tool>/run.json` (parameters as file paths and values, never pixel data; status,
   error, traceback, interpreter, worker output). Napari's *Details...* button shows it; attach it to bug reports. The newest 50 are kept.
 * First run slow? Imports dominate (a repeat run in a kept worker is ~10x faster). Napari keeps the worker for 10 minutes by default.
diff --git a/docs/SPEC_WAVE2.md b/docs/SPEC_WAVE2.md
index 951db3c..c25fe57 100644
--- a/docs/SPEC_WAVE2.md
+++ b/docs/SPEC_WAVE2.md
@@ -49,8 +49,8 @@ Rules (declaration errors at registration, exact text):
 @tool("Track speed")
 def speed(
     movie: Annotated[Image, Axes("TYX")],
-    pixel_size: Annotated[float, PixelSizeOf("movie"), Unit("um/px")] = 1.0,
-    dt: Annotated[float, TimeIntervalOf("movie"), Unit("s")] = 1.0,
+    pixel_size: Annotated[float, PixelSizeOf("movie"), Unit("um/px")],
+    dt: Annotated[float, TimeIntervalOf("movie"), Unit("s")],
     dz: Annotated[Optional[float], ZStepOf("volume"), Unit("um")] = None,
 ): ...
 ```
@@ -61,7 +61,11 @@ def speed(
 | Unit | um/px | **seconds** | **micrometres** |
 | Prefill from | layer scale / calibration | Fiji `frameInterval`, OME `TimeIncrement`, QuPath server `getTimeUnit`, Napari layer `scale[T]` | Fiji `pixelDepth`, OME `PhysicalSizeZ`, QuPath `getZSpacingMicrons`, Napari `scale[Z]` |
 * Declaration rules: applies to a `float` (or `Optional[float]`) parameter and names an `Image` / `Labels` parameter of the same tool whose `Axes` contain `T` (resp. `Z`) or that has no `Axes`. Error: `parameter 'dt': TimeIntervalOf('movie') needs 'movie' to have a T axis (its Axes are 'YX')`.
-* Hosts convert to the fixed units above (Fiji `frameInterval` in `timeUnit` -> s; QuPath minutes/ms -> s). Unknown or zero calibration: the parameter keeps its default and the host shows "not calibrated" in the tooltip; it never sends 0.
+* Hosts convert to the fixed units above (Fiji `frameInterval` in `timeUnit` -> s; QuPath minutes/ms -> s). **Calibration rules (amended by [SPEC_WRONG_SCIENCE.md](SPEC_WRONG_SCIENCE.md) section 2, which is normative for all three links):**
+  * A source is calibrated only from explicit metadata: a number with a unit. A bare number or default pixel units is *unknown*; the host never assumes um (or seconds) and never infers calibration from the value 1.0.
+  * Unknown, zero or non-finite calibration leaves the linked field **blank** with the tooltip "not calibrated"; it never sends 0 and **the declared default is not used as a stand-in**. A required linked field that is blank blocks the run until a value is entered; an `Optional[float]` sends `null`.
+  * The field is `unset`, `auto` or `user`; a source change re-derives or clears an `auto` value, and never overwrites a `user` value (SPEC_WRONG_SCIENCE 2.2).
+  * The request carries the value in the canonical unit (um per pixel, um, seconds) and the reserved per-axis `_calibration` input (x, y, z, t, each `{value, unit, source}`); tools never see it (SPEC_WRONG_SCIENCE 2.3.4).
 * `Unit("s")` / `Unit("um")` stay free text for display; the units in the table are the contract.
 
 ### 1.5 What a tool returns for stacks
@@ -72,7 +76,7 @@ def speed(
 | `ShapesOut` | each feature has optional properties `t` and `z` (zero-based integers); coordinates stay `[x, y]` per plane |
 | `TableOut` | an ordinary table; a `t` / `z` column by convention (hosts do not interpret it) |
 | `Scalars`, `MessageOut`, `Affine` | unchanged (a per-frame Affine is refused with `PerPlane`, 1.6) |
-* A point or shape without `t` / `z` when its `apply_to` image has that axis with length > 1 is placed on plane 0 and the host says so once (status line). `labconstrictor-tools test` reports it as a contract problem: `points 'peaks': image has a T axis but no 't' column (placed on frame 0)`.
+* A point or shape without `t` / `z` when its `apply_to` image has that axis with length > 1 is placed on **the plane that was exported** (the frame's plane; SPEC_WRONG_SCIENCE 1.1.9), not on plane 0, and the host says so once (status line). `labconstrictor-tools test` reports it as a contract problem: `points 'peaks': image has a T axis but no 't' column (placed on the exported plane)`.
 * A `t` / `z` outside the image is dropped by the host and counted: `3 points were outside the image planes and were not shown` (never an error).
 * Pixel centres at integers, as before; `t` and `z` are plane indices, never physical times.
 
@@ -137,7 +141,7 @@ Generated round-trip cases, in the style of the cases files read by `labconstric
 | `perplane_points` | 3 frames | points table has a `t` column 0..2 |
 | `perplane_cancel` | `cancel_after_s` mid-run | `CANCELATION` within one plane |
 | `perplane_bad_plane` | tool raises on frame 2 | `per_plane_failed`, message contains `frame 2` |
-| `calibration_prefill` | parameters not given | defaults used; `time_interval_of` / `z_step_of` present in schema |
+| `calibration_prefill` | parameters not given | CLI and notebook: a required linked parameter that is not given is refused (SPEC_WRONG_SCIENCE 2.3.5); an `Optional` one is `null`; `time_interval_of` / `z_step_of` present in schema |
 | `unknown_axis` | `_axes: "QYX"` | `unknown_axes` |
 | `too_large` | `LC_MAX_STACK_BYTES=1000` | `stack_too_large` |
 | `points_missing_t` | tool returns points without `t` on a stack | contract problem reported by `test` |
@@ -319,7 +323,7 @@ Hosts for 5-7 can start as soon as 4 is merged and the example tools exist; 8 an
 3. **Fixed canonical order `TCZYX`-subset (C before Z)?** Recommended: yes, with `Y`, `X` last; one rule to document, matches tifffile/OME-Zarr practice.
 4. **Calibration units: fixed (s, um) or host-native?** Recommended: fixed s and um; hosts convert; `Unit` stays display-only.
 5. **Per-plane iteration in the worker or in the hosts?** Recommended: in the worker (`PerPlane`): one task, one progress bar, one cancel path, same behaviour in CLI/notebook, memory bounded.
-6. **Missing `t` / `z` on points of a stack: frame 0, all frames, or an error?** Recommended: frame 0 plus a status note and a `test` contract warning; "all frames" would hide a tool bug.
+6. **Missing `t` / `z` on points of a stack: frame 0, all frames, or an error?** Recommended (decided in SPEC_WRONG_SCIENCE 1.1.9): the exported plane plus a status note and a `test` contract warning; "all frames" would hide a tool bug.
 7. **Zero- or one-based plane indices?** Recommended: zero-based in the protocol (like pixel coordinates); hosts show their own numbering.
 8. **Default stack limit 4 GiB?** Recommended: 4 GiB whole-stack and 500 planes in QuPath, both overridable; tune after the first real movie.
 9. **QuPath default "Planes" choice?** Recommended: current plane (never silently sends a whole movie); "all" is explicit and guarded.
diff --git a/docs/SPEC_WRONG_SCIENCE.md b/docs/SPEC_WRONG_SCIENCE.md
new file mode 100644
index 0000000..e2c3fdf
--- /dev/null
+++ b/docs/SPEC_WRONG_SCIENCE.md
@@ -0,0 +1,368 @@
+# Spec (proposal): the "wrong-science" fix wave
+
+Status: **for review, nothing is implemented.** Maintainer decisions are recorded in section 8.
+
+**v1: 2D. N-D (T/Z stacks) and the QuPath resolution (downsample) choice follow in Wave 2.** The frame (1.1.2) and the placement formula (1.1.3) already have their final shape, so Wave 2 adds fixtures, not rules. Wave 2 fixtures still needed: `TYX` and `ZYX` results with `t`/`z` columns, a 2D result on a `TYX` layer (Napari), a per-axis `_calibration` with z and t, and QuPath export at downsample 2 and 4 on a real pyramid (CF-14 is the data, the GUI harness is the missing part). Same conventions as [SPEC_WAVE2.md](SPEC_WAVE2.md) and [HOST_PARITY.md](HOST_PARITY.md): additive within `protocol: 1`, rules are host-neutral, a rule is "done" when its fixtures pass in every host that claims the feature. The fixtures below are data, meant to live in `labconstrictor_tools/conformance.json` under the key `wrong_science` and to be reused by the conformance suite (Tools #87).
+
+These rules exist because a tool run can succeed and still be scientifically wrong: a mask on the wrong pixels, a result drawn away from its image, a pixel size from another image, a researcher's folder deleted. Each host fixes its own code, but all of them implement **the same rule**, so a fix in one host cannot leave another one behind.
+
+| # | Theme | Rule set | Issues it settles |
+|---|---|---|---|
+| 1 | Coordinate frame | section 1 | Napari #31 #33 #34, Fiji #30, QuPath #21 (and the plane/offset half of QuPath #16) |
+| 2 | Calibration | section 2 | Napari #35 #38, Fiji #26, QuPath #15 |
+| 3 | Retention (hosts write markers, only Tools prunes) | section 3 | Tools #55, Napari #32, Fiji #28, QuPath #14 |
+| 4 | Run identity | section 4 | QuPath #16 (and the same hazard in Napari and Fiji) |
+| 5 | Async lookups | section 5 | Napari #36 #37, QuPath #19 |
+| 6 | Number limits | section 6 | HOST_PARITY A06, A07, C01, D05 |
+
+Out of scope here (tracked in their own issues): Fiji #29 (macro replay of required scalars), Fiji #31 (optional warp comparison blocking the overlay), Fiji #33 (Appose completion ordering). They are host bugs with no cross-host rule.
+
+Words: **MUST** and **MUST NOT** are tested by a fixture; **SHOULD** is not. "Source" is the input named by `ApplyTo` (else the first `Image` or `Labels` input in manifest order, never "the first value of any type", never the active, last shown or topmost image). "Refuse" means: do not start the run (inputs) or do not draw the result (outputs), say why in one sentence, keep every output file, never fall back to another image.
+
+---
+
+## 1. Coordinate frame
+
+### 1.1 The rule
+1. **A result lives in the data space of its source, as it was exported.** `PointsOut`, `ShapesOut`, `ImageOut` and `LabelsOut` coordinates are pixel coordinates of the image file the host wrote for the source (after any crop or plane choice), pixel centres at integers, `(y, x)` for points and `[x, y]` for shapes, as in PROTOCOL.md and HOST_PARITY H06. The worker never sees a world, viewer, slide or calibrated coordinate.
+2. **The host owns the mapping back.** It records, at run start (section 4), a *frame* for each exported image: `{source, shape, axes_offset, plane, downsample, transform}`. `axes_offset` is `(t, z, y, x)`: the origin of the exported area inside the source's full-resolution grid (all zero unless the host exports a crop; `t` and `z` are the exported plane's indices); `plane` is the exported `(t, z)`; `downsample` is the factor between exported and full-resolution pixels (1 unless the host exports a reduced copy); `transform` is the source's spatial transform (identity where the host has none). `shape` is the exported Y/X (and T/Z) shape.
+3. **Placement formula (stated once).** A result coordinate `x` (likewise `y`) is in exported-pixel units with the centre of pixel `i` at integer `i`. Its **continuous full-resolution coordinate** is `c = x0 + (x + 0.5) * downsample`, where `x0` is `axes_offset` for that axis and full-resolution pixel `i` spans `[i, i+1)`. Hosts draw at `c` as follows: Fiji and QuPath use `c` as the ROI vertex; Napari uses the data coordinate `c - 0.5` and its layer transform does the rest (`result.data_to_world(p) == source.data_to_world(c - 0.5)`). At `downsample = 1` and `x0 = 0` this is today's `x + 0.5` (Fiji, QuPath) and `x` (Napari). Shapes `[x, y]` use the same formula per vertex.
+4. **No lossy resampling.** The host never resamples a result to fit; it carries the source transform over. Conversion is exact, so "refuse" is reserved for cases where an exact mapping does not exist (1.4).
+5. **No silent fallback.** A result whose source cannot be resolved, is gone, or has no display (a file) is never drawn on another image or layer. It is shown as a table (points), listed as a file (shapes, images), and the status says where the files are.
+6. **Outputs without a source.** `ImageOut` / `LabelsOut` with no `ApplyTo` keep the documented default: pixel origin, identity transform, no units. `PointsOut` / `ShapesOut` with no `ApplyTo` use the first `Image` input (H05); with no image input they are a table or file.
+7. **Size mismatch is stated, not hidden.** If an `ImageOut` / `LabelsOut` that declares `ApplyTo` has a Y/X shape different from the exported frame, the host shows it at the default pixel origin (rule 6) and says once: `'name' is W x H but 'source' was exported as W2 x H2; shown at the pixel origin, not aligned`.
+8. **`Replace()` recomputes the frame.** Replacing a result layer or window sets the transform again from the new result; it never keeps the previous one.
+9. **No `t` / `z` means the exported plane.** A point or shape with no `t` / `z` lands on `frame.plane` (the plane that was exported), **not on plane 0**. This amends SPEC_WAVE2 1.5.
+
+### 1.2 Input selections (`RegionOf`, QuPath "Image area")
+1. A selection is converted **into the exported image's pixel grid**, then rasterised there. The mask has exactly the exported image's Y/X shape.
+2. Rasterisation: a mask pixel is set if its centre lies inside the polygon (boundary pixels are never used in fixtures, so hosts need not agree on them).
+3. Napari: vertices go `shapes.data_to_world` then `image.world_to_data` (full transform: scale, translate, rotate, shear, affine), at level 0 of a multiscale image. The mask is in the image's data grid whatever the shapes layer's own transform.
+4. A selection MUST NOT be rasterised in its own raw data coordinates.
+5. All vertices of one selection must land on one plane of the image. Otherwise refuse with `selection_mixed_planes`.
+6. QuPath: the crop is the integer bounding box of the selected annotations in full-resolution pixels (floor of the minimum, ceil of the maximum, clamped to the image); `axes_offset` is its top-left corner; with `downsample` d the exported shape is `ceil(size / d)` and a mask pixel centre `(i + 0.5) * d + offset` is tested against the annotation (1.1.3). v1 exports at `downsample = 1`.
+7. **QuPath planes.** Every selected annotation MUST be on one `ImagePlane`, and that plane MUST be the one exported (the viewer's plane at run start). Different planes among the selection: refuse `selection_mixed_planes`. One plane that is not the exported one: refuse `selection_plane_mismatch` (the host does not switch planes behind the person's back). The exported TIFF, the mask and the restored annotations all carry that one plane. **Whole-image export uses the same plane as the viewport and selection export** (the viewer's plane at run start). Today whole-image export uses `z=0, t=0` while the viewport area uses the viewer plane; that is a defect (QuPath #16, #21) and fixture CF-10 covers it.
+
+### 1.3 How each host maps
+| | frame comes from | result drawn with | file input | transform that cannot be mapped |
+|---|---|---|---|---|
+| Napari | the Image layer (level 0 of a multiscale one) | new layer gets the source's `scale`, `translate`, `rotate`, `shear`, `affine` (and units); N-D: the transform acts on the trailing axes the result has, leading axes of the source must not move the plane (note below), else refuse | pixel frame of the file: identity, no units; the layer is named after the file; no layer is searched | refuse `frame_unsupported_transform` (non-invertible YX block, or a leading-axes coupling that cannot be expressed on a lower-dimensional result) |
+| Fiji | the `ImagePlus` (by object, not by title) | ROI or overlay in the pixel space of that image at `c` (1.1.3), `setPosition(channel, z, t)` of the exported plane; calibration origin and scale are not applied (ROIs are pixel based) | the file is opened in its own window (titled with the file name) and the result goes there; if it cannot be opened: table and file | Fiji images have no transform: identity by construction |
+| QuPath | the `ImageData` of the run (section 4), plane, `axes_offset` and `downsample` above | annotation on the exported plane, vertices at `c` (1.1.3) in full-resolution pixels | not displayable: table plus file, status `file input: results are in the file's pixel frame` | QuPath images have no transform: identity by construction |
+| CLI, notebook | n/a | files; a table carries `frame` columns only if the tool wrote them | n/a | n/a |
+
+Note on the Napari row: a lower-dimensional result on a higher-dimensional source is allowed only if the dropped leading axes of the source have identity scale/translate in the world (they do not move the plane); otherwise `frame_unsupported_transform`.
+
+### 1.4 Refusal versus conversion, in one table
+| situation | decision |
+|---|---|
+| any invertible affine on the source (translate, scale, rotate, shear) | convert (exact), never refuse |
+| `RegionOf` shapes layer with a different transform than the image | convert through world (1.2.3) |
+| multiscale image | level 0; transform is the layer's |
+| non-invertible transform, or axes that cannot be expressed | refuse `frame_unsupported_transform` |
+| selection on several planes, or on a plane other than the exported one | refuse (1.2.5, 1.2.7) |
+| source layer removed, image closed or changed during the run | outputs kept, not drawn: `target_unavailable` (section 4) |
+| source is a file | pixel frame of the file (1.3), never another image |
+
+New host-side codes `frame_unsupported_transform`, `selection_mixed_planes`, `selection_plane_mismatch`, `target_unavailable` go into `host_internal_codes` of the conformance file; wording is one sentence naming the source and the reason, always followed by `(nothing was changed; files are in <path>)` when files exist.
+
+### 1.5 Fixtures: coordinate frame
+Base image `ASYM`: uint16, 8 rows by 12 columns, `value(y, x) = 100*y + x`. Rectangles have vertices on half pixels, so no pixel centre lies on an edge. `world` is Napari only; `target_px` is `c - 0.5` on the target image in its own full-resolution data pixels (so Fiji and QuPath draw at `target_px + 0.5`), the check in every host.
+
+```json
+{
+  "wrong_science": {"coordinate": {
+    "image": {"id": "ASYM", "shape": [8, 12], "dtype": "uint16", "value": "100*y + x"},
+    "rect": [[1.5, 2.5], [1.5, 5.5], [3.5, 5.5], [3.5, 2.5]],
+    "rect_mask_pixels": [[2,3],[2,4],[2,5],[3,3],[3,4],[3,5]],
+    "rect_mask_values": [203, 204, 205, 303, 304, 305],
+    "cases": [
+      {"id": "CF-01", "name": "identity", "source": {},
+       "point": [2, 3], "expect": {"world": [2, 3], "target_px": [2, 3], "mask": "rect_mask_pixels"}},
+      {"id": "CF-02", "name": "translate only (scale equal, origin different)",
+       "source": {"translate": [100, 0]}, "shapes_layer": {"translate": [0, 0], "vertices_world": "rect + [100, 0]"},
+       "point": [2, 3], "expect": {"world": [102, 3], "target_px": [2, 3], "mask": "rect_mask_pixels"}},
+      {"id": "CF-03", "name": "scale and translate",
+       "source": {"scale": [0.5, 0.25], "translate": [10, 20]},
+       "point": [2, 3], "expect": {"world": [11.0, 20.75], "target_px": [2, 3]}},
+      {"id": "CF-04", "name": "rotation by 90 degrees",
+       "source": {"affine": [[0,-1,0],[1,0,0],[0,0,1]]},
+       "shapes_layer": {"vertices_world": [[-2.5,1.5],[-5.5,1.5],[-5.5,3.5],[-2.5,3.5]]},
+       "point": [2, 3], "expect": {"world": [-3, 2], "target_px": [2, 3], "mask": "rect_mask_pixels"}},
+      {"id": "CF-05", "name": "shear",
+       "source": {"affine": [[1,0.5,0],[0,1,0],[0,0,1]]},
+       "point": [2, 4], "expect": {"world": [4, 4], "target_px": [2, 4]}},
+      {"id": "CF-06", "name": "multiscale, level 0 carries the transform",
+       "source": {"levels": [[8,12],[4,6]], "translate": [100, 0]},
+       "point": [2, 3], "expect": {"world": [102, 3], "export_shape": [8, 12]}},
+      {"id": "CF-07", "name": "file input with a decoy open image",
+       "inputs": {"image": {"file": "ASYM.tif"}}, "open_image": {"id": "DECOY", "translate": [100, 0]},
+       "point": [2, 3], "expect": {"target": "file:ASYM.tif", "napari_world": [2, 3],
+         "decoy_gets_nothing": true, "fiji_new_window_titled": "ASYM.tif", "qupath": "table_and_file"}},
+      {"id": "CF-08", "name": "earlier output must not become the target",
+       "sequence": ["run A -> ImageOut shown", "run B (file input) -> PointsOut ApplyTo"],
+       "expect": {"target": "file:ASYM.tif", "last_shown_image_gets_nothing": true}},
+      {"id": "CF-09", "name": "QuPath crop offset",
+       "source": {"server_wh": [12, 8]}, "selection_annotation": {"x": [4, 10], "y": [2, 6], "plane": [0, 0]},
+       "expect": {"export_offset_yx": [2, 4], "export_shape": [4, 6], "export_value_0_0": 204, "export_value_3_5": 509,
+                  "regionof_mask": "all ones, shape [4, 6]"},
+       "point": [1, 2], "result_expect": {"target_px": [3, 6]}},
+      {"id": "CF-10", "name": "QuPath planes",
+       "source": {"z": 2, "t": 1}, "viewer": {"z": 0, "t": 0},
+       "variants": [
+         {"selection": [{"z": 0, "t": 0}], "expect": "run, results on z=0 t=0"},
+         {"selection": [{"z": 1, "t": 0}], "expect": "refuse selection_plane_mismatch"},
+         {"selection": [{"z": 0, "t": 0}, {"z": 1, "t": 0}], "expect": "refuse selection_mixed_planes"},
+         {"selection": [], "viewer": {"z": 1, "t": 0}, "export": "whole image", "expect": "exported plane z=1 t=0, results on z=1 t=0"},
+         {"point_without_t_z": true, "viewer": {"z": 1, "t": 0}, "expect": "lands on z=1 t=0, not on plane 0"}]},
+      {"id": "CF-11", "name": "size mismatch is stated",
+       "result": {"type": "labels", "shape": [4, 6], "apply_to": "image"}, "source_export_shape": [8, 12],
+       "expect": {"transform": "identity", "status_contains": "not aligned"}},
+      {"id": "CF-12", "name": "Replace recomputes the transform",
+       "sequence": ["labels result on source translate [100,0]", "Replace with result for source translate [0,0]"],
+       "expect": {"world_of_0_0": [0, 0]}},
+      {"id": "CF-13", "name": "non-invertible source transform",
+       "source": {"affine": [[0,0,0],[0,0,0],[0,0,1]]}, "expect": "refuse frame_unsupported_transform"},
+      {"id": "CF-14", "name": "QuPath downsample 2 and 4 (c = x0 + (x + 0.5) * d); needs a host that exports at d != 1",
+       "variants": [
+         {"server_wh": [24, 16], "downsample": 2, "offset_yx": [0, 0], "export_shape": [8, 12], "point": [2, 3], "expect": {"c_yx": [5.0, 7.0]}},
+         {"server_wh": [48, 32], "downsample": 4, "offset_yx": [0, 0], "export_shape": [8, 12], "point": [2, 3], "expect": {"c_yx": [10.0, 14.0]}},
+         {"server_wh": [48, 32], "downsample": 2, "offset_yx": [4, 8], "export_shape": [8, 12], "point": [2, 3], "expect": {"c_yx": [9.0, 15.0]}},
+         {"downsample": 1, "offset_yx": [0, 0], "point": [2, 3], "expect": {"c_yx": [2.5, 3.5]}}],
+       "unsupported_ok": "a host that only exports at downsample 1 reports the first three as unsupported, never as passed"}
+    ]}}
+}
+```
+Checks that every case also makes: the **worker's input file** (exported pixels equal `ASYM` or its crop, mask pixels equal `rect_mask_pixels`), the **actual drawn coordinates** (not only "no error"), and that nothing was drawn on any image other than `target`.
+
+---
+
+## 2. Calibration
+
+### 2.1 What "calibrated" means
+1. A source is **calibrated** only if the host can state a physical length per pixel **from explicit metadata**: a length unit plus a numeric size. The number alone (`1.0`, `0.25`) is never evidence, in either direction.
+2. **Unknown is a first-class value.** Pixel, empty, dimensionless or missing units give *unknown*, whatever the number. The host never assumes 1 um/px, and **a bare scale with default pixel units is unknown, never assumed to be um** (this removes the Napari behaviour recorded in HOST_PARITY C19).
+3. Explicit units win even when the scale is exactly 1: `1 micrometer` is 1.0 um/px; `1 millimeter` is 1000.0 um/px.
+4. Unit conversion is to **micrometres per pixel** (the contract of `PixelSizeOf`, SPEC_WAVE2 1.4). Length units known to the host: at least `um`, `micron(s)`, `micrometer/-metre`, `nm`, `mm`, `cm`, `m`, and the Angstrom (`Angstrom`, `angstrom`, U+00C5, U+212B; 1 Angstrom = 1e-4 um). The micro sign has three accepted spellings: U+00B5 (micro sign), U+03BC (Greek mu) and ASCII `u`, each followed by `m`. **U+FFFD (the replacement character, a damaged micro sign) followed by `m` is not accepted**: the result is unknown with the warning `unit text 'X' is damaged; enter the pixel size`.
+5. Anisotropic pixels (Y and X differ by more than 1e-3, relative to the larger) and non-length units give *unknown* plus a warning (`pixels are not square` / `unit 's' is not a length`); the scalar field is not filled (within the tolerance the field takes the mean of the X and Y sizes). **This is a behaviour change** in every host that fills the field from one axis today. Release-note line: *"A pixel size is no longer filled in automatically when the image's pixels are not square (X and Y differ by more than 0.1 %) or its unit is not a length; enter the pixel size yourself."*
+6. Sources: Napari layer `scale` + `units`; Fiji `Calibration` (`scaled()`, `getUnit()`, `pixelWidth`); QuPath `PixelCalibration` (`hasPixelSizeMicrons()`); a file input by its TIFF/OME metadata with a length unit (`ResolutionUnit` NONE is unknown). **TIFF resolution tags alone are not a calibration when they look like a default:** `ResolutionUnit` INCH or CENTIMETER with a resolution equal (within 0.5 %) to 72 or 96 dpi (28.35 or 37.80 per cm) is unknown, not 352.8 or 264.6 um/px. An ImageJ `unit=` or OME `PhysicalSizeX` unit in the file wins over the tags.
+
+### 2.2 The field, its states, and the transitions
+A `PixelSizeOf` field has one of three states: `unset`, `auto(source, value)`, `user(value)`. The state is kept by the host as a **flag set by user edit events**, never inferred by comparing the value with the last auto value. A programmatic set does not make it `user`.
+
+| event | state before | state after |
+|---|---|---|
+| source changes (image, file set or cleared, project image switched) and the new source is calibrated | `unset` or `auto` | `auto(new source, new value)` |
+| same, and the new source is **unknown** | `unset` or `auto` | `unset`, field **cleared**, tooltip `not calibrated: 'image' has no pixel size` |
+| source changes (any) | `user` | unchanged; the tooltip names the entered value and that it overrides the image |
+| person types or pastes a value | any | `user(value)` |
+| person clears the field, or presses "use the image's calibration" | any | `unset`, then re-derived from the current source (may become `auto` or stay `unset`) |
+| file input is set | any non-`user` | derived from the **file** (the file is the exported source and wins over the open image) |
+| file input is cleared | any non-`user` | derived from the open image again |
+
+Precedence of the source is the precedence of what is exported: file input first, then the chosen image (Fiji #26 asks the same for the initial prefill).
+
+### 2.3 Submitting, and what the request carries
+1. **Run is blocked while a required linked field (`PixelSizeOf`, and in Wave 2 `TimeIntervalOf`, `ZStepOf`) is `unset`.** Message: `'pixel_size' needs a value: 'image' has no pixel size. Enter it in um.` A declared default on a linked field is **not** used as a stand-in (it was written for an author's example image).
+2. `Optional[float]` linked field: `unset` sends `null`. Nothing is blocked.
+3. A value outside `(0, inf)` or not finite is refused as today.
+4. The request carries two things. The value in the manifest parameter, in um/px (unchanged). And a reserved input `_calibration`, like `_job_dir` and `_axes`, which tools never see. It is **per axis**, keyed by manifest parameter, with overall provenance:
+```json
+{"_calibration": {"pixel_size": {"of": "image", "source": "image|file|user",
+  "axes": {"x": {"value": 1.0, "unit": "um", "source": "image", "raw": {"scale": 1.0, "unit": "micrometer"}},
+           "y": {"value": 1.0, "unit": "um", "source": "image", "raw": {"scale": 1.0, "unit": "micrometer"}}}}}}
+```
+   `value` is in the canonical unit of the link (`um` per pixel for x, y and z; `s` for t); `unit` is that canonical unit; `source` is `image`, `file` or `user` per axis (an entered value is `user`); `raw` keeps the original scale and unit text when there was one. **Phase 1 fills `x` and `y` only** (a scalar `PixelSizeOf` needs an isotropic pair, 2.1.5); `z` (`ZStepOf`) and `t` (`TimeIntervalOf`) are added by Wave 2 with the same entry shape. The worker only copies the object into `run.json`; hosts write it into the run record too. A request with a `PixelSizeOf` value and no `_calibration` entry is a host bug and a test failure.
+5. CLI and notebook: the same rule. The value comes from `--pixel-size` / the argument, or from the file's own calibration if linking is implemented; otherwise the run fails with the sentence of 2.3.1. They never default silently.
+
+### 2.4 Fixtures: calibration
+Known answers (`um_per_px`, or `unknown`); the first run of the form must produce them **in the request**, not only in the field.
+
+| id | source | expected |
+|---|---|---|
+| CAL-01 | Napari scale (1,1), units (micrometer, micrometer) | 1.0, source image |
+| CAL-02 | Napari scale (1,1), units default (pixel) | unknown |
+| CAL-03 | Napari scale (1,1), units millimeter | 1000.0 |
+| CAL-04 | Napari scale (0.25,0.25), units pixel or none | unknown (never read as um) |
+| CAL-05 | 0.325 um, 325 nm, 0.000325 mm (any host) | 0.325 each (relative error < 1e-9) |
+| CAL-06 | scale (0.5, 0.25), units um | unknown + `not square` warning |
+| CAL-07 | scale (1,1), units second | unknown + `not a length` warning |
+| CAL-08 | Fiji unit `micron`, pixelWidth 1.0 / unit `pixel`, width 1.0 / unit empty | 1.0 / unknown / unknown |
+| CAL-09 | QuPath `hasPixelSizeMicrons()` true with 1.0 / false | 1.0 / unknown |
+| CAL-10 | TIFF with ImageJ `unit=micron` spacing 1.0 / no resolution tags / `ResolutionUnit` NONE | 1.0 / unknown / unknown |
+| CAL-11 | TIFF `ResolutionUnit` INCH, 72 dpi, no ImageJ/OME unit | unknown (not 352.78) |
+| CAL-12 | TIFF `ResolutionUnit` INCH, 96 dpi, no ImageJ/OME unit | unknown (not 264.58) |
+| CAL-13 | TIFF `ResolutionUnit` CENTIMETER, 28.35 and 37.80 per cm, no unit text | unknown, unknown |
+| CAL-14 | TIFF `ResolutionUnit` INCH, 25400 dpi (not default-looking), no unit text | 1.0, source file |
+| CAL-15 | unit text `"\u00B5m"` (micro sign), `"\u03BCm"` (Greek mu), `"um"`, each with scale 0.5 | 0.5 for all three |
+| CAL-16 | unit text `"\uFFFDm"`, scale 0.5 | unknown + `damaged` warning |
+| CAL-17 | unit text `"Angstrom"`, `"\u00C5"`, `"\u212B"`, scale 1.0 | 0.0001 each |
+| CAL-18 | scale (0.5, 0.5004) um / scale (0.5, 0.5006) um | 0.5002 (difference 8e-4 is within 1e-3, the field takes the mean of x and y) / unknown + warning (difference 1.2e-3) |
+
+Transitions (each asserts the field **and** the request/worker input):
+
+| id | sequence | expected |
+|---|---|---|
+| CAL-T1 | A (0.25) -> B (0.5) | field 0.5, request 0.5, source image of B |
+| CAL-T2 | A (0.25) -> uncalibrated B | field empty, run blocked with 2.3.1; Optional: request `null`; A's value is in no request |
+| CAL-T3 | A (0.25), person types 0.3, switch to B (0.5) | 0.3, source user |
+| CAL-T4 | state user(0.3), person clears field, source B (0.5) | auto 0.5 |
+| CAL-T5 | open image A (0.25), file B uncalibrated | unset, run blocked (not A's value) |
+| CAL-T6 | CAL-T5, then file cleared | auto 0.25 (A) |
+| CAL-T7 | QuPath project image A -> file image uncalibrated | unset |
+| CAL-T8 | required linked field with default 1.0, source unknown | blocked, the default is not sent |
+| CAL-T9 | user types 0.25 equal to the last auto value, then switch to uncalibrated B | stays 0.25, source user (flag, not comparison) |
+
+---
+
+## 3. Retention under `LC_HOME`
+
+### 3.1 Who does what
+1. **Hosts never prune and never delete anything under `<LC_HOME>/results` or `<LC_HOME>/runs`.** Napari, Fiji and QuPath only *create* folders there and write two marker files (3.2). There is no retention code in any host.
+2. **Only Tools prunes**: the reference `labconstrictor_tools.retention` and the CLI command `labconstrictor-tools prune [--root results|runs|all] [--dry-run]`. One implementation, in Python, so there is one policy and one place to test it.
+3. **How a host triggers cleanup.** After a host has written `.lc-done.json` it starts `labconstrictor-tools prune` **in a subprocess** (user-approved), detached: it does not wait, ignores the exit code, logs a failure to the shared log, and a failure never fails or delays the run. The executable is the one in the app's worker environment (the same environment that runs the tools). A CLI run calls `prune` itself after writing its done file.
+4. **GUI-only users get cleanup through the Tools CLI.** Nobody has to open a terminal: the host's subprocess is what runs it. If the subprocess cannot start, folders accumulate; **no host falls back to deleting them itself**.
+5. Never touched by `prune`: `--out` folders, `state`, `logs`, and anything outside the two roots. Temporary job folders of a host live outside `LC_HOME` and are the host's own (3.4).
+
+### 3.2 Markers, written by hosts and the CLI
+`.lc-owner.json` is written first, when the folder is created: `{"lc_marker": 1, "kind": "result|run", "name": "<folder name>", "host": "cli|napari|fiji|qupath|notebook", "pid": 1234, "created": "2026-10-12T09:30:00.123Z", "token": "<uuid4>"}`. `.lc-done.json` is written last, atomically (temp file then rename): `{"finished": "<UTC ISO-8601>", "status": "ok|failed|cancelled"}`. A half-written folder has no done file and is therefore never eligible. Result folders are named `<YYYYMMDDTHHMMSS>_<6 hex>_<app>_<tool>` (slug of `A-Za-z0-9_.-`) in every host; run records may use any slug (Fiji's millisecond stamp stays). The name is a convenience; the marker is the authority.
+
+### 3.3 What `prune` may delete
+Only two roots are ever pruned: `<LC_HOME>/results` and `<LC_HOME>/runs`. An entry is **eligible** only if **all** hold:
+1. a direct child of the root, name made of `A-Za-z0-9_.-`, a real directory by `lstat` (not a symlink, not a Windows junction or other reparse point), and its real path's parent is the real path of the root;
+2. it has a valid `.lc-owner.json` (`lc_marker` 1, right `kind`, `name` equal to the folder name, so a copied or renamed folder is foreign);
+3. it has `.lc-done.json`;
+4. `prune` holds the retention lock (3.5).
+
+Never eligible: foreign folders (any name, even `20261008T120000_reanalysis_backup`), **legacy folders from older versions (no marker)**, folders with no done file (active or crashed), symlinks, junctions, files.
+
+Counting: `RESULTS_KEPT = 20`, `RUN_RECORDS_KEPT = 50`, counted over **eligible** entries only (foreign, legacy and active ones do not use up the quota and are never evicted to make room), ordered by `created` in the owner file then by name, not by directory name. Delete = rename to `.lc-deleting-<token>` inside the root, then remove without following links inside it; a leftover `.lc-deleting-*` that passes (2) is removed at the next prune. A folder a host reported to the person as holding a result is eligible like any other once it is past the quota; hosts therefore keep the reported path in the run record, and the status says that older results are cleaned up by `labconstrictor-tools prune`.
+
+### 3.4 Files a host reports, and temporary job folders (not pruning)
+Temporary job folders outside `LC_HOME` (Napari `lcin_*`, Fiji `lcjob_fiji_*`, notebook `lcnb_*`) are the host's own and the host may delete them. **Before deleting**, the host moves every output file it will report (a `FileOut` inside the job folder; an image or labels result it did not or could not display) into an owned folder `<LC_HOME>/results/...` (3.2) and reports **that** path, so a reported path never points into a folder about to be deleted. Files outside the job folder are never moved or modified. Cancelled and failed runs still remove their temporary folder (their owned folder, if one was made, gets `.lc-done.json` `failed` / `cancelled`). The notebook stops leaving `lcnb_*` for ever by using the same owned folder.
+
+### 3.5 Concurrency (Tools only)
+`prune` takes one exclusive, non-blocking lock on `<LC_HOME>/.retention.lock`, implemented once in `labconstrictor_tools.retention`. If it cannot take the lock it exits 0 without deleting (another prune is running, or the share does not support locks). Creation needs no lock: owner first, done last. Several hosts starting `prune` at once is therefore safe.
+
+### 3.6 Where the reference changes
+| today | rule |
+|---|---|
+| CLI: start-anchored `^\d{8}T\d{6}_`, prunes before creating (Tools #55) | `retention.prune` after done, marker-based (3.3); CLI `prune` command |
+| `runs._prune`: every sub-folder | `retention.prune(root, "run", 50)`, eligible only |
+| Fiji `writeRunRecord`: prunes every sub-folder | no pruning; writes markers; starts `prune` (3.1.3) |
+| QuPath `newJobDir`: deletes every sub-folder beyond 20 | no pruning; adopts the CLI folder name (HOST_PARITY L01), markers, `prune` |
+| Napari / Fiji `rmtree(job_dir)` | allowed outside `LC_HOME`, after 3.4 |
+
+### 3.7 Fixtures: retention
+All use a temporary `LC_HOME`; every survivor is checked **by file contents** (a sentinel file with fixed bytes), not only by count. `done(n)` = n owned folders with both markers, `created` increasing. **Windows note:** a plain symlink needs administrator rights or developer mode; a directory junction is made with `mklink /J`. RET-05 creates a symlink and, on Windows, also a junction; if a link kind cannot be created the fixture reports `unsupported` for it, never `pass`.
+
+**A. Prune eligibility (run against the Tools reference `retention.prune` and the CLI `prune`; not a host test)**
+
+| id | setup | action | expected |
+|---|---|---|---|
+| RET-01 | foreign `results/20261008T120000_reanalysis_backup/x.txt` ("keep") + done(300) | `prune` after each | foreign folder and `x.txt` intact; exactly 20 owned remain, the newest 20 by `created` |
+| RET-02 | foreign `runs/0000_keep_this_analysis/x.txt` + done(120) | `prune --root runs` | foreign intact; exactly 50 owned |
+| RET-03 | 25 results with no `.lc-done.json` | `prune` | all 25 present, with files |
+| RET-04 | done(30) | `prune` | the 20 latest by `created` remain |
+| RET-05 | `results/<valid name>` is a symlink (and on Windows a junction) to `outside/` holding an owner marker and done file; 40 owned | `prune` | link and all of `outside/` intact |
+| RET-06 | owned folder copied and renamed (marker `name` differs) | `prune` | not deleted |
+| RET-07 | 30 legacy folders (valid names, no marker) + done(25) | `prune` | all 30 legacy remain; 20 owned remain |
+| RET-08 | done(100); four `prune` processes started at once (CLI only) | concurrently | exactly 20 owned remain; no foreign entry lost; every process exits 0 |
+| RET-09 | lock held by another process | `prune` | exits 0, deletes nothing |
+| RET-12 | owned crashed folder (no done file) + done(30) | `prune` | the crashed folder survives |
+| RET-13 | two equal `created` values | `prune` | order by `created` then name, deterministic |
+
+**B. Hosts never delete (Napari, Fiji, QuPath, notebook; the real host, with the `prune` subprocess replaced by a recorder)**
+
+| id | setup | action | expected |
+|---|---|---|---|
+| HRET-01 | foreign `results/20261008T120000_reanalysis_backup/x.txt` and foreign `runs/0000_keep_this_analysis/x.txt` | the host does 60 runs | both foreign folders and `x.txt` intact |
+| HRET-02 | done(60) owned results and done(120) owned run records already present | the host does 5 runs | none of the old folders is gone (counts only grow) |
+| HRET-03 | none | one run | the folder has a valid `.lc-owner.json` (name equals folder name) and, after the run, a valid `.lc-done.json` with the right status |
+| HRET-04 | `prune` replaced by a recorder, then by a command that fails | one run each | the recorder saw `labconstrictor-tools prune` started after the done file exists; a failing command does not fail the run |
+| RET-10 | job folder with `report.txt` ("data") returned as `FileOut` | run to success, close the widget | reported path exists under `results/`, contents "data"; job folder gone |
+| RET-11 | failed or cancelled run | finish | temporary job folder removed; an owned folder, if any, has `failed` / `cancelled` |
+| RET-14 | undisplayable (over the display limit) `ImageOut` | run | file stays at a stable owned path, the path is shown |
+
+---
+
+## 4. Run identity
+
+1. **Snapshot at run start, on the UI thread, before any worker call.** The host builds one immutable record and carries it through export, worker call and result placement: `run_id` (uuid4), `app`, `tool`, parameter values, calibration states (2.3), and for every `Image` / `Labels` / `RegionOf` input the **source identity** and **frame** (1.1.2): the selected selection geometry copied by value (vertices, planes), not a live reference.
+2. **Source identity is an object, not a label.** Napari: the layer object (not its name). Fiji: the `ImagePlus` object and its window id (not its title). QuPath: the `ImageData` object plus project entry id. A chooser text such as `Current image: slide A` and the prefix test `startsWith("Current image")` are never identity.
+3. **Export reads the snapshot.** Changing the active image, layer selection or selected annotations after the click cannot change what is exported or which selection is used.
+4. **Placement checks identity first.** Results are placed only if the source is the same object, still open (Napari: still in `viewer.layers`; Fiji: window still open; QuPath: the same `ImageData` still accessible), and its exported shape is unchanged. If so the host applies the **current** transform of that same layer (so the result follows the layer), through 1.1.3. If not, `target_unavailable`: outputs are kept, nothing is drawn on another image, and the status says `run <run_id> on 'A': 'A' is no longer open; results are in <path>`.
+5. **Output metadata binds to the snapshot, not the widget.** The app and tool recorded on a result (layer metadata, window property, annotation property, run record) come from the snapshot; a tool or app change while running cannot rebind them. Every result drawn carries `run_id`.
+6. Fixtures:
+
+| id | sequence | expected |
+|---|---|---|
+| RUN-01 | start on A (delayed tool), activate B, tool returns points | nothing on B; `target_unavailable` if A is gone, else points on A |
+| RUN-02 | start on A with a selection, change the selection during export | exported crop and mask are those of the click |
+| RUN-03 | start tool X, switch the widget to tool Y while running | result metadata app/tool are X's |
+| RUN-04 | start on A, close A | outputs kept, status names `run_id` and path, no exception |
+| RUN-05 | Napari: layer A is moved (translate changed) during the run | points follow A's transform at placement |
+| RUN-06 | two runs in a row on A then B | each result carries its own `run_id` and lands on its own source |
+
+---
+
+## 5. Asynchronous lookups (`ChoicesFrom`)
+
+1. **Identity of a lookup.** Every request captures `(form_gen, app, tool, param, deps, request_id)`.
+   `form_gen` is a **process-wide monotonic integer that is never reset**; it increases whenever a form is built or destroyed (app change, tool change, widget close). `request_id` is a monotonic integer per widget, never reset. `deps` is the serialised snapshot of the values the lookup depends on (including the source image identity and calibration if it uses them).
+2. **A reply is applied only if all of these still hold at reply time:** `form_gen` equals the current one; `app` and `tool` equal the current ones; `request_id` is the latest issued for `param`; `deps` equals the dependencies **now** (recomputed, not remembered). Otherwise it is dropped, including its error and tooltip.
+3. **A dependency change invalidates immediately.** The moment a dependency changes, the parameter's latest `request_id` is advanced and its choices marked pending; the debounce (400 ms) only delays the new request, it does not delay the invalidation.
+4. **Bounded work.** At most one lookup is in flight per widget (per host window). Pending lookups are coalesced: one pending slot per parameter, a newer request replaces an older pending one; at most 8 pending in all (oldest dropped and logged). A lookup that exceeds 60 s is cancelled and its worker discarded. No unbounded thread creation: one worker thread (executor) per widget.
+5. **One owner for the worker.** A single controller per window owns the worker cache; every start, reuse, release, reap and close goes through it (one lock, or one thread). Each job (run or lookup) captures the worker instance and its app at submission and uses only that one. A lookup never uses or replaces a worker held by a running tool; while a run is active, lookups wait (existing retry, 1500 ms). An app switch during a run never replaces the run's worker; the new app's worker is created after the run ends.
+6. **Shutdown.** On widget close: set `closed`, drop pending lookups, cancel the in-flight one, close workers within the close timeout (10 s, HOST_PARITY K03), then kill. A worker created after `closed` was set is closed by the thread that created it. After close there are no live workers and no live threads of the widget.
+7. Fixtures (deterministic barriers; the delayed source tool blocks on an event the test releases):
+
+| id | sequence | expected |
+|---|---|---|
+| ASY-01 | tool A and B both have `ChoicesFrom` param `mode`; A's lookup is delayed; switch to B; release A | B's dropdown shows only B's choices; displayed choices and value checked |
+| ASY-02 | change the dependency of `mode`, release the old reply before the debounce fires | old reply dropped; `mode` is pending, not showing old choices |
+| ASY-03 | A's lookup fails after switch to B | no tooltip or error on any B field |
+| ASY-04 | change a dependency 50 times in 1 s | at most 1 in flight, at most 1 pending per param; worker processes started <= 1 |
+| ASY-05 | two parameters each with `ChoicesFrom`, both lookups requested at once | one worker process; each reply goes to its own control |
+| ASY-06 | start a run, switch app, request a lookup | run uses its worker to the end; the lookup runs after, in the new app's worker |
+| ASY-07 | close the widget with a lookup in flight | no worker process or thread of the widget alive afterwards; no worker created after close survives |
+| ASY-08 | interleave acquire/release/reap/close from three threads with barriers | cache consistent (each worker owned once), no double close |
+
+---
+
+## 6. Number limits for form fields
+1. A form field with no declared `Min` / `Max` accepts integers up to **+-(2^53 - 1) = +-9007199254740991** (the largest integer every double and every JSON number holds exactly) and floats up to **+-1e15**. This replaces the `+-(2^31-1)` and `+-1e9` limits of HOST_PARITY A06, A07.
+2. A typed, pasted or macro value beyond a limit (declared or default) is **refused, never clamped**: no run starts, nothing is sent, the message names the field and the limit: `'L' must be <= 9007199254740991` (or `>= -9007199254740991`), the worker templates of HOST_PARITY I06. A GUI box that cannot hold such a number uses a text-backed or `long` / `double` widget; it must not silently shorten a value.
+3. Conformance key `limits.form_integer_max = 9007199254740991` (replaces `unbounded_integer`), and `limits.unbounded_float = 1e15`.
+4. Fixture per host (Napari, Fiji dialog, Fiji macro, QuPath, notebook; the CLI is the worker's reference): `NUM-01` typed `9007199254740991` is accepted and the request carries exactly that integer; `NUM-02` typed `9007199254740992` is refused with the message above, no clamp (the value never becomes `9007199254740991` or `2147483647`), no run, no request; `NUM-03` typed `-9007199254740992` likewise; `NUM-04` float `1e15` accepted, `1.0000000000000002e15` refused; `NUM-05` a declared `Max` of 10 refuses 11 (unchanged).
+
+---
+
+## 7. Order of work and acceptance
+1. Tools PR: `retention` module and CLI `prune` (3.1-3.5), fixtures from sections 1-6 in `conformance.json` (`wrong_science`), new `host_internal_codes`, the per-axis `_calibration` reserved input (2.3.4), `PixelSizeOf` wording in AUTHORING.md and PROTOCOL.md, the number limits. Replaces HOST_PARITY L01-L03 and H05.
+2. One PR per host, each closing the issues in the table at the top and running its themes' fixtures through a real GUI or harness (never only the helper function).
+3. Tools #87 imports `wrong_science` as its first known-answer fixtures; Napari #31-#38, Fiji #26-#30 and QuPath #14-#21 become regressions when fixed.
+
+## 8. Decisions and follow-ups
+Decided by the maintainers:
+* A linked pixel-size field with an unknown source blocks the run (2.3.1; SPEC_WAVE2 1.4 amended).
+* A bare scale with default pixel units is unknown, never assumed um (2.1.2).
+* QuPath refuses an ROI on another plane and never switches the viewer (1.2.7).
+* Legacy unmarked folders are never auto-deleted (3.3).
+* **Hosts never prune.** Hosts write markers and start `labconstrictor-tools prune` in a subprocess; only Tools deletes (3.1).
+* Form integers up to +-(2^53-1), floats +-1e15; beyond is refused, never clamped (section 6).
+* The per-axis `_calibration` shape (x, y, z, t; phase 1 fills x, y) is final.
+
+Follow-up item: an explicit `labconstrictor-tools clean --legacy` command with a dry run (lists, then deletes only on confirmation). Not part of this wave.
+
+Working decisions, **default, not yet confirmed**:
+1. Fiji with a file source opens the file in its own window; QuPath uses table plus file (1.3). (default, not yet confirmed)
+2. Napari with a file source: pixel-frame layer only, no extra image layer (1.3). (default, not yet confirmed)
+3. Napari lower-dimensional results on N-D sources only when dropped axes do not move the plane; confirm in Wave 2 (1.3). (default, not yet confirmed)
+4. Crashed runs (no `.lc-done.json`) are never pruned (3.3). (default, not yet confirmed)
+5. Retention quota counts only eligible folders (3.3). (default, not yet confirmed)
+6. Lookup limits: one in flight, 8 pending, 60 s timeout (section 5). (default, not yet confirmed)
+7. `prune` skips silently when it cannot take the lock, e.g. on a network share (3.5). (default, not yet confirmed)
+8. Napari snapshot identity is the object reference plus a still-in-`viewer.layers` check, not names or `unique_id` (section 4). (default, not yet confirmed)
+9. A damaged micro sign (U+FFFD + `m`) is unknown with a warning, not read as um (2.1.4). (default, not yet confirmed)
+10. TIFF resolution tags equal to 72 or 96 dpi (within 0.5 %) count as unknown (2.1.6). (default, not yet confirmed)