diff --git a/crates/core/src/types/mod.rs b/crates/core/src/types/mod.rs
index e21f75110..297d701e1 100755
--- a/crates/core/src/types/mod.rs
+++ b/crates/core/src/types/mod.rs
@@ -42,7 +42,9 @@ pub use key_schema::{
     ScalarAttributeType, TableKeyInfo, VectorIndexKeyInfo, hash_key_elements,
     is_multipart_key_schema, partition_indexes, range_key_elements,
 };
-pub use query::{Condition, QueryInput, QueryOutput, ScanInput, ScanOutput, Select};
+pub use query::{
+    Condition, QueryInput, QueryOutput, ScanInput, ScanOutput, Select, saturated_int32,
+};
 pub use stream::{
     DescribeStreamInput, DescribeStreamOutput, GetRecordsInput, GetRecordsOutput,
     GetShardIteratorInput, GetShardIteratorOutput, ListStreamsInput, ListStreamsOutput,
diff --git a/crates/core/src/types/query.rs b/crates/core/src/types/query.rs
index d9aeaf345..70cb53186 100755
--- a/crates/core/src/types/query.rs
+++ b/crates/core/src/types/query.rs
@@ -142,15 +142,30 @@ pub struct ScanInput {
         deserialize_with = "crate::serde_helpers::deserialize_expression_values"
     )]
     pub expression_attribute_values: Option<HashMap<String, AttributeValue>>,
-    #[serde(rename = "Limit")]
+    /// Any JSON number; see [`saturated_int32`].
+    #[serde(
+        rename = "Limit",
+        default,
+        deserialize_with = "deserialize_int32_field"
+    )]
     pub limit: Option<i64>,
     #[serde(rename = "ExclusiveStartKey")]
     pub exclusive_start_key: Option<Item>,
     #[serde(rename = "Select")]
     pub select: Option<Select>,
-    #[serde(rename = "Segment")]
+    /// Any JSON number; see [`saturated_int32`].
+    #[serde(
+        rename = "Segment",
+        default,
+        deserialize_with = "deserialize_int32_field"
+    )]
     pub segment: Option<i64>,
-    #[serde(rename = "TotalSegments")]
+    /// Any JSON number; see [`saturated_int32`].
+    #[serde(
+        rename = "TotalSegments",
+        default,
+        deserialize_with = "deserialize_int32_field"
+    )]
     pub total_segments: Option<i64>,
     #[serde(rename = "ConsistentRead")]
     pub consistent_read: Option<bool>,
@@ -168,6 +183,41 @@ pub struct ScanInput {
     pub conditional_operator: Option<ConditionalOperator>,
 }
 
+/// The value the service validates and uses for a `Scan` `Limit`, `Segment`
+/// or `TotalSegments` written as `number`: a fraction is truncated toward zero
+/// and a value outside the int32 range is saturated to the nearer bound.
+///
+/// Measured 2026-10-25 (us-east-1): `Limit: 1.5` and `Limit: 1.0` return one
+/// item, `Limit: 1e2`, `Limit: 2147483648` and `Limit: 9223372036854775808`
+/// are accepted, `Segment: 1.5` of `TotalSegments: 2` returns the items of
+/// segment 1, `Limit: 0.0` is reported as `0`, `Limit: -2147483649` as
+/// `-2147483648` and `TotalSegments: 2147483648` as `2147483647`. Measured
+/// 2026-10-30 12:40 UTC: `Limit: -1.5` is reported as `-1`, and `Limit: -0.5`
+/// and `Limit: -0` as `0`.
+#[must_use]
+pub fn saturated_int32(number: &serde_json::Number) -> i32 {
+    if let Some(value) = number.as_i64() {
+        return i32::try_from(value).unwrap_or(if value < 0 { i32::MIN } else { i32::MAX });
+    }
+    if number.is_u64() {
+        return i32::MAX;
+    }
+    // A float: `as` truncates toward zero and saturates at the int32 bounds.
+    #[allow(clippy::cast_possible_truncation)]
+    number.as_f64().map_or(0, |value| value as i32)
+}
+
+/// Deserialize an optional `Scan` range field from any JSON number, as
+/// [`saturated_int32`] reads it. A JSON value of another type is refused, as
+/// it was when the field deserialized as an integer.
+fn deserialize_int32_field<'de, D>(deserializer: D) -> Result<Option<i64>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    Option::<serde_json::Number>::deserialize(deserializer)
+        .map(|number| number.map(|n| i64::from(saturated_int32(&n))))
+}
+
 /// `Scan` response body.
 #[derive(Debug, Clone, Serialize)]
 pub struct ScanOutput {
@@ -183,3 +233,71 @@ pub struct ScanOutput {
     #[serde(rename = "ConsumedCapacity", skip_serializing_if = "Option::is_none")]
     pub consumed_capacity: Option<ConsumedCapacity>,
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::{ScanInput, saturated_int32};
+
+    fn number(text: &str) -> serde_json::Number {
+        serde_json::from_str(text).expect("a JSON number")
+    }
+
+    #[test]
+    fn range_fields_are_truncated_and_saturated_to_int32() {
+        for (text, expected) in [
+            ("1", 1),
+            ("-2147483648", i32::MIN),
+            ("2147483647", i32::MAX),
+            ("-2147483649", i32::MIN),
+            ("2147483648", i32::MAX),
+            ("9223372036854775808", i32::MAX),
+            ("-9223372036854775809", i32::MIN),
+            ("1.5", 1),
+            ("1.0", 1),
+            ("0.0", 0),
+            ("-1.5", -1),
+            ("-0.5", 0),
+            ("-0", 0),
+            ("1e2", 100),
+            ("1e40", i32::MAX),
+            ("-1e40", i32::MIN),
+        ] {
+            assert_eq!(saturated_int32(&number(text)), expected, "{text}");
+        }
+    }
+
+    #[test]
+    fn scan_input_reads_any_number_in_the_range_fields() {
+        let input: ScanInput = serde_json::from_value(json!({
+            "TableName": "t", "Limit": 1.5, "Segment": 1.5, "TotalSegments": 2_147_483_648_i64,
+        }))
+        .expect("accepted");
+        assert_eq!(
+            (input.limit, input.segment, input.total_segments),
+            (Some(1), Some(1), Some(i64::from(i32::MAX)))
+        );
+        let input: ScanInput = serde_json::from_str(
+            r#"{"TableName": "t", "Limit": 9223372036854775808, "Segment": null}"#,
+        )
+        .expect("accepted");
+        assert_eq!(
+            (input.limit, input.segment),
+            (Some(i64::from(i32::MAX)), None)
+        );
+        let input: ScanInput = serde_json::from_value(json!({"TableName": "t"})).expect("accepted");
+        assert_eq!(input.total_segments, None);
+        // Another JSON type is still refused.
+        for body in [
+            json!({"TableName": "t", "Limit": "1"}),
+            json!({"TableName": "t", "Segment": true}),
+            json!({"TableName": "t", "TotalSegments": [1]}),
+        ] {
+            assert!(
+                serde_json::from_value::<ScanInput>(body.clone()).is_err(),
+                "{body}"
+            );
+        }
+    }
+}
diff --git a/crates/engine/src/query_key_values.rs b/crates/engine/src/query_key_values.rs
index 42d10ee79..6948b5db1 100644
--- a/crates/engine/src/query_key_values.rs
+++ b/crates/engine/src/query_key_values.rs
@@ -119,6 +119,16 @@ fn query_request_checks(body: &Value) -> Result<(), DynamoDbError> {
     if let Some(limit) = body.get("Limit").and_then(Value::as_i64)
         && limit < 1
     {
+        // Beside a value that is not one AttributeValue the service answers
+        // its older form, with the value echoed (measured 2026-10-25 12:56 UTC
+        // on Query and Scan, and 2026-10-31 for the key and the lists).
+        if has_unreadable_attribute_value(body, QUERY_CONDITIONS) {
+            return Err(DynamoDbError::ValidationException(format!(
+                "1 validation error detected: Value '{}' at 'limit' failed to satisfy constraint: \
+                 Member must have value greater than or equal to 1",
+                limit.clamp(i64::from(i32::MIN), i64::from(i32::MAX))
+            )));
+        }
         return Err(DynamoDbError::ValidationException(
             LIMIT_BELOW_ONE.to_owned(),
         ));
@@ -194,6 +204,87 @@ pub(crate) fn non_empty(body: &Value, field: &str) -> bool {
     }
 }
 
+/// The type descriptors an AttributeValue may carry.
+const TYPE_DESCRIPTORS: &[&str] = &["S", "N", "B", "SS", "NS", "BS", "M", "L", "NULL", "BOOL"];
+
+/// The legacy condition maps of `Scan` whose `AttributeValueList` entries
+/// [`has_unreadable_attribute_value`] reads.
+pub(crate) const SCAN_CONDITIONS: &[&str] = &["ScanFilter"];
+
+/// The legacy condition maps of `Query` whose `AttributeValueList` entries
+/// [`has_unreadable_attribute_value`] reads.
+pub(crate) const QUERY_CONDITIONS: &[&str] = &["KeyConditions", "QueryFilter"];
+
+/// Whether the request holds an object that is not one AttributeValue: empty,
+/// with a type descriptor the service does not have (a lower-case `s`
+/// included), or with more than one, at the top or as a member of an `L` or
+/// `M` at any depth. The values read are the `ExpressionAttributeValues`
+/// entries, the `ExclusiveStartKey` values and the `AttributeValueList`
+/// entries of the `conditions` maps. Beside such a value the service reports a
+/// range fault in its older form, and beside a readable value, of the wrong
+/// type for a key or not, the newer form.
+///
+/// Measured on 2026-10-25 at 12:56 UTC: `Limit: 0` beside an entry `{}`,
+/// `{"X": "1"}` or `{"S": "x", "N": "1"}` answers `Value '0' at 'limit'` on
+/// Query and Scan, and beside an empty or duplicate `NS` the newer form. On
+/// 2026-10-30 at 12:40 UTC on Scan and 2026-10-31 at 12:36 UTC on Query:
+/// beside an entry `{"L": [{}]}`, `{"M": {"k": {"X": "1"}}}` or `{"s": "x"}`,
+/// the older form. On 2026-10-31 between 23:54 and 23:56 UTC: beside `{}` or
+/// `{"X": "1"}` as an `ExclusiveStartKey` value or a `ScanFilter`
+/// `AttributeValueList` entry on Scan, and `{}` as an `ExclusiveStartKey`
+/// value or a `KeyConditions` or `QueryFilter` `AttributeValueList` entry on
+/// Query, the older form, for a `Segment` fault too; beside `{"N": "1"}` as
+/// the value of an `S` key, `{"N": "1"}` in a `ScanFilter` list and `{"S":
+/// "p0"}` in a `KeyConditions` list, the newer form. An `L` or `M` member of
+/// an `ExclusiveStartKey` value or of a list entry is read as one of an
+/// `ExpressionAttributeValues` entry is; that is not measured.
+///
+/// A value that is not an object is a shape fault, reported ahead of the
+/// checks.
+pub(crate) fn has_unreadable_attribute_value(body: &Value, conditions: &[&str]) -> bool {
+    let in_map = |field: &str| {
+        body.get(field)
+            .and_then(Value::as_object)
+            .is_some_and(|values| values.values().any(is_unreadable_attribute_value))
+    };
+    let in_lists = |field: &&str| {
+        body.get(*field)
+            .and_then(Value::as_object)
+            .is_some_and(|conditions| {
+                conditions.values().any(|condition| {
+                    condition
+                        .get("AttributeValueList")
+                        .and_then(Value::as_array)
+                        .is_some_and(|list| list.iter().any(is_unreadable_attribute_value))
+                })
+            })
+    };
+    in_map("ExpressionAttributeValues")
+        || in_map("ExclusiveStartKey")
+        || conditions.iter().any(in_lists)
+}
+
+/// Whether `entry` is an object that is not one AttributeValue, or an `L` or
+/// `M` with such a member; see [`has_unreadable_attribute_value`].
+fn is_unreadable_attribute_value(entry: &Value) -> bool {
+    let Some(descriptors) = entry.as_object() else {
+        return false;
+    };
+    let mut fields = descriptors.iter();
+    match (fields.next(), fields.next()) {
+        (Some((descriptor, value)), None) => match descriptor.as_str() {
+            "L" => value
+                .as_array()
+                .is_some_and(|members| members.iter().any(is_unreadable_attribute_value)),
+            "M" => value
+                .as_object()
+                .is_some_and(|members| members.values().any(is_unreadable_attribute_value)),
+            descriptor => !TYPE_DESCRIPTORS.contains(&descriptor),
+        },
+        _ => true,
+    }
+}
+
 /// Refuse the first `N` value in `ExpressionAttributeValues` (including `NS`
 /// members and values nested in `L` and `M`) that is not a number, with the
 /// bare numeric message: no `ExpressionAttributeValues contains invalid value`
diff --git a/crates/engine/src/query_key_values/tests.rs b/crates/engine/src/query_key_values/tests.rs
index 68c353943..56c5bf729 100644
--- a/crates/engine/src/query_key_values/tests.rs
+++ b/crates/engine/src/query_key_values/tests.rs
@@ -562,18 +562,33 @@ fn a_shape_fault_in_another_field_is_reported_ahead_of_the_checks() {
         Some(LIMIT_BELOW_ONE)
     );
 
-    // Neither does an unknown type descriptor, which the deserializer reports
-    // as a SerializationException: the service answers the Limit
-    // ValidationException (measured 2026-10-25), in its older
-    // `Value '0' at 'limit'` form; ExtendDB answers its usual Limit text.
-    let unknown_type = serde_json::json!({
-        "TableName": "t", "KeyConditionExpression": "pk = :p",
-        "Limit": 0, "ExpressionAttributeValues": {":p": {"S": "x"}, ":a": {"X": "1"}},
-    });
-    assert_eq!(
-        message(validate_query_request_body(&unknown_type)).as_deref(),
-        Some(LIMIT_BELOW_ONE)
-    );
+    // Neither does an entry the service cannot read as one AttributeValue (an
+    // unknown type descriptor, which the deserializer reports as a
+    // SerializationException, an empty one or one with two descriptors): the
+    // service answers the Limit ValidationException in its older form, with
+    // the value echoed (measured 2026-10-25 12:56 UTC). An unreadable member
+    // of an L or M and a lower-case descriptor do the same (measured on Scan
+    // 2026-10-30 12:40 UTC and on Query 2026-10-31 12:36 UTC).
+    for entry in [
+        serde_json::json!({"X": "1"}),
+        serde_json::json!({}),
+        serde_json::json!({"S": "x", "N": "1"}),
+        serde_json::json!({"L": [{}]}),
+        serde_json::json!({"M": {"k": {"X": "1"}}}),
+        serde_json::json!({"s": "x"}),
+    ] {
+        let unreadable = serde_json::json!({
+            "TableName": "t", "KeyConditionExpression": "pk = :p",
+            "Limit": 0, "ExpressionAttributeValues": {":p": {"S": "x"}, ":a": entry},
+        });
+        assert_eq!(
+            message(validate_query_request_body(&unreadable)).as_deref(),
+            Some(
+                "1 validation error detected: Value '0' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1"
+            ),
+            "{unreadable}"
+        );
+    }
 
     // A body that passes every check is left to the handler's deserializer.
     let shape_fault_only = serde_json::json!({
@@ -582,3 +597,42 @@ fn a_shape_fault_in_another_field_is_reported_ahead_of_the_checks() {
     });
     assert!(validate_query_request_body(&shape_fault_only).is_ok());
 }
+
+/// Measured 2026-10-31 between 23:54 and 23:56 UTC: an empty value in
+/// `ExclusiveStartKey`, or as an `AttributeValueList` entry of `KeyConditions`
+/// or `QueryFilter`, answers a `Limit` of 0 in the older form, as an entry of
+/// `ExpressionAttributeValues` does; a readable `KeyConditions` entry keeps the
+/// newer form.
+#[test]
+fn an_unreadable_value_in_the_start_key_or_a_condition_list_switches_to_the_older_form() {
+    let older_limit = "1 validation error detected: Value '0' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1";
+    let key_conditions = |entry: serde_json::Value| serde_json::json!({"pk": {"ComparisonOperator": "EQ", "AttributeValueList": [entry]}});
+    let start_key = serde_json::json!({
+        "TableName": "t", "KeyConditionExpression": "pk = :p", "Limit": 0,
+        "ExpressionAttributeValues": {":p": {"S": "p0"}},
+        "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}},
+    });
+    let query_filter = serde_json::json!({
+        "TableName": "t", "KeyConditions": key_conditions(serde_json::json!({"S": "p0"})),
+        "Limit": 0,
+        "QueryFilter": {"a": {"ComparisonOperator": "EQ", "AttributeValueList": [{}]}},
+    });
+    let key_condition = serde_json::json!({
+        "TableName": "t", "KeyConditions": key_conditions(serde_json::json!({})), "Limit": 0,
+    });
+    for body in [start_key, query_filter, key_condition] {
+        assert_eq!(
+            message(validate_query_request_body(&body)).as_deref(),
+            Some(older_limit),
+            "{body}"
+        );
+    }
+    let readable = serde_json::json!({
+        "TableName": "t", "KeyConditions": key_conditions(serde_json::json!({"S": "p0"})),
+        "Limit": 0,
+    });
+    assert_eq!(
+        message(validate_query_request_body(&readable)).as_deref(),
+        Some(LIMIT_BELOW_ONE)
+    );
+}
diff --git a/crates/engine/src/scan_request.rs b/crates/engine/src/scan_request.rs
index 2214d0058..2fb57e206 100644
--- a/crates/engine/src/scan_request.rs
+++ b/crates/engine/src/scan_request.rs
@@ -4,18 +4,20 @@
 //! The `Scan` checks that run on the request body alone, before the body is
 //! deserialized and before the table is looked up, in the service's order.
 //!
-//! Measured 2026-10-25 (us-east-1, each request twice):
+//! Measured 2026-10-25 and 2026-10-30 (us-east-1, each request twice):
 //!
 //! 1. the range constraints on `Limit` (at least 1), `Segment` (0 to 999999)
 //!    and `TotalSegments` (1 to 1000000), each checked when present, whether or
-//!    not the other segment field is. A `Limit` below 1 inside the int32 range
-//!    answers `1 validation error detected: Value at 'Limit' failed to satisfy
-//!    constraint: Member must have value greater than or equal to 1`; below
-//!    int32 the service saturates the value and answers the older form
-//!    `Value '-2147483648' at 'limit' ...`. The service aggregates several
-//!    range faults into one message; this module reports the first in the
-//!    order `Limit`, `Segment`, `TotalSegments`, with the `Segment` and
-//!    `TotalSegments` texts the previous release used;
+//!    not the other segment field is, every fault in one message: `1
+//!    validation error detected: Value at 'Limit' failed to satisfy
+//!    constraint: Member must have value greater than or equal to 1`, or `2
+//!    validation errors detected: ...; ...` in the order `Limit`, `Segment`,
+//!    `TotalSegments`. A float or a value outside int32 in any of the three,
+//!    or a value that is not one AttributeValue in `ExpressionAttributeValues`,
+//!    in `ExclusiveStartKey` or in a `ScanFilter` `AttributeValueList`,
+//!    switches the message to the older form, `Value '-2147483648' at 'limit'
+//!    ...`, with the value saturated or truncated, in the order
+//!    `totalSegments`, `segment`, `limit`; see `validate_ranges`;
 //! 2. the expression and non-expression parameter mix;
 //! 3. the `ReturnConsumedCapacity` enum;
 //! 4. every number in `ExpressionAttributeValues`, `NS` members and values
@@ -36,11 +38,12 @@
 use std::collections::HashMap;
 
 use extenddb_core::error::DynamoDbError;
-use extenddb_core::types::{AttributeValue, ScanInput};
+use extenddb_core::types::{AttributeValue, ScanInput, saturated_int32};
 use serde_json::Value;
 
 use crate::query_key_values::{
-    non_empty, present, shape_fault_first, validate_expression_attribute_value_numbers,
+    SCAN_CONDITIONS, has_unreadable_attribute_value, non_empty, present, shape_fault_first,
+    validate_expression_attribute_value_numbers,
 };
 
 /// The `Scan` checks that run on the raw request body, in the service's order:
@@ -114,57 +117,120 @@ fn scan_request_checks(body: &Value) -> Result<(), DynamoDbError> {
     )
 }
 
-/// The range constraints on `Limit`, `Segment` and `TotalSegments`, the first
-/// fault in that order.
+/// The range constraints on `Limit`, `Segment` and `TotalSegments`, every
+/// fault in one message, in one of the service's two forms (measured
+/// 2026-10-25, us-east-1).
 ///
-/// `Limit` answers the service's text: inside the int32 range the field is
-/// capitalised and the value is not echoed; below int32 the service saturates
-/// the value and uses the older `Value '<n>' at 'limit'` form (measured
-/// 2026-10-25, `Limit: -2147483649`). `Segment` and `TotalSegments` keep the
-/// texts of the previous release.
+/// When each field present is an integer inside the int32 range, the newer
+/// form: `Value at '<Field>' failed to satisfy constraint: ...` with the field
+/// capitalised and no value echoed, in the order `Limit`, `Segment`,
+/// `TotalSegments`. When any of the three is a float or outside int32, or a
+/// value in `ExpressionAttributeValues`, `ExclusiveStartKey` or a `ScanFilter`
+/// `AttributeValueList` is not one AttributeValue (see
+/// [`has_unreadable_attribute_value`]), the older form: `Value '<n>' at
+/// '<field>' ...` with the value as [`saturated_int32`] reads it and the field
+/// in lower camel case, in the reverse of the newer form's order:
+/// `totalSegments`, `segment`, `limit` (measured 2026-10-30 12:40 UTC with a
+/// fault in each of the three, and on 2026-10-25 with `segment` then `limit`
+/// and `totalSegments` then `limit`).
 fn validate_ranges(body: &Value) -> Result<(), DynamoDbError> {
-    let get = |field: &str| body.get(field).and_then(Value::as_i64);
-    if let Some(limit) = get("Limit")
-        && limit < 1
-    {
-        let text = if limit >= i64::from(i32::MIN) {
-            "Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1".to_owned()
-        } else {
-            format!(
-                "Value '{}' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1",
-                i32::MIN
-            )
-        };
-        return Err(DynamoDbError::ValidationException(format!(
-            "1 validation error detected: {text}"
-        )));
-    }
-    if let Some(segment) = get("Segment") {
-        if segment < 0 {
-            return Err(DynamoDbError::ValidationException(format!(
-                "1 validation error detected: Value '{segment}' at 'segment' failed to satisfy constraint: Member must have value greater than or equal to 0"
-            )));
-        }
-        if segment > 999_999 {
-            return Err(DynamoDbError::ValidationException(format!(
-                "1 validation error detected: Value '{segment}' at 'segment' failed to satisfy constraint: Member must have value less than or equal to 999999"
-            )));
-        }
+    let numbers: Vec<(&RangeField, &serde_json::Number)> = RANGE_FIELDS
+        .iter()
+        .filter_map(|range| {
+            body.get(range.field)
+                .and_then(Value::as_number)
+                .map(|number| (range, number))
+        })
+        .collect();
+    let older_form = has_unreadable_attribute_value(body, SCAN_CONDITIONS)
+        || numbers.iter().any(|(_, number)| {
+            number
+                .as_i64()
+                .is_none_or(|value| i32::try_from(value).is_err())
+        });
+    let faults: Vec<(&RangeField, i32, String)> = numbers
+        .into_iter()
+        .filter_map(|(range, number)| {
+            let value = saturated_int32(number);
+            if value < range.min {
+                Some((
+                    range,
+                    value,
+                    format!("greater than or equal to {}", range.min),
+                ))
+            } else {
+                range
+                    .max
+                    .filter(|max| value > *max)
+                    .map(|max| (range, value, format!("less than or equal to {max}")))
+            }
+        })
+        .collect();
+    if faults.is_empty() {
+        return Ok(());
     }
-    if let Some(total) = get("TotalSegments") {
-        if total < 1 {
-            return Err(DynamoDbError::ValidationException(
-                "The parameter TotalSegments should be greater than or equal to 1".to_owned(),
-            ));
-        }
-        if total > 1_000_000 {
-            return Err(DynamoDbError::ValidationException(format!(
-                "1 validation error detected: Value '{total}' at 'totalSegments' failed to satisfy constraint: Member must have value less than or equal to 1000000"
-            )));
-        }
-    }
-    Ok(())
+    let clauses: Vec<String> = if older_form {
+        faults
+            .iter()
+            .rev()
+            .map(|(range, value, constraint)| {
+                format!(
+                    "Value '{value}' at '{}' failed to satisfy constraint: Member must have value {constraint}",
+                    range.older_field
+                )
+            })
+            .collect()
+    } else {
+        faults
+            .iter()
+            .map(|(range, _, constraint)| {
+                format!(
+                    "Value at '{}' failed to satisfy constraint: Member must have value {constraint}",
+                    range.field
+                )
+            })
+            .collect()
+    };
+    let count = clauses.len();
+    Err(DynamoDbError::ValidationException(format!(
+        "{count} validation error{} detected: {}",
+        if count == 1 { "" } else { "s" },
+        clauses.join("; ")
+    )))
 }
 
+/// One range-checked `Scan` field: its name in the newer and the older form of
+/// the fault, and its bounds.
+struct RangeField {
+    field: &'static str,
+    older_field: &'static str,
+    min: i32,
+    max: Option<i32>,
+}
+
+/// The range-checked fields in the order the newer form reports them.
+const RANGE_FIELDS: [RangeField; 3] = [
+    RangeField {
+        field: "Limit",
+        older_field: "limit",
+        min: 1,
+        max: None,
+    },
+    RangeField {
+        field: "Segment",
+        older_field: "segment",
+        min: 0,
+        max: Some(999_999),
+    },
+    RangeField {
+        field: "TotalSegments",
+        older_field: "totalSegments",
+        min: 1,
+        max: Some(1_000_000),
+    },
+];
+
+#[cfg(test)]
+mod range_tests;
 #[cfg(test)]
 mod tests;
diff --git a/crates/engine/src/scan_request/range_tests.rs b/crates/engine/src/scan_request/range_tests.rs
new file mode 100644
index 000000000..0554cb1d5
--- /dev/null
+++ b/crates/engine/src/scan_request/range_tests.rs
@@ -0,0 +1,321 @@
+// Copyright 2026 ExtendDB contributors
+// SPDX-License-Identifier: Apache-2.0
+
+//! The range constraints on `Limit`, `Segment` and `TotalSegments`.
+//!
+//! Every row is a request sent to the service (us-east-1, each request twice,
+//! a Scan of an existing table) with the answer it gave: on 2026-10-25 between
+//! 09:23 and 12:56 UTC, and on 2026-10-30 at 12:40 UTC, 2026-10-31 at 12:36
+//! UTC or 2026-10-31 between 23:54 and 23:56 UTC where a test says so.
+
+use extenddb_core::error::DynamoDbError;
+use serde_json::Value;
+
+use super::validate_scan_request_body;
+
+const LIMIT: &str = "Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1";
+const SEGMENT_LOW: &str = "Value at 'Segment' failed to satisfy constraint: Member must have value greater than or equal to 0";
+const SEGMENT_HIGH: &str = "Value at 'Segment' failed to satisfy constraint: Member must have value less than or equal to 999999";
+const TOTAL_LOW: &str = "Value at 'TotalSegments' failed to satisfy constraint: Member must have value greater than or equal to 1";
+const TOTAL_HIGH: &str = "Value at 'TotalSegments' failed to satisfy constraint: Member must have value less than or equal to 1000000";
+
+fn check(body: &Value) -> Option<String> {
+    match validate_scan_request_body(body) {
+        Ok(()) => None,
+        Err(DynamoDbError::ValidationException(msg)) => Some(msg),
+        Err(other) => panic!("unexpected error {other:?}"),
+    }
+}
+
+/// A Scan body with `fields` added to the table name, written as JSON text so
+/// a number keeps the form the request wrote (`0.0`, `1e2`).
+fn scan(fields: &str) -> Value {
+    serde_json::from_str(&format!(r#"{{"TableName": "t", {fields}}}"#)).expect("JSON")
+}
+
+fn one(clause: &str) -> String {
+    format!("1 validation error detected: {clause}")
+}
+
+fn older(value: &str, field: &str, constraint: &str) -> String {
+    format!(
+        "Value '{value}' at '{field}' failed to satisfy constraint: Member must have value {constraint}"
+    )
+}
+
+#[test]
+fn integers_inside_int32_answer_the_newer_form_in_the_order_limit_segment_total_segments() {
+    let cases = [
+        (r#""Limit": 0"#, one(LIMIT)),
+        (r#""Limit": -2147483648"#, one(LIMIT)),
+        (r#""Segment": -1"#, one(SEGMENT_LOW)),
+        (r#""Segment": -1, "TotalSegments": 2"#, one(SEGMENT_LOW)),
+        (
+            r#""Segment": 1000000, "TotalSegments": 1000000"#,
+            one(SEGMENT_HIGH),
+        ),
+        (r#""TotalSegments": 0"#, one(TOTAL_LOW)),
+        (r#""Segment": 0, "TotalSegments": 0"#, one(TOTAL_LOW)),
+        (r#""Segment": 0, "TotalSegments": -1"#, one(TOTAL_LOW)),
+        (r#""TotalSegments": 1000001"#, one(TOTAL_HIGH)),
+        (
+            r#""Limit": 0, "Segment": -1, "TotalSegments": 1000001"#,
+            format!("3 validation errors detected: {LIMIT}; {SEGMENT_LOW}; {TOTAL_HIGH}"),
+        ),
+        (
+            r#""Limit": 0, "TotalSegments": 0"#,
+            format!("2 validation errors detected: {LIMIT}; {TOTAL_LOW}"),
+        ),
+        (
+            r#""Segment": -1, "TotalSegments": 1000001"#,
+            format!("2 validation errors detected: {SEGMENT_LOW}; {TOTAL_HIGH}"),
+        ),
+        (
+            r#""Segment": 1000000, "TotalSegments": 0"#,
+            format!("2 validation errors detected: {SEGMENT_HIGH}; {TOTAL_LOW}"),
+        ),
+    ];
+    for (fields, expected) in cases {
+        assert_eq!(check(&scan(fields)), Some(expected), "{fields}");
+    }
+}
+
+#[test]
+fn a_float_or_a_value_outside_int32_answers_the_older_form_with_limit_last() {
+    let at_least_one = "greater than or equal to 1";
+    let cases = [
+        (
+            r#""Limit": -2147483649"#,
+            one(&older("-2147483648", "limit", at_least_one)),
+        ),
+        (r#""Limit": 0.0"#, one(&older("0", "limit", at_least_one))),
+        (
+            r#""Segment": 0, "TotalSegments": 2147483648"#,
+            one(&older(
+                "2147483647",
+                "totalSegments",
+                "less than or equal to 1000000",
+            )),
+        ),
+        (
+            r#""Limit": -2147483649, "Segment": -1"#,
+            format!(
+                "2 validation errors detected: {}; {}",
+                older("-1", "segment", "greater than or equal to 0"),
+                older("-2147483648", "limit", at_least_one)
+            ),
+        ),
+        (
+            r#""TotalSegments": 1000001, "Limit": 0.0"#,
+            format!(
+                "2 validation errors detected: {}; {}",
+                older("1000001", "totalSegments", "less than or equal to 1000000"),
+                older("0", "limit", at_least_one)
+            ),
+        ),
+    ];
+    for (fields, expected) in cases {
+        assert_eq!(check(&scan(fields)), Some(expected), "{fields}");
+    }
+}
+
+#[test]
+fn floats_and_out_of_range_integers_that_satisfy_the_constraints_are_accepted() {
+    for fields in [
+        r#""Limit": 2147483648"#,
+        r#""Limit": 9223372036854775808"#,
+        r#""Limit": 1.5"#,
+        r#""Limit": 1.0"#,
+        r#""Limit": 1e2"#,
+        r#""Segment": 1.5, "TotalSegments": 2"#,
+    ] {
+        assert_eq!(check(&scan(fields)), None, "{fields}");
+    }
+}
+
+#[test]
+fn an_entry_that_is_not_one_attribute_value_switches_to_the_older_form() {
+    let older_limit = one(&older("0", "limit", "greater than or equal to 1"));
+    for entry in [r"{}", r#"{"X": "1"}"#, r#"{"S": "x", "N": "1"}"#] {
+        let fields = format!(r#""Limit": 0, "ExpressionAttributeValues": {{":a": {entry}}}"#);
+        assert_eq!(
+            check(&scan(&fields)).as_deref(),
+            Some(older_limit.as_str()),
+            "{entry}"
+        );
+    }
+    // An empty or duplicate NS is read as an AttributeValue: the newer form.
+    for entry in [r#"{"NS": []}"#, r#"{"NS": ["1", "1"]}"#] {
+        let fields = format!(r#""Limit": 0, "ExpressionAttributeValues": {{":a": {entry}}}"#);
+        assert_eq!(check(&scan(&fields)), Some(one(LIMIT)), "{entry}");
+    }
+}
+
+/// Measured 2026-10-30 12:40 UTC: a fault in each of the three fields in the
+/// older form is reported `totalSegments`, `segment`, `limit`, whichever field
+/// is the float.
+#[test]
+fn three_older_form_faults_are_reported_total_segments_segment_limit() {
+    let expected = format!(
+        "3 validation errors detected: {}; {}; {}",
+        older("1000001", "totalSegments", "less than or equal to 1000000"),
+        older("-1", "segment", "greater than or equal to 0"),
+        older("0", "limit", "greater than or equal to 1")
+    );
+    for fields in [
+        r#""Limit": 0.0, "Segment": -1, "TotalSegments": 1000001"#,
+        r#""Limit": 0, "Segment": -1, "TotalSegments": 1000001.0"#,
+    ] {
+        assert_eq!(
+            check(&scan(fields)).as_deref(),
+            Some(expected.as_str()),
+            "{fields}"
+        );
+    }
+}
+
+/// Measured 2026-10-30 12:40 UTC: a negative fraction is truncated toward
+/// zero, and `-0` is read as 0.
+#[test]
+fn a_negative_fraction_is_truncated_toward_zero() {
+    for (fields, value) in [
+        (r#""Limit": -1.5"#, "-1"),
+        (r#""Limit": -0.5"#, "0"),
+        (r#""Limit": -0"#, "0"),
+    ] {
+        assert_eq!(
+            check(&scan(fields)),
+            Some(one(&older(value, "limit", "greater than or equal to 1"))),
+            "{fields}"
+        );
+    }
+}
+
+/// Measured 2026-10-30 12:40 UTC: an unreadable member of an `L` or an `M`
+/// entry, and a lower-case type descriptor, switch to the older form. Each
+/// entry sits under `:d` beside a filter that reads `:p`, as sent.
+#[test]
+fn an_unreadable_member_of_a_list_or_map_entry_switches_to_the_older_form() {
+    let older_limit = one(&older("0", "limit", "greater than or equal to 1"));
+    for entry in [
+        r#"{"L": [{}]}"#,
+        r#"{"M": {"k": {"X": "1"}}}"#,
+        r#"{"s": "x"}"#,
+    ] {
+        let fields = format!(
+            r#""Limit": 0, "FilterExpression": "a = :p", "ExpressionAttributeValues": {{":p": {{"S": "x"}}, ":d": {entry}}}"#
+        );
+        assert_eq!(
+            check(&scan(&fields)).as_deref(),
+            Some(older_limit.as_str()),
+            "{entry}"
+        );
+    }
+}
+
+/// Measured 2026-10-31 between 23:54 and 23:56 UTC: an empty value or one with
+/// an unknown type descriptor in `ExclusiveStartKey` or in a `ScanFilter`
+/// `AttributeValueList` switches to the older form, for a `Segment` fault too;
+/// a readable value keeps the newer form, also a number for an `S` key.
+#[test]
+fn an_unreadable_value_in_the_start_key_or_a_scan_filter_switches_to_the_older_form() {
+    let older_limit = one(&older("0", "limit", "greater than or equal to 1"));
+    let filter = |entry: &str| {
+        format!(
+            r#""ScanFilter": {{"a": {{"ComparisonOperator": "EQ", "AttributeValueList": [{entry}]}}}}"#
+        )
+    };
+    for fields in [
+        r#""ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}"#.to_owned(),
+        r#""ExclusiveStartKey": {"pk": {"X": "1"}, "sk": {"S": "x"}}"#.to_owned(),
+        filter("{}"),
+        filter(r#"{"X": "1"}"#),
+    ] {
+        let fields = format!(r#""Limit": 0, {fields}"#);
+        assert_eq!(
+            check(&scan(&fields)).as_deref(),
+            Some(older_limit.as_str()),
+            "{fields}"
+        );
+    }
+    let segment =
+        r#""Segment": -1, "TotalSegments": 2, "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}"#;
+    assert_eq!(
+        check(&scan(segment)),
+        Some(one(&older("-1", "segment", "greater than or equal to 0")))
+    );
+    for fields in [
+        r#""ExclusiveStartKey": {"pk": {"N": "1"}, "sk": {"S": "x"}}"#.to_owned(),
+        filter(r#"{"N": "1"}"#),
+    ] {
+        let fields = format!(r#""Limit": 0, {fields}"#);
+        assert_eq!(check(&scan(&fields)), Some(one(LIMIT)), "{fields}");
+    }
+}
+
+/// Measured 2026-10-31 12:36 UTC: `Limit: 0` beside a readable entry of each
+/// type, and beside an `L` and an `M` whose members are readable, keeps the
+/// newer form, as the empty and duplicate `NS` measured on 2026-10-25 do.
+#[test]
+fn a_readable_entry_of_any_type_keeps_the_newer_form() {
+    for entry in [
+        r#"{"S": "x"}"#,
+        r#"{"N": "1"}"#,
+        r#"{"B": "AA=="}"#,
+        r#"{"SS": ["x"]}"#,
+        r#"{"NS": ["1"]}"#,
+        r#"{"BS": ["AA=="]}"#,
+        r#"{"M": {"k": {"S": "x"}}}"#,
+        r#"{"L": [{"N": "1"}, {"L": []}]}"#,
+        r#"{"NULL": true}"#,
+        r#"{"BOOL": false}"#,
+    ] {
+        let fields = format!(r#""Limit": 0, "ExpressionAttributeValues": {{":a": {entry}}}"#);
+        assert_eq!(check(&scan(&fields)), Some(one(LIMIT)), "{entry}");
+    }
+}
+
+/// Measured 2026-10-31 12:36 UTC: every fault in one message, in the order
+/// Limit, Segment, TotalSegments, and nothing reported for a field inside its
+/// bounds. `Segment: 0, TotalSegments: 1` was sent with `ConsistentRead: true`
+/// and returned the whole table in one page.
+#[test]
+fn every_fault_is_reported_in_one_message_and_a_field_inside_its_bounds_is_not() {
+    let cases = [
+        (r#""Limit": -1"#, one(LIMIT)),
+        (r#""Segment": 0, "TotalSegments": 1000001"#, one(TOTAL_HIGH)),
+        (
+            r#""Limit": 0, "TotalSegments": 1000001"#,
+            format!("2 validation errors detected: {LIMIT}; {TOTAL_HIGH}"),
+        ),
+        (
+            r#""Limit": 0, "Segment": -1"#,
+            format!("2 validation errors detected: {LIMIT}; {SEGMENT_LOW}"),
+        ),
+        (
+            r#""Limit": -1, "Segment": 1000000"#,
+            format!("2 validation errors detected: {LIMIT}; {SEGMENT_HIGH}"),
+        ),
+        (
+            r#""Limit": 0, "Segment": 1000000, "TotalSegments": 0"#,
+            format!("3 validation errors detected: {LIMIT}; {SEGMENT_HIGH}; {TOTAL_LOW}"),
+        ),
+        // A Segment that is not below TotalSegments is checked later; the
+        // Limit fault is reported alone.
+        (
+            r#""Limit": 0, "Segment": 5, "TotalSegments": 2"#,
+            one(LIMIT),
+        ),
+    ];
+    for (fields, expected) in cases {
+        assert_eq!(check(&scan(fields)), Some(expected), "{fields}");
+    }
+    for fields in [
+        r#""Limit": 2147483647"#,
+        r#""Limit": null"#,
+        r#""Segment": 0, "TotalSegments": 1"#,
+        r#""Segment": 999999, "TotalSegments": 1000000"#,
+    ] {
+        assert_eq!(check(&scan(fields)), None, "{fields}");
+    }
+}
diff --git a/crates/engine/src/scan_request/tests.rs b/crates/engine/src/scan_request/tests.rs
index 2ae845559..91005eb22 100644
--- a/crates/engine/src/scan_request/tests.rs
+++ b/crates/engine/src/scan_request/tests.rs
@@ -3,10 +3,8 @@
 
 //! The expected texts below were measured against the service on 2026-10-25
 //! (us-east-1, each request twice), except where a test says otherwise: the
-//! `Segment` and `TotalSegments` range texts are the previous release's (the
-//! service aggregates range faults into one message with a different form, a
-//! separate issue), and the deserializer test pins this module's hand-off, not
-//! a service text.
+//! deserializer test pins this module's hand-off, not a service text. The
+//! range constraint rows are in `range_tests`.
 
 use extenddb_core::error::DynamoDbError;
 use serde_json::{Value, json};
@@ -126,95 +124,65 @@ fn nested_numbers_and_the_other_number_faults_are_reported_with_the_service_text
 }
 
 #[test]
-fn limit_segment_and_total_segments_ranges_come_first() {
+fn range_faults_come_first() {
+    const SEGMENT_LOW: &str = "1 validation error detected: Value at 'Segment' failed to satisfy constraint: Member must have value greater than or equal to 0";
     let base = bad_number();
-    assert_eq!(
-        check(&with(base.clone(), "Limit", json!(0))).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+    for limit in [0, -1] {
+        assert_eq!(
+            check(&with(base.clone(), "Limit", json!(limit))).as_deref(),
+            Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+        );
+    }
+    // A range fault beats the parameter mix and the ReturnConsumedCapacity enum.
+    let scan_filter =
+        json!({"a": {"ComparisonOperator": "EQ", "AttributeValueList": [{"S": "x"}]}});
+    let mix = with(
+        with(base.clone(), "Segment", json!(-1)),
+        "ScanFilter",
+        scan_filter.clone(),
     );
-    assert_eq!(
-        check(&with(base.clone(), "Limit", json!(-1))).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+    assert_eq!(check(&mix).as_deref(), Some(SEGMENT_LOW));
+    let rcc = with(
+        with(base.clone(), "Segment", json!(-1)),
+        "ReturnConsumedCapacity",
+        json!("NOPE"),
     );
-    // The int32 minimum itself gets the capitalised form; below it the service
-    // saturates the value and uses the older form (measured 2026-10-25).
-    assert_eq!(
-        check(&with(base.clone(), "Limit", json!(-2_147_483_648_i64))).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+    assert_eq!(check(&rcc).as_deref(), Some(SEGMENT_LOW));
+    let rcc = with(
+        with(base.clone(), "Limit", json!(0)),
+        "ReturnConsumedCapacity",
+        json!("NOPE"),
     );
     assert_eq!(
-        check(&with(base.clone(), "Limit", json!(-2_147_483_649_i64))).as_deref(),
-        Some(
-            "1 validation error detected: Value '-2147483648' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1"
-        )
+        check(&rcc).as_deref(),
+        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
     );
-    // Each segment field is range checked when present, with or without the
-    // other one (the service's position; the texts are the previous release's).
-    for (field, value, text) in [
-        (
-            "Segment",
-            -1,
-            "1 validation error detected: Value '-1' at 'segment' failed to satisfy constraint: Member must have value greater than or equal to 0",
-        ),
-        (
-            "Segment",
-            1_000_000,
-            "1 validation error detected: Value '1000000' at 'segment' failed to satisfy constraint: Member must have value less than or equal to 999999",
-        ),
-        (
-            "TotalSegments",
-            0,
-            "The parameter TotalSegments should be greater than or equal to 1",
-        ),
-        (
-            "TotalSegments",
-            1_000_001,
-            "1 validation error detected: Value '1000001' at 'totalSegments' failed to satisfy constraint: Member must have value less than or equal to 1000000",
-        ),
-    ] {
-        assert_eq!(
-            check(&with(base.clone(), field, json!(value))).as_deref(),
-            Some(text),
-            "{field} {value}"
-        );
-        let partner = if field == "Segment" {
-            ("TotalSegments", 2)
-        } else {
-            ("Segment", 0)
-        };
-        let paired = with(
-            with(base.clone(), field, json!(value)),
-            partner.0,
-            json!(partner.1),
-        );
-        assert_eq!(
-            check(&paired).as_deref(),
-            Some(text),
-            "{field} {value} with {}",
-            partner.0
-        );
-    }
-    // Several range faults: the first in the order Limit, Segment,
-    // TotalSegments is reported.
-    let three = with(
+    // Every range fault is reported, ahead of the mix, both enums and the number.
+    let all = with(
         with(
-            with(json!({"TableName": "t"}), "Limit", json!(0)),
-            "Segment",
-            json!(-1),
+            with(with(base.clone(), "Limit", json!(0)), "Segment", json!(-1)),
+            "TotalSegments",
+            json!(0),
         ),
-        "TotalSegments",
-        json!(1_000_001),
+        "ScanFilter",
+        scan_filter.clone(),
     );
     assert_eq!(
-        check(&three).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+        check(&all).as_deref(),
+        Some(
+            "3 validation errors detected: Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1; Value at 'Segment' failed to satisfy constraint: Member must have value greater than or equal to 0; Value at 'TotalSegments' failed to satisfy constraint: Member must have value greater than or equal to 1"
+        )
     );
-    let two = with(
-        with(json!({"TableName": "t"}), "Segment", json!(-1)),
-        "TotalSegments",
-        json!(1_000_001),
+    let mut two = with(with(base, "Limit", json!(0)), "Segment", json!(1_000_000));
+    two["ScanFilter"] = scan_filter;
+    two["ReturnConsumedCapacity"] = json!("NOPE");
+    two["Select"] = json!("NOPE");
+    assert_eq!(
+        check(&two).as_deref(),
+        Some(
+            "2 validation errors detected: Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1; Value at 'Segment' failed to satisfy constraint: Member must have value less than or equal to 999999"
+        )
     );
-    assert!(check(&two).is_some_and(|m| m.contains("at 'segment'")));
     // Values at the bounds pass.
     assert!(
         check(
@@ -222,22 +190,6 @@ fn limit_segment_and_total_segments_ranges_come_first() {
         )
         .is_none()
     );
-    // A range fault beats the parameter mix and the ReturnConsumedCapacity enum.
-    let mix = with(
-        with(base.clone(), "Segment", json!(-1)),
-        "ScanFilter",
-        json!({"a": {"ComparisonOperator": "EQ", "AttributeValueList": [{"S": "x"}]}}),
-    );
-    assert!(check(&mix).is_some_and(|m| m.contains("at 'segment'")));
-    let rcc = with(
-        with(base, "Limit", json!(0)),
-        "ReturnConsumedCapacity",
-        json!("NOPE"),
-    );
-    assert_eq!(
-        check(&rcc).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
-    );
 }
 
 #[test]
diff --git a/tests/python/test_scan_range_constraints.py b/tests/python/test_scan_range_constraints.py
new file mode 100644
index 000000000..cb897d749
--- /dev/null
+++ b/tests/python/test_scan_range_constraints.py
@@ -0,0 +1,350 @@
+# Copyright 2026 ExtendDB contributors
+# SPDX-License-Identifier: Apache-2.0
+
+"""Scan range constraints on ``Limit``, ``Segment`` and ``TotalSegments``.
+
+Every request below is sent as raw signed JSON, so a number keeps the form
+written here (``0.0``, ``1e2``, ``9223372036854775808``). Each request is a
+row of the table measured against DynamoDB (us-east-1) on 2026-10-25 at 09:23,
+09:25, 09:28, 10:38, 10:55 and 12:56 UTC, or of the ones measured on
+2026-10-30 at 12:40 UTC, 2026-10-31 at 12:36 UTC and 2026-10-31 between 23:54
+and 23:56 UTC where a row says so, each sent twice, and each expected answer
+is the service's. Where a table records
+only that the service accepted a request, the test asserts what a Scan with
+that limit returns on this table of 12 items. ``Segment: 0, TotalSegments: 1``
+with ``ConsistentRead: true`` returned the whole table in one page on
+2026-10-31, and the test asserts the same here.
+
+When each field present is an integer inside the int32 range, a fault reads
+``Value at '<Field>' failed to satisfy constraint: ...`` with the field
+capitalised and no value echoed, and several faults are reported in one
+message in the order Limit, Segment, TotalSegments. When a field is a float
+or outside int32, or a value is not one AttributeValue (an
+``ExpressionAttributeValues`` entry or an ``L`` or ``M`` member of one, an
+``ExclusiveStartKey`` value, or an ``AttributeValueList`` entry of
+``ScanFilter``, or on Query of ``KeyConditions`` or ``QueryFilter``), the
+service saturates or truncates the value and uses the older form,
+``Value '<n>' at '<field>' ...``, in the order totalSegments, segment, limit. A float or an out-of-range integer
+that satisfies the constraint is accepted.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+from botocore.awsrequest import AWSRequest
+
+from helpers import unique_name, wait_for_active, wait_for_deleted
+
+ITEMS = 12
+
+LIMIT = (
+    "Value at 'Limit' failed to satisfy constraint: "
+    "Member must have value greater than or equal to 1"
+)
+SEGMENT_LOW = (
+    "Value at 'Segment' failed to satisfy constraint: "
+    "Member must have value greater than or equal to 0"
+)
+SEGMENT_HIGH = (
+    "Value at 'Segment' failed to satisfy constraint: "
+    "Member must have value less than or equal to 999999"
+)
+TOTAL_LOW = (
+    "Value at 'TotalSegments' failed to satisfy constraint: "
+    "Member must have value greater than or equal to 1"
+)
+TOTAL_HIGH = (
+    "Value at 'TotalSegments' failed to satisfy constraint: "
+    "Member must have value less than or equal to 1000000"
+)
+
+
+def one(clause: str) -> str:
+    return "1 validation error detected: " + clause
+
+
+def older(value: str, field: str, constraint: str) -> str:
+    return (
+        f"Value '{value}' at '{field}' failed to satisfy constraint: "
+        f"Member must have value {constraint}"
+    )
+
+
+OLDER_LIMIT_0 = older("0", "limit", "greater than or equal to 1")
+OLDER_LIMIT_MIN = older("-2147483648", "limit", "greater than or equal to 1")
+
+# (id, the fields after TableName as JSON text, the expected message)
+NEWER_FORM = [
+    ("Limit-0", '"Limit": 0', one(LIMIT)),
+    ("Limit-int32-min", '"Limit": -2147483648', one(LIMIT)),
+    ("Segment-minus-1", '"Segment": -1', one(SEGMENT_LOW)),
+    ("Segment-minus-1-of-2", '"Segment": -1, "TotalSegments": 2', one(SEGMENT_LOW)),
+    ("Segment-1000000-of-1000000", '"Segment": 1000000, "TotalSegments": 1000000',
+     one(SEGMENT_HIGH)),
+    ("TotalSegments-0", '"TotalSegments": 0', one(TOTAL_LOW)),
+    ("TotalSegments-0-Segment-0", '"Segment": 0, "TotalSegments": 0', one(TOTAL_LOW)),
+    ("TotalSegments-minus-1-Segment-0", '"Segment": 0, "TotalSegments": -1', one(TOTAL_LOW)),
+    ("TotalSegments-1000001", '"TotalSegments": 1000001', one(TOTAL_HIGH)),
+    ("Limit-Segment-TotalSegments", '"Limit": 0, "Segment": -1, "TotalSegments": 1000001',
+     f"3 validation errors detected: {LIMIT}; {SEGMENT_LOW}; {TOTAL_HIGH}"),
+    ("Limit-TotalSegments", '"Limit": 0, "TotalSegments": 0',
+     f"2 validation errors detected: {LIMIT}; {TOTAL_LOW}"),
+    ("Segment-low-TotalSegments-high", '"Segment": -1, "TotalSegments": 1000001',
+     f"2 validation errors detected: {SEGMENT_LOW}; {TOTAL_HIGH}"),
+    ("Segment-high-TotalSegments-low", '"Segment": 1000000, "TotalSegments": 0',
+     f"2 validation errors detected: {SEGMENT_HIGH}; {TOTAL_LOW}"),
+]
+
+OLDER_FORM = [
+    ("Limit-below-int32", '"Limit": -2147483649', one(OLDER_LIMIT_MIN)),
+    ("TotalSegments-above-int32", '"Segment": 0, "TotalSegments": 2147483648',
+     one(older("2147483647", "totalSegments", "less than or equal to 1000000"))),
+    ("Limit-0.0", '"Limit": 0.0', one(OLDER_LIMIT_0)),
+    ("Limit-below-int32-Segment-minus-1", '"Limit": -2147483649, "Segment": -1',
+     "2 validation errors detected: "
+     f"{older('-1', 'segment', 'greater than or equal to 0')}; {OLDER_LIMIT_MIN}"),
+    ("TotalSegments-1000001-Limit-0.0", '"TotalSegments": 1000001, "Limit": 0.0',
+     "2 validation errors detected: "
+     f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; {OLDER_LIMIT_0}"),
+    # Measured 2026-10-30 12:40 UTC.
+    ("three-faults-Limit-0.0", '"Limit": 0.0, "Segment": -1, "TotalSegments": 1000001',
+     "3 validation errors detected: "
+     f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; "
+     f"{older('-1', 'segment', 'greater than or equal to 0')}; {OLDER_LIMIT_0}"),
+    ("three-faults-TotalSegments-1000001.0",
+     '"Limit": 0, "Segment": -1, "TotalSegments": 1000001.0',
+     "3 validation errors detected: "
+     f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; "
+     f"{older('-1', 'segment', 'greater than or equal to 0')}; {OLDER_LIMIT_0}"),
+    ("Limit-minus-1.5", '"Limit": -1.5',
+     one(older("-1", "limit", "greater than or equal to 1"))),
+    ("Limit-minus-0.5", '"Limit": -0.5', one(OLDER_LIMIT_0)),
+    ("Limit-minus-0", '"Limit": -0', one(OLDER_LIMIT_0)),
+]
+
+# ExpressionAttributeValues entries the service does not read as one
+# AttributeValue (older form beside Limit 0), and two it does (newer form).
+UNREADABLE = [("empty", {}), ("unknown-type", {"X": "1"}), ("two-types", {"S": "x", "N": "1"})]
+READABLE = [("empty-NS", {"NS": []}), ("duplicate-NS", {"NS": ["1", "1"]})]
+# Measured 2026-10-30 12:40 UTC on Scan, each under :d beside a filter that
+# reads :p: older form.
+UNREADABLE_MEMBERS = [("L-empty-member", {"L": [{}]}),
+                      ("M-member-type-X", {"M": {"k": {"X": "1"}}}),
+                      ("lower-case-s", {"s": "x"})]
+
+
+def _conditions(name: str, entry: dict) -> dict:
+    return {name: {"ComparisonOperator": "EQ", "AttributeValueList": [entry]}}
+
+
+def _scan_filter(entry: dict) -> str:
+    return '"ScanFilter": ' + json.dumps(_conditions("a", entry))
+
+
+# Measured 2026-10-31 between 23:54 and 23:56 UTC: a value that is not one
+# AttributeValue in ExclusiveStartKey or in a condition list answers the older
+# form; a readable one, also of the wrong type for the key, the newer form.
+KEY_AND_LISTS = [
+    ("ExclusiveStartKey-empty", '"Limit": 0, "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}',
+     one(OLDER_LIMIT_0)),
+    ("ExclusiveStartKey-type-X",
+     '"Limit": 0, "ExclusiveStartKey": {"pk": {"X": "1"}, "sk": {"S": "x"}}', one(OLDER_LIMIT_0)),
+    ("ScanFilter-empty", '"Limit": 0, ' + _scan_filter({}), one(OLDER_LIMIT_0)),
+    ("ScanFilter-type-X", '"Limit": 0, ' + _scan_filter({"X": "1"}), one(OLDER_LIMIT_0)),
+    ("Segment-beside-ExclusiveStartKey-empty",
+     '"Segment": -1, "TotalSegments": 2, "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}',
+     one(older("-1", "segment", "greater than or equal to 0"))),
+    ("ExclusiveStartKey-N-on-an-S-key",
+     '"Limit": 0, "ExclusiveStartKey": {"pk": {"N": "1"}, "sk": {"S": "x"}}', one(LIMIT)),
+    ("ScanFilter-N", '"Limit": 0, ' + _scan_filter({"N": "1"}), one(LIMIT)),
+]
+QUERY_KEY_AND_LISTS = [
+    ("ExclusiveStartKey-empty",
+     {"KeyConditionExpression": "pk = :p", "Limit": 0,
+      "ExpressionAttributeValues": {":p": {"S": "p0"}},
+      "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}}, one(OLDER_LIMIT_0)),
+    ("QueryFilter-empty",
+     {"KeyConditions": _conditions("pk", {"S": "p0"}), "Limit": 0,
+      "QueryFilter": _conditions("a", {})}, one(OLDER_LIMIT_0)),
+    ("KeyConditions-empty", {"KeyConditions": _conditions("pk", {}), "Limit": 0},
+     one(OLDER_LIMIT_0)),
+    ("KeyConditions-S", {"KeyConditions": _conditions("pk", {"S": "p0"}), "Limit": 0}, one(LIMIT)),
+]
+
+
+def _raw(client, operation: str, body_text: str):
+    """POST ``body_text`` exactly as written, signed with the client's credentials."""
+    req = AWSRequest(method="POST", url=client.meta.endpoint_url, data=body_text,
+                     headers={"Content-Type": "application/x-amz-json-1.0",
+                              "X-Amz-Target": f"DynamoDB_20120810.{operation}"})
+    client._request_signer.sign(operation, req)
+    resp = client._endpoint.http_session.send(req.prepare())
+    return resp.status_code, json.loads(resp.content.decode("utf-8", "replace") or "{}")
+
+
+def _scan(client, table: str, fields: str):
+    return _raw(client, "Scan", '{"TableName": %s, %s}' % (json.dumps(table), fields))
+
+
+def _validation_message(status: int, payload: dict) -> str:
+    assert status == 400, payload
+    assert payload.get("__type", "").endswith("ValidationException"), payload
+    return payload.get("message", payload.get("Message"))
+
+
+@pytest.fixture(scope="module")
+def table(dynamodb_client):
+    """pk S, sk S, with ITEMS items."""
+    name = unique_name("scanrange")
+    dynamodb_client.create_table(
+        TableName=name,
+        AttributeDefinitions=[
+            {"AttributeName": "pk", "AttributeType": "S"},
+            {"AttributeName": "sk", "AttributeType": "S"},
+        ],
+        KeySchema=[
+            {"AttributeName": "pk", "KeyType": "HASH"},
+            {"AttributeName": "sk", "KeyType": "RANGE"},
+        ],
+        BillingMode="PAY_PER_REQUEST",
+    )
+    wait_for_active(dynamodb_client, name)
+    for i in range(ITEMS):
+        dynamodb_client.put_item(TableName=name, Item={
+            "pk": {"S": f"p{i}"}, "sk": {"S": "s"}, "a": {"N": str(i)}})
+    yield name
+    dynamodb_client.delete_table(TableName=name)
+    wait_for_deleted(dynamodb_client, name)
+
+
+class TestIntegersInsideInt32:
+    """The newer form, every fault in one message, Limit, Segment, TotalSegments."""
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in NEWER_FORM],
+                             ids=[r[0] for r in NEWER_FORM])
+    def test_rows(self, dynamodb_client, table, fields, expected):
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == expected
+
+
+class TestFloatsAndValuesOutsideInt32:
+    """The older form: the value saturated or truncated and echoed, limit last."""
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in OLDER_FORM],
+                             ids=[r[0] for r in OLDER_FORM])
+    def test_rows(self, dynamodb_client, table, fields, expected):
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == expected
+
+
+class TestFloatsAndValuesOutsideInt32AreAccepted:
+    """A value that satisfies its constraint once saturated or truncated is
+    accepted and used as saturated or truncated."""
+
+    @pytest.mark.parametrize("fields", [
+        '"Limit": 2147483648', '"Limit": 9223372036854775808', '"Limit": 1e2',
+    ], ids=["Limit-2147483648", "Limit-2-to-the-63", "Limit-1e2"])
+    def test_large_limits_are_accepted(self, dynamodb_client, table, fields):
+        status, payload = _scan(dynamodb_client, table, fields + ', "ConsistentRead": true')
+        assert status == 200, payload
+        assert (payload["Count"], payload["ScannedCount"]) == (ITEMS, ITEMS)
+
+    @pytest.mark.parametrize("fields", ['"Limit": 1.5', '"Limit": 1.0'],
+                             ids=["Limit-1.5", "Limit-1.0"])
+    def test_a_fractional_limit_is_truncated(self, dynamodb_client, table, fields):
+        status, payload = _scan(dynamodb_client, table, fields + ', "ConsistentRead": true')
+        assert status == 200, payload
+        assert (payload["Count"], payload["ScannedCount"]) == (1, 1)
+
+    def test_a_fractional_segment_is_truncated(self, dynamodb_client, table):
+        # The TotalSegments of 2 is this test's; the table records only Segment 1.5.
+        status, half = _scan(dynamodb_client, table,
+                             '"Segment": 1.5, "TotalSegments": 2, "ConsistentRead": true')
+        assert status == 200, half
+        status, whole = _scan(dynamodb_client, table,
+                              '"Segment": 1, "TotalSegments": 2, "ConsistentRead": true')
+        assert status == 200, whole
+
+        def keys(page):
+            return sorted(item["pk"]["S"] for item in page["Items"])
+
+        assert keys(whole), "segment 1 of 2 holds at least one item"
+        assert keys(half) == keys(whole)
+
+    def test_segment_0_of_1_returns_every_item(self, dynamodb_client, table):
+        status, payload = _scan(dynamodb_client, table,
+                                '"Segment": 0, "TotalSegments": 1, "ConsistentRead": true')
+        assert status == 200, payload
+        assert (payload["Count"], payload["ScannedCount"]) == (ITEMS, ITEMS)
+
+
+class TestBesideAnExpressionAttributeValuesEntry:
+    """Limit 0 beside an entry that is not one AttributeValue answers the older
+    form on Scan and on Query (measured 12:56 UTC); beside an empty or a
+    duplicate NS, the newer form."""
+
+    @pytest.mark.parametrize("entry", [e for _, e in UNREADABLE], ids=[i for i, _ in UNREADABLE])
+    def test_scan_unreadable_entry(self, dynamodb_client, table, entry):
+        fields = '"Limit": 0, "ExpressionAttributeValues": ' + json.dumps({":a": entry})
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == one(OLDER_LIMIT_0)
+
+    @pytest.mark.parametrize("entry", [e for _, e in READABLE], ids=[i for i, _ in READABLE])
+    def test_scan_readable_entry(self, dynamodb_client, table, entry):
+        fields = '"Limit": 0, "ExpressionAttributeValues": ' + json.dumps({":a": entry})
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == one(LIMIT)
+
+    @pytest.mark.parametrize("entry, expected",
+                             [(e, one(OLDER_LIMIT_0)) for _, e in UNREADABLE]
+                             + [(e, one(LIMIT)) for _, e in READABLE],
+                             ids=[i for i, _ in UNREADABLE] + [i for i, _ in READABLE])
+    def test_query(self, dynamodb_client, table, entry, expected):
+        body = json.dumps({
+            "TableName": table, "KeyConditionExpression": "pk = :p", "Limit": 0,
+            "ExpressionAttributeValues": {":p": {"S": "p0"}, ":a": entry},
+        })
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == expected
+
+    def test_query_limit_below_int32_beside_an_empty_entry(self, dynamodb_client, table):
+        # Measured 2026-10-31 12:36 UTC: the echoed value is saturated to
+        # int32, as the Scan row Limit -2147483649 is.
+        body = json.dumps({
+            "TableName": table, "KeyConditionExpression": "pk = :p", "Limit": -2147483649,
+            "ExpressionAttributeValues": {":p": {"S": "p0"}, ":a": {}},
+        })
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == one(OLDER_LIMIT_MIN)
+
+    @pytest.mark.parametrize("entry", [e for _, e in UNREADABLE_MEMBERS],
+                             ids=[i for i, _ in UNREADABLE_MEMBERS])
+    def test_scan_unreadable_member(self, dynamodb_client, table, entry):
+        fields = ('"Limit": 0, "FilterExpression": "a = :p", "ExpressionAttributeValues": '
+                  + json.dumps({":p": {"S": "x"}, ":d": entry}))
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == one(OLDER_LIMIT_0)
+
+    @pytest.mark.parametrize("entry", [e for _, e in UNREADABLE_MEMBERS],
+                             ids=[i for i, _ in UNREADABLE_MEMBERS])
+    def test_query_unreadable_member(self, dynamodb_client, table, entry):
+        # Measured on Query 2026-10-31 12:36 UTC, each entry under :d beside
+        # the key condition's :p.
+        body = json.dumps({
+            "TableName": table, "KeyConditionExpression": "pk = :p", "Limit": 0,
+            "ExpressionAttributeValues": {":p": {"S": "p0"}, ":d": entry},
+        })
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == one(OLDER_LIMIT_0)
+
+
+class TestBesideAnUnreadableValueInTheKeyOrAConditionList:
+    """Measured 2026-10-31 between 23:54 and 23:56 UTC: a value that is not one
+    AttributeValue in ExclusiveStartKey, or in the AttributeValueList of a
+    ScanFilter, KeyConditions or QueryFilter condition, switches to the older
+    form, as an ExpressionAttributeValues entry does."""
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in KEY_AND_LISTS],
+                             ids=[r[0] for r in KEY_AND_LISTS])
+    def test_scan(self, dynamodb_client, table, fields, expected):
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == expected
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in QUERY_KEY_AND_LISTS],
+                             ids=[r[0] for r in QUERY_KEY_AND_LISTS])
+    def test_query(self, dynamodb_client, table, fields, expected):
+        body = json.dumps({"TableName": table, **fields})
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == expected
diff --git a/tests/test_query_scan.py b/tests/test_query_scan.py
index 44a82f4a2..f75a88c27 100755
--- a/tests/test_query_scan.py
+++ b/tests/test_query_scan.py
@@ -614,17 +614,17 @@ def test_scan_segment_at_max_accepted(self, dynamodb_client, scan_table):
     def test_scan_segment_one_over_max_rejected(
         self, dynamodb_client_no_validation, scan_table
     ):
-        """Segment > 999999 returns the Coral-format ValidationException."""
+        """Segment > 999999 answers the range constraint, field capitalised and no value echoed."""
         with pytest.raises(ClientError) as exc_info:
             dynamodb_client_no_validation.scan(
                 TableName=scan_table, Segment=1_000_000, TotalSegments=1_000_000
             )
         err = exc_info.value.response["Error"]
         assert err["Code"] == "ValidationException"
-        msg = err["Message"]
-        assert "1 validation error detected" in msg
-        assert "'1000000' at 'segment'" in msg
-        assert "Member must have value less than or equal to 999999" in msg
+        assert err["Message"] == (
+            "1 validation error detected: Value at 'Segment' failed to satisfy "
+            "constraint: Member must have value less than or equal to 999999"
+        )
 
     def test_scan_total_segments_at_max_accepted(self, dynamodb_client, scan_table):
         """TotalSegments=1000000 with Segment=0 is at the documented bound."""
@@ -635,17 +635,17 @@ def test_scan_total_segments_at_max_accepted(self, dynamodb_client, scan_table):
     def test_scan_total_segments_one_over_max_rejected(
         self, dynamodb_client_no_validation, scan_table
     ):
-        """TotalSegments > 1000000 returns the Coral-format ValidationException."""
+        """TotalSegments > 1000000 answers the range constraint, field capitalised and no value echoed."""
         with pytest.raises(ClientError) as exc_info:
             dynamodb_client_no_validation.scan(
                 TableName=scan_table, Segment=0, TotalSegments=1_000_001
             )
         err = exc_info.value.response["Error"]
         assert err["Code"] == "ValidationException"
-        msg = err["Message"]
-        assert "1 validation error detected" in msg
-        assert "'1000001' at 'totalSegments'" in msg
-        assert "Member must have value less than or equal to 1000000" in msg
+        assert err["Message"] == (
+            "1 validation error detected: Value at 'TotalSegments' failed to satisfy "
+            "constraint: Member must have value less than or equal to 1000000"
+        )
 
     def test_scan_all_projected_attributes_without_index_rejected(
         self, dynamodb_client, scan_table