From 2a0ddf1b2b1583466e93113f0c467035663da893 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:20:17 +0000
Subject: [PATCH 1/3] fix(scan): report every Limit, Segment and TotalSegments
 range fault in the service's two forms

The Scan range check reported the first fault in the order Limit, Segment,
TotalSegments, with the previous release's texts for the two segment fields
(Value '-1' at 'segment', and "The parameter TotalSegments should be greater
than or equal to 1" for a value below 1). A float or an integer outside i64
in any of the three answered SerializationException.

The service reports every range fault in one message. When each field present
is an integer inside the int32 range it uses "Value at '<Field>' failed to
satisfy constraint: ..." with the field capitalised and no value echoed, in
the order Limit, Segment, TotalSegments. When any of the three is a float or
outside int32, or an ExpressionAttributeValues entry is not one AttributeValue
(empty, an unknown type descriptor, two descriptors), it truncates or
saturates the value and uses "Value '<n>' at '<field>' ..." with the field in
lower camel case and limit last. A float or an out-of-range integer that
satisfies the constraint is accepted: Limit 1.5 returns one item and Segment
1.5 returns part of the table.

The request-time check now builds that message from the raw body, and the
three fields deserialize from any JSON number, truncated toward zero and
saturated to int32, so the handler uses the value the check validated. Query
answers the older form for a Limit of 0 beside an entry that is not one
AttributeValue, as measured on Query. The two assertions in
tests/test_query_scan.py that pinned the previous segment texts now assert
the measured text.

Measured against the service on 2026-10-25 (09:23, 09:25, 09:28, 10:38, 10:55
and 12:56 UTC), each request twice.
---
 crates/core/src/types/mod.rs                  |   4 +-
 crates/core/src/types/query.rs                | 119 ++++++++-
 crates/engine/src/query_key_values.rs         |  35 +++
 crates/engine/src/query_key_values/tests.rs   |  34 ++-
 crates/engine/src/scan_request.rs             | 178 ++++++++-----
 crates/engine/src/scan_request/range_tests.rs | 195 +++++++++++++++
 crates/engine/src/scan_request/tests.rs       | 146 ++++-------
 tests/python/test_scan_range_constraints.py   | 234 ++++++++++++++++++
 tests/test_query_scan.py                      |  20 +-
 9 files changed, 785 insertions(+), 180 deletions(-)
 create mode 100644 crates/engine/src/scan_request/range_tests.rs
 create mode 100644 tests/python/test_scan_range_constraints.py

diff --git a/crates/core/src/types/mod.rs b/crates/core/src/types/mod.rs
index caf90fd19..12fbe3d74 100755
--- a/crates/core/src/types/mod.rs
+++ b/crates/core/src/types/mod.rs
@@ -42,7 +42,9 @@ pub use key_schema::{
     ScalarAttributeType, TableKeyInfo, VectorIndexKeyInfo, hash_key_elements,
     is_multipart_key_schema, partition_indexes, range_key_elements,
 };
-pub use query::{Condition, QueryInput, QueryOutput, ScanInput, ScanOutput, Select};
+pub use query::{
+    Condition, QueryInput, QueryOutput, ScanInput, ScanOutput, Select, saturated_int32,
+};
 pub use stream::{
     DescribeStreamInput, DescribeStreamOutput, GetRecordsInput, GetRecordsOutput,
     GetShardIteratorInput, GetShardIteratorOutput, ListStreamsInput, ListStreamsOutput,
diff --git a/crates/core/src/types/query.rs b/crates/core/src/types/query.rs
index d9aeaf345..695c63928 100755
--- a/crates/core/src/types/query.rs
+++ b/crates/core/src/types/query.rs
@@ -142,15 +142,30 @@ pub struct ScanInput {
         deserialize_with = "crate::serde_helpers::deserialize_expression_values"
     )]
     pub expression_attribute_values: Option<HashMap<String, AttributeValue>>,
-    #[serde(rename = "Limit")]
+    /// Any JSON number; see [`saturated_int32`].
+    #[serde(
+        rename = "Limit",
+        default,
+        deserialize_with = "deserialize_int32_field"
+    )]
     pub limit: Option<i64>,
     #[serde(rename = "ExclusiveStartKey")]
     pub exclusive_start_key: Option<Item>,
     #[serde(rename = "Select")]
     pub select: Option<Select>,
-    #[serde(rename = "Segment")]
+    /// Any JSON number; see [`saturated_int32`].
+    #[serde(
+        rename = "Segment",
+        default,
+        deserialize_with = "deserialize_int32_field"
+    )]
     pub segment: Option<i64>,
-    #[serde(rename = "TotalSegments")]
+    /// Any JSON number; see [`saturated_int32`].
+    #[serde(
+        rename = "TotalSegments",
+        default,
+        deserialize_with = "deserialize_int32_field"
+    )]
     pub total_segments: Option<i64>,
     #[serde(rename = "ConsistentRead")]
     pub consistent_read: Option<bool>,
@@ -168,6 +183,39 @@ pub struct ScanInput {
     pub conditional_operator: Option<ConditionalOperator>,
 }
 
+/// The value the service validates and uses for a `Scan` `Limit`, `Segment`
+/// or `TotalSegments` written as `number`: a fraction is truncated toward zero
+/// and a value outside the int32 range is saturated to the nearer bound.
+///
+/// Measured 2026-10-25 (us-east-1): `Limit: 1.5` and `Limit: 1.0` return one
+/// item, `Limit: 1e2`, `Limit: 2147483648` and `Limit: 9223372036854775808`
+/// are accepted, `Segment: 1.5` of `TotalSegments: 2` returns the items of
+/// segment 1, `Limit: 0.0` is reported as `0`, `Limit: -2147483649` as
+/// `-2147483648` and `TotalSegments: 2147483648` as `2147483647`.
+#[must_use]
+pub fn saturated_int32(number: &serde_json::Number) -> i32 {
+    if let Some(value) = number.as_i64() {
+        return i32::try_from(value).unwrap_or(if value < 0 { i32::MIN } else { i32::MAX });
+    }
+    if number.is_u64() {
+        return i32::MAX;
+    }
+    // A float: `as` truncates toward zero and saturates at the int32 bounds.
+    #[allow(clippy::cast_possible_truncation)]
+    number.as_f64().map_or(0, |value| value as i32)
+}
+
+/// Deserialize an optional `Scan` range field from any JSON number, as
+/// [`saturated_int32`] reads it. A JSON value of another type is refused, as
+/// it was when the field deserialized as an integer.
+fn deserialize_int32_field<'de, D>(deserializer: D) -> Result<Option<i64>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    Option::<serde_json::Number>::deserialize(deserializer)
+        .map(|number| number.map(|n| i64::from(saturated_int32(&n))))
+}
+
 /// `Scan` response body.
 #[derive(Debug, Clone, Serialize)]
 pub struct ScanOutput {
@@ -183,3 +231,68 @@ pub struct ScanOutput {
     #[serde(rename = "ConsumedCapacity", skip_serializing_if = "Option::is_none")]
     pub consumed_capacity: Option<ConsumedCapacity>,
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::{ScanInput, saturated_int32};
+
+    fn number(text: &str) -> serde_json::Number {
+        serde_json::from_str(text).expect("a JSON number")
+    }
+
+    #[test]
+    fn range_fields_are_truncated_and_saturated_to_int32() {
+        for (text, expected) in [
+            ("1", 1),
+            ("-2147483648", i32::MIN),
+            ("2147483647", i32::MAX),
+            ("-2147483649", i32::MIN),
+            ("2147483648", i32::MAX),
+            ("9223372036854775808", i32::MAX),
+            ("-9223372036854775809", i32::MIN),
+            ("1.5", 1),
+            ("1.0", 1),
+            ("0.0", 0),
+            ("1e2", 100),
+            ("1e40", i32::MAX),
+            ("-1e40", i32::MIN),
+        ] {
+            assert_eq!(saturated_int32(&number(text)), expected, "{text}");
+        }
+    }
+
+    #[test]
+    fn scan_input_reads_any_number_in_the_range_fields() {
+        let input: ScanInput = serde_json::from_value(json!({
+            "TableName": "t", "Limit": 1.5, "Segment": 1.5, "TotalSegments": 2_147_483_648_i64,
+        }))
+        .expect("accepted");
+        assert_eq!(
+            (input.limit, input.segment, input.total_segments),
+            (Some(1), Some(1), Some(i64::from(i32::MAX)))
+        );
+        let input: ScanInput = serde_json::from_str(
+            r#"{"TableName": "t", "Limit": 9223372036854775808, "Segment": null}"#,
+        )
+        .expect("accepted");
+        assert_eq!(
+            (input.limit, input.segment),
+            (Some(i64::from(i32::MAX)), None)
+        );
+        let input: ScanInput = serde_json::from_value(json!({"TableName": "t"})).expect("accepted");
+        assert_eq!(input.total_segments, None);
+        // Another JSON type is still refused.
+        for body in [
+            json!({"TableName": "t", "Limit": "1"}),
+            json!({"TableName": "t", "Segment": true}),
+            json!({"TableName": "t", "TotalSegments": [1]}),
+        ] {
+            assert!(
+                serde_json::from_value::<ScanInput>(body.clone()).is_err(),
+                "{body}"
+            );
+        }
+    }
+}
diff --git a/crates/engine/src/query_key_values.rs b/crates/engine/src/query_key_values.rs
index 42d10ee79..56408ef64 100644
--- a/crates/engine/src/query_key_values.rs
+++ b/crates/engine/src/query_key_values.rs
@@ -119,6 +119,16 @@ fn query_request_checks(body: &Value) -> Result<(), DynamoDbError> {
     if let Some(limit) = body.get("Limit").and_then(Value::as_i64)
         && limit < 1
     {
+        // Beside an ExpressionAttributeValues entry that is not one
+        // AttributeValue the service answers its older form, with the value
+        // echoed (measured 2026-10-25 12:56 UTC on Query and Scan).
+        if has_unreadable_attribute_value(body) {
+            return Err(DynamoDbError::ValidationException(format!(
+                "1 validation error detected: Value '{}' at 'limit' failed to satisfy constraint: \
+                 Member must have value greater than or equal to 1",
+                limit.clamp(i64::from(i32::MIN), i64::from(i32::MAX))
+            )));
+        }
         return Err(DynamoDbError::ValidationException(
             LIMIT_BELOW_ONE.to_owned(),
         ));
@@ -194,6 +204,31 @@ pub(crate) fn non_empty(body: &Value, field: &str) -> bool {
     }
 }
 
+/// The type descriptors an AttributeValue may carry.
+const TYPE_DESCRIPTORS: &[&str] = &["S", "N", "B", "SS", "NS", "BS", "M", "L", "NULL", "BOOL"];
+
+/// Whether an `ExpressionAttributeValues` entry is an object that is not one
+/// AttributeValue: empty, with a type descriptor the service does not have, or
+/// with more than one. Beside such an entry the service reports a range fault
+/// in its older form (measured 2026-10-25 12:56 UTC: `Limit: 0` beside `{}`,
+/// `{"X": "1"}` or `{"S": "x", "N": "1"}` answers `Value '0' at 'limit'` on
+/// Query and Scan, and beside an empty or duplicate `NS` the newer form). An
+/// entry that is not an object is a shape fault, reported ahead of the checks.
+pub(crate) fn has_unreadable_attribute_value(body: &Value) -> bool {
+    body.get("ExpressionAttributeValues")
+        .and_then(Value::as_object)
+        .is_some_and(|values| {
+            values.values().any(|entry| {
+                entry.as_object().is_some_and(|descriptors| {
+                    descriptors.len() != 1
+                        || descriptors
+                            .keys()
+                            .any(|key| !TYPE_DESCRIPTORS.contains(&key.as_str()))
+                })
+            })
+        })
+}
+
 /// Refuse the first `N` value in `ExpressionAttributeValues` (including `NS`
 /// members and values nested in `L` and `M`) that is not a number, with the
 /// bare numeric message: no `ExpressionAttributeValues contains invalid value`
diff --git a/crates/engine/src/query_key_values/tests.rs b/crates/engine/src/query_key_values/tests.rs
index f1ba2d3e6..e48eec7fb 100644
--- a/crates/engine/src/query_key_values/tests.rs
+++ b/crates/engine/src/query_key_values/tests.rs
@@ -562,18 +562,28 @@ fn a_shape_fault_in_another_field_is_reported_ahead_of_the_checks() {
         Some(LIMIT_BELOW_ONE)
     );
 
-    // Neither does an unknown type descriptor, which the deserializer reports
-    // as a SerializationException: the service answers the Limit
-    // ValidationException (measured 2026-10-25), in its older
-    // `Value '0' at 'limit'` form; ExtendDB answers its usual Limit text.
-    let unknown_type = serde_json::json!({
-        "TableName": "t", "KeyConditionExpression": "pk = :p",
-        "Limit": 0, "ExpressionAttributeValues": {":p": {"S": "x"}, ":a": {"X": "1"}},
-    });
-    assert_eq!(
-        message(validate_query_request_body(&unknown_type)).as_deref(),
-        Some(LIMIT_BELOW_ONE)
-    );
+    // Neither does an entry the service cannot read as one AttributeValue (an
+    // unknown type descriptor, which the deserializer reports as a
+    // SerializationException, an empty one or one with two descriptors): the
+    // service answers the Limit ValidationException in its older form, with
+    // the value echoed (measured 2026-10-25 12:56 UTC).
+    for entry in [
+        serde_json::json!({"X": "1"}),
+        serde_json::json!({}),
+        serde_json::json!({"S": "x", "N": "1"}),
+    ] {
+        let unreadable = serde_json::json!({
+            "TableName": "t", "KeyConditionExpression": "pk = :p",
+            "Limit": 0, "ExpressionAttributeValues": {":p": {"S": "x"}, ":a": entry},
+        });
+        assert_eq!(
+            message(validate_query_request_body(&unreadable)).as_deref(),
+            Some(
+                "1 validation error detected: Value '0' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1"
+            ),
+            "{unreadable}"
+        );
+    }
 
     // A body that passes every check is left to the handler's deserializer.
     let shape_fault_only = serde_json::json!({
diff --git a/crates/engine/src/scan_request.rs b/crates/engine/src/scan_request.rs
index 2214d0058..21b16169b 100644
--- a/crates/engine/src/scan_request.rs
+++ b/crates/engine/src/scan_request.rs
@@ -8,14 +8,15 @@
 //!
 //! 1. the range constraints on `Limit` (at least 1), `Segment` (0 to 999999)
 //!    and `TotalSegments` (1 to 1000000), each checked when present, whether or
-//!    not the other segment field is. A `Limit` below 1 inside the int32 range
-//!    answers `1 validation error detected: Value at 'Limit' failed to satisfy
-//!    constraint: Member must have value greater than or equal to 1`; below
-//!    int32 the service saturates the value and answers the older form
-//!    `Value '-2147483648' at 'limit' ...`. The service aggregates several
-//!    range faults into one message; this module reports the first in the
-//!    order `Limit`, `Segment`, `TotalSegments`, with the `Segment` and
-//!    `TotalSegments` texts the previous release used;
+//!    not the other segment field is, every fault in one message: `1
+//!    validation error detected: Value at 'Limit' failed to satisfy
+//!    constraint: Member must have value greater than or equal to 1`, or `2
+//!    validation errors detected: ...; ...` in the order `Limit`, `Segment`,
+//!    `TotalSegments`. A float or a value outside int32 in any of the three,
+//!    or an `ExpressionAttributeValues` entry that is not one AttributeValue,
+//!    switches the message to the older form, `Value '-2147483648' at 'limit'
+//!    ...`, with the value saturated or truncated and `limit` last; see
+//!    `validate_ranges`;
 //! 2. the expression and non-expression parameter mix;
 //! 3. the `ReturnConsumedCapacity` enum;
 //! 4. every number in `ExpressionAttributeValues`, `NS` members and values
@@ -36,11 +37,12 @@
 use std::collections::HashMap;
 
 use extenddb_core::error::DynamoDbError;
-use extenddb_core::types::{AttributeValue, ScanInput};
+use extenddb_core::types::{AttributeValue, ScanInput, saturated_int32};
 use serde_json::Value;
 
 use crate::query_key_values::{
-    non_empty, present, shape_fault_first, validate_expression_attribute_value_numbers,
+    has_unreadable_attribute_value, non_empty, present, shape_fault_first,
+    validate_expression_attribute_value_numbers,
 };
 
 /// The `Scan` checks that run on the raw request body, in the service's order:
@@ -114,57 +116,119 @@ fn scan_request_checks(body: &Value) -> Result<(), DynamoDbError> {
     )
 }
 
-/// The range constraints on `Limit`, `Segment` and `TotalSegments`, the first
-/// fault in that order.
+/// The range constraints on `Limit`, `Segment` and `TotalSegments`, every
+/// fault in one message, in one of the service's two forms (measured
+/// 2026-10-25, us-east-1).
 ///
-/// `Limit` answers the service's text: inside the int32 range the field is
-/// capitalised and the value is not echoed; below int32 the service saturates
-/// the value and uses the older `Value '<n>' at 'limit'` form (measured
-/// 2026-10-25, `Limit: -2147483649`). `Segment` and `TotalSegments` keep the
-/// texts of the previous release.
+/// When each field present is an integer inside the int32 range, the newer
+/// form: `Value at '<Field>' failed to satisfy constraint: ...` with the field
+/// capitalised and no value echoed, in the order `Limit`, `Segment`,
+/// `TotalSegments`. When any of the three is a float or outside int32, or an
+/// `ExpressionAttributeValues` entry is not one AttributeValue (see
+/// [`has_unreadable_attribute_value`]), the older form: `Value '<n>' at
+/// '<field>' ...` with the value as [`saturated_int32`] reads it and the field
+/// in lower camel case, with `limit` last. The service's order of `segment`
+/// and `totalSegments` in the older form is not measured; they keep the order
+/// of the newer form.
 fn validate_ranges(body: &Value) -> Result<(), DynamoDbError> {
-    let get = |field: &str| body.get(field).and_then(Value::as_i64);
-    if let Some(limit) = get("Limit")
-        && limit < 1
-    {
-        let text = if limit >= i64::from(i32::MIN) {
-            "Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1".to_owned()
-        } else {
-            format!(
-                "Value '{}' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1",
-                i32::MIN
-            )
-        };
-        return Err(DynamoDbError::ValidationException(format!(
-            "1 validation error detected: {text}"
-        )));
-    }
-    if let Some(segment) = get("Segment") {
-        if segment < 0 {
-            return Err(DynamoDbError::ValidationException(format!(
-                "1 validation error detected: Value '{segment}' at 'segment' failed to satisfy constraint: Member must have value greater than or equal to 0"
-            )));
-        }
-        if segment > 999_999 {
-            return Err(DynamoDbError::ValidationException(format!(
-                "1 validation error detected: Value '{segment}' at 'segment' failed to satisfy constraint: Member must have value less than or equal to 999999"
-            )));
-        }
+    let numbers: Vec<(&RangeField, &serde_json::Number)> = RANGE_FIELDS
+        .iter()
+        .filter_map(|range| {
+            body.get(range.field)
+                .and_then(Value::as_number)
+                .map(|number| (range, number))
+        })
+        .collect();
+    let older_form = has_unreadable_attribute_value(body)
+        || numbers.iter().any(|(_, number)| {
+            number
+                .as_i64()
+                .is_none_or(|value| i32::try_from(value).is_err())
+        });
+    let mut faults: Vec<(&RangeField, i32, String)> = numbers
+        .into_iter()
+        .filter_map(|(range, number)| {
+            let value = saturated_int32(number);
+            if value < range.min {
+                Some((
+                    range,
+                    value,
+                    format!("greater than or equal to {}", range.min),
+                ))
+            } else {
+                range
+                    .max
+                    .filter(|max| value > *max)
+                    .map(|max| (range, value, format!("less than or equal to {max}")))
+            }
+        })
+        .collect();
+    if faults.is_empty() {
+        return Ok(());
     }
-    if let Some(total) = get("TotalSegments") {
-        if total < 1 {
-            return Err(DynamoDbError::ValidationException(
-                "The parameter TotalSegments should be greater than or equal to 1".to_owned(),
-            ));
-        }
-        if total > 1_000_000 {
-            return Err(DynamoDbError::ValidationException(format!(
-                "1 validation error detected: Value '{total}' at 'totalSegments' failed to satisfy constraint: Member must have value less than or equal to 1000000"
-            )));
-        }
-    }
-    Ok(())
+    let clauses: Vec<String> = if older_form {
+        // `limit` last; the stable sort keeps `segment` ahead of `totalSegments`.
+        faults.sort_by_key(|(range, ..)| range.field == "Limit");
+        faults
+            .iter()
+            .map(|(range, value, constraint)| {
+                format!(
+                    "Value '{value}' at '{}' failed to satisfy constraint: Member must have value {constraint}",
+                    range.older_field
+                )
+            })
+            .collect()
+    } else {
+        faults
+            .iter()
+            .map(|(range, _, constraint)| {
+                format!(
+                    "Value at '{}' failed to satisfy constraint: Member must have value {constraint}",
+                    range.field
+                )
+            })
+            .collect()
+    };
+    let count = clauses.len();
+    Err(DynamoDbError::ValidationException(format!(
+        "{count} validation error{} detected: {}",
+        if count == 1 { "" } else { "s" },
+        clauses.join("; ")
+    )))
 }
 
+/// One range-checked `Scan` field: its name in the newer and the older form of
+/// the fault, and its bounds.
+struct RangeField {
+    field: &'static str,
+    older_field: &'static str,
+    min: i32,
+    max: Option<i32>,
+}
+
+/// The range-checked fields in the order the newer form reports them.
+const RANGE_FIELDS: [RangeField; 3] = [
+    RangeField {
+        field: "Limit",
+        older_field: "limit",
+        min: 1,
+        max: None,
+    },
+    RangeField {
+        field: "Segment",
+        older_field: "segment",
+        min: 0,
+        max: Some(999_999),
+    },
+    RangeField {
+        field: "TotalSegments",
+        older_field: "totalSegments",
+        min: 1,
+        max: Some(1_000_000),
+    },
+];
+
+#[cfg(test)]
+mod range_tests;
 #[cfg(test)]
 mod tests;
diff --git a/crates/engine/src/scan_request/range_tests.rs b/crates/engine/src/scan_request/range_tests.rs
new file mode 100644
index 000000000..0ead01928
--- /dev/null
+++ b/crates/engine/src/scan_request/range_tests.rs
@@ -0,0 +1,195 @@
+// Copyright 2026 ExtendDB contributors
+// SPDX-License-Identifier: Apache-2.0
+
+//! The range constraints on `Limit`, `Segment` and `TotalSegments`.
+//!
+//! The rows in every test but the last are requests sent to the service on
+//! 2026-10-25 (us-east-1, 09:23 to 12:56 UTC, each request twice, a Scan of an
+//! existing table) with the answers it gave. The last test applies the same
+//! rules to requests that were not sent.
+
+use extenddb_core::error::DynamoDbError;
+use serde_json::Value;
+
+use super::validate_scan_request_body;
+
+const LIMIT: &str = "Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1";
+const SEGMENT_LOW: &str = "Value at 'Segment' failed to satisfy constraint: Member must have value greater than or equal to 0";
+const SEGMENT_HIGH: &str = "Value at 'Segment' failed to satisfy constraint: Member must have value less than or equal to 999999";
+const TOTAL_LOW: &str = "Value at 'TotalSegments' failed to satisfy constraint: Member must have value greater than or equal to 1";
+const TOTAL_HIGH: &str = "Value at 'TotalSegments' failed to satisfy constraint: Member must have value less than or equal to 1000000";
+
+fn check(body: &Value) -> Option<String> {
+    match validate_scan_request_body(body) {
+        Ok(()) => None,
+        Err(DynamoDbError::ValidationException(msg)) => Some(msg),
+        Err(other) => panic!("unexpected error {other:?}"),
+    }
+}
+
+/// A Scan body with `fields` added to the table name, written as JSON text so
+/// a number keeps the form the request wrote (`0.0`, `1e2`).
+fn scan(fields: &str) -> Value {
+    serde_json::from_str(&format!(r#"{{"TableName": "t", {fields}}}"#)).expect("JSON")
+}
+
+fn one(clause: &str) -> String {
+    format!("1 validation error detected: {clause}")
+}
+
+fn older(value: &str, field: &str, constraint: &str) -> String {
+    format!(
+        "Value '{value}' at '{field}' failed to satisfy constraint: Member must have value {constraint}"
+    )
+}
+
+#[test]
+fn integers_inside_int32_answer_the_newer_form_in_the_order_limit_segment_total_segments() {
+    let cases = [
+        (r#""Limit": 0"#, one(LIMIT)),
+        (r#""Limit": -2147483648"#, one(LIMIT)),
+        (r#""Segment": -1"#, one(SEGMENT_LOW)),
+        (r#""Segment": -1, "TotalSegments": 2"#, one(SEGMENT_LOW)),
+        (
+            r#""Segment": 1000000, "TotalSegments": 1000000"#,
+            one(SEGMENT_HIGH),
+        ),
+        (r#""TotalSegments": 0"#, one(TOTAL_LOW)),
+        (r#""Segment": 0, "TotalSegments": 0"#, one(TOTAL_LOW)),
+        (r#""Segment": 0, "TotalSegments": -1"#, one(TOTAL_LOW)),
+        (r#""TotalSegments": 1000001"#, one(TOTAL_HIGH)),
+        (
+            r#""Limit": 0, "Segment": -1, "TotalSegments": 1000001"#,
+            format!("3 validation errors detected: {LIMIT}; {SEGMENT_LOW}; {TOTAL_HIGH}"),
+        ),
+        (
+            r#""Limit": 0, "TotalSegments": 0"#,
+            format!("2 validation errors detected: {LIMIT}; {TOTAL_LOW}"),
+        ),
+        (
+            r#""Segment": -1, "TotalSegments": 1000001"#,
+            format!("2 validation errors detected: {SEGMENT_LOW}; {TOTAL_HIGH}"),
+        ),
+        (
+            r#""Segment": 1000000, "TotalSegments": 0"#,
+            format!("2 validation errors detected: {SEGMENT_HIGH}; {TOTAL_LOW}"),
+        ),
+    ];
+    for (fields, expected) in cases {
+        assert_eq!(check(&scan(fields)), Some(expected), "{fields}");
+    }
+}
+
+#[test]
+fn a_float_or_a_value_outside_int32_answers_the_older_form_with_limit_last() {
+    let at_least_one = "greater than or equal to 1";
+    let cases = [
+        (
+            r#""Limit": -2147483649"#,
+            one(&older("-2147483648", "limit", at_least_one)),
+        ),
+        (r#""Limit": 0.0"#, one(&older("0", "limit", at_least_one))),
+        (
+            r#""Segment": 0, "TotalSegments": 2147483648"#,
+            one(&older(
+                "2147483647",
+                "totalSegments",
+                "less than or equal to 1000000",
+            )),
+        ),
+        (
+            r#""Limit": -2147483649, "Segment": -1"#,
+            format!(
+                "2 validation errors detected: {}; {}",
+                older("-1", "segment", "greater than or equal to 0"),
+                older("-2147483648", "limit", at_least_one)
+            ),
+        ),
+        (
+            r#""TotalSegments": 1000001, "Limit": 0.0"#,
+            format!(
+                "2 validation errors detected: {}; {}",
+                older("1000001", "totalSegments", "less than or equal to 1000000"),
+                older("0", "limit", at_least_one)
+            ),
+        ),
+    ];
+    for (fields, expected) in cases {
+        assert_eq!(check(&scan(fields)), Some(expected), "{fields}");
+    }
+}
+
+#[test]
+fn floats_and_out_of_range_integers_that_satisfy_the_constraints_are_accepted() {
+    for fields in [
+        r#""Limit": 2147483648"#,
+        r#""Limit": 9223372036854775808"#,
+        r#""Limit": 1.5"#,
+        r#""Limit": 1.0"#,
+        r#""Limit": 1e2"#,
+        r#""Segment": 1.5, "TotalSegments": 2"#,
+    ] {
+        assert_eq!(check(&scan(fields)), None, "{fields}");
+    }
+}
+
+#[test]
+fn an_entry_that_is_not_one_attribute_value_switches_to_the_older_form() {
+    let older_limit = one(&older("0", "limit", "greater than or equal to 1"));
+    for entry in [r"{}", r#"{"X": "1"}"#, r#"{"S": "x", "N": "1"}"#] {
+        let fields = format!(r#""Limit": 0, "ExpressionAttributeValues": {{":a": {entry}}}"#);
+        assert_eq!(
+            check(&scan(&fields)).as_deref(),
+            Some(older_limit.as_str()),
+            "{entry}"
+        );
+    }
+    // An empty or duplicate NS is read as an AttributeValue: the newer form.
+    for entry in [r#"{"NS": []}"#, r#"{"NS": ["1", "1"]}"#] {
+        let fields = format!(r#""Limit": 0, "ExpressionAttributeValues": {{":a": {entry}}}"#);
+        assert_eq!(check(&scan(&fields)), Some(one(LIMIT)), "{entry}");
+    }
+}
+
+/// Requests the service was not sent. The answers follow from the measured
+/// ones: every fault in one message, in the order Limit, Segment,
+/// TotalSegments, and nothing reported for a field inside its bounds.
+#[test]
+fn combinations_the_service_was_not_sent_follow_the_measured_rules() {
+    let cases = [
+        (r#""Limit": -1"#, one(LIMIT)),
+        (r#""Segment": 0, "TotalSegments": 1000001"#, one(TOTAL_HIGH)),
+        (
+            r#""Limit": 0, "TotalSegments": 1000001"#,
+            format!("2 validation errors detected: {LIMIT}; {TOTAL_HIGH}"),
+        ),
+        (
+            r#""Limit": 0, "Segment": -1"#,
+            format!("2 validation errors detected: {LIMIT}; {SEGMENT_LOW}"),
+        ),
+        (
+            r#""Limit": -1, "Segment": 1000000"#,
+            format!("2 validation errors detected: {LIMIT}; {SEGMENT_HIGH}"),
+        ),
+        (
+            r#""Limit": 0, "Segment": 1000000, "TotalSegments": 0"#,
+            format!("3 validation errors detected: {LIMIT}; {SEGMENT_HIGH}; {TOTAL_LOW}"),
+        ),
+        // A Segment that is not below TotalSegments is checked later; the
+        // Limit fault is reported alone.
+        (
+            r#""Limit": 0, "Segment": 5, "TotalSegments": 2"#,
+            one(LIMIT),
+        ),
+    ];
+    for (fields, expected) in cases {
+        assert_eq!(check(&scan(fields)), Some(expected), "{fields}");
+    }
+    for fields in [
+        r#""Limit": 2147483647"#,
+        r#""Limit": null"#,
+        r#""Segment": 999999, "TotalSegments": 1000000"#,
+    ] {
+        assert_eq!(check(&scan(fields)), None, "{fields}");
+    }
+}
diff --git a/crates/engine/src/scan_request/tests.rs b/crates/engine/src/scan_request/tests.rs
index 2ae845559..91005eb22 100644
--- a/crates/engine/src/scan_request/tests.rs
+++ b/crates/engine/src/scan_request/tests.rs
@@ -3,10 +3,8 @@
 
 //! The expected texts below were measured against the service on 2026-10-25
 //! (us-east-1, each request twice), except where a test says otherwise: the
-//! `Segment` and `TotalSegments` range texts are the previous release's (the
-//! service aggregates range faults into one message with a different form, a
-//! separate issue), and the deserializer test pins this module's hand-off, not
-//! a service text.
+//! deserializer test pins this module's hand-off, not a service text. The
+//! range constraint rows are in `range_tests`.
 
 use extenddb_core::error::DynamoDbError;
 use serde_json::{Value, json};
@@ -126,95 +124,65 @@ fn nested_numbers_and_the_other_number_faults_are_reported_with_the_service_text
 }
 
 #[test]
-fn limit_segment_and_total_segments_ranges_come_first() {
+fn range_faults_come_first() {
+    const SEGMENT_LOW: &str = "1 validation error detected: Value at 'Segment' failed to satisfy constraint: Member must have value greater than or equal to 0";
     let base = bad_number();
-    assert_eq!(
-        check(&with(base.clone(), "Limit", json!(0))).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+    for limit in [0, -1] {
+        assert_eq!(
+            check(&with(base.clone(), "Limit", json!(limit))).as_deref(),
+            Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+        );
+    }
+    // A range fault beats the parameter mix and the ReturnConsumedCapacity enum.
+    let scan_filter =
+        json!({"a": {"ComparisonOperator": "EQ", "AttributeValueList": [{"S": "x"}]}});
+    let mix = with(
+        with(base.clone(), "Segment", json!(-1)),
+        "ScanFilter",
+        scan_filter.clone(),
     );
-    assert_eq!(
-        check(&with(base.clone(), "Limit", json!(-1))).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+    assert_eq!(check(&mix).as_deref(), Some(SEGMENT_LOW));
+    let rcc = with(
+        with(base.clone(), "Segment", json!(-1)),
+        "ReturnConsumedCapacity",
+        json!("NOPE"),
     );
-    // The int32 minimum itself gets the capitalised form; below it the service
-    // saturates the value and uses the older form (measured 2026-10-25).
-    assert_eq!(
-        check(&with(base.clone(), "Limit", json!(-2_147_483_648_i64))).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+    assert_eq!(check(&rcc).as_deref(), Some(SEGMENT_LOW));
+    let rcc = with(
+        with(base.clone(), "Limit", json!(0)),
+        "ReturnConsumedCapacity",
+        json!("NOPE"),
     );
     assert_eq!(
-        check(&with(base.clone(), "Limit", json!(-2_147_483_649_i64))).as_deref(),
-        Some(
-            "1 validation error detected: Value '-2147483648' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1"
-        )
+        check(&rcc).as_deref(),
+        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
     );
-    // Each segment field is range checked when present, with or without the
-    // other one (the service's position; the texts are the previous release's).
-    for (field, value, text) in [
-        (
-            "Segment",
-            -1,
-            "1 validation error detected: Value '-1' at 'segment' failed to satisfy constraint: Member must have value greater than or equal to 0",
-        ),
-        (
-            "Segment",
-            1_000_000,
-            "1 validation error detected: Value '1000000' at 'segment' failed to satisfy constraint: Member must have value less than or equal to 999999",
-        ),
-        (
-            "TotalSegments",
-            0,
-            "The parameter TotalSegments should be greater than or equal to 1",
-        ),
-        (
-            "TotalSegments",
-            1_000_001,
-            "1 validation error detected: Value '1000001' at 'totalSegments' failed to satisfy constraint: Member must have value less than or equal to 1000000",
-        ),
-    ] {
-        assert_eq!(
-            check(&with(base.clone(), field, json!(value))).as_deref(),
-            Some(text),
-            "{field} {value}"
-        );
-        let partner = if field == "Segment" {
-            ("TotalSegments", 2)
-        } else {
-            ("Segment", 0)
-        };
-        let paired = with(
-            with(base.clone(), field, json!(value)),
-            partner.0,
-            json!(partner.1),
-        );
-        assert_eq!(
-            check(&paired).as_deref(),
-            Some(text),
-            "{field} {value} with {}",
-            partner.0
-        );
-    }
-    // Several range faults: the first in the order Limit, Segment,
-    // TotalSegments is reported.
-    let three = with(
+    // Every range fault is reported, ahead of the mix, both enums and the number.
+    let all = with(
         with(
-            with(json!({"TableName": "t"}), "Limit", json!(0)),
-            "Segment",
-            json!(-1),
+            with(with(base.clone(), "Limit", json!(0)), "Segment", json!(-1)),
+            "TotalSegments",
+            json!(0),
         ),
-        "TotalSegments",
-        json!(1_000_001),
+        "ScanFilter",
+        scan_filter.clone(),
     );
     assert_eq!(
-        check(&three).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
+        check(&all).as_deref(),
+        Some(
+            "3 validation errors detected: Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1; Value at 'Segment' failed to satisfy constraint: Member must have value greater than or equal to 0; Value at 'TotalSegments' failed to satisfy constraint: Member must have value greater than or equal to 1"
+        )
     );
-    let two = with(
-        with(json!({"TableName": "t"}), "Segment", json!(-1)),
-        "TotalSegments",
-        json!(1_000_001),
+    let mut two = with(with(base, "Limit", json!(0)), "Segment", json!(1_000_000));
+    two["ScanFilter"] = scan_filter;
+    two["ReturnConsumedCapacity"] = json!("NOPE");
+    two["Select"] = json!("NOPE");
+    assert_eq!(
+        check(&two).as_deref(),
+        Some(
+            "2 validation errors detected: Value at 'Limit' failed to satisfy constraint: Member must have value greater than or equal to 1; Value at 'Segment' failed to satisfy constraint: Member must have value less than or equal to 999999"
+        )
     );
-    assert!(check(&two).is_some_and(|m| m.contains("at 'segment'")));
     // Values at the bounds pass.
     assert!(
         check(
@@ -222,22 +190,6 @@ fn limit_segment_and_total_segments_ranges_come_first() {
         )
         .is_none()
     );
-    // A range fault beats the parameter mix and the ReturnConsumedCapacity enum.
-    let mix = with(
-        with(base.clone(), "Segment", json!(-1)),
-        "ScanFilter",
-        json!({"a": {"ComparisonOperator": "EQ", "AttributeValueList": [{"S": "x"}]}}),
-    );
-    assert!(check(&mix).is_some_and(|m| m.contains("at 'segment'")));
-    let rcc = with(
-        with(base, "Limit", json!(0)),
-        "ReturnConsumedCapacity",
-        json!("NOPE"),
-    );
-    assert_eq!(
-        check(&rcc).as_deref(),
-        Some(&*format!("1 validation error detected: {LIMIT_RANGE}"))
-    );
 }
 
 #[test]
diff --git a/tests/python/test_scan_range_constraints.py b/tests/python/test_scan_range_constraints.py
new file mode 100644
index 000000000..aad2375b9
--- /dev/null
+++ b/tests/python/test_scan_range_constraints.py
@@ -0,0 +1,234 @@
+# Copyright 2026 ExtendDB contributors
+# SPDX-License-Identifier: Apache-2.0
+
+"""Scan range constraints on ``Limit``, ``Segment`` and ``TotalSegments``.
+
+Every request below is sent as raw signed JSON, so a number keeps the form
+written here (``0.0``, ``1e2``, ``9223372036854775808``). Each request is a
+row of the table measured against DynamoDB (us-east-1) on 2026-10-25 at 09:23,
+09:25, 09:28, 10:38, 10:55 and 12:56 UTC, each sent twice, and each expected
+answer is the service's. Where that table records only that the service
+accepted a request, the test asserts what a Scan with that limit returns on
+this table of 12 items.
+
+When each field present is an integer inside the int32 range, a fault reads
+``Value at '<Field>' failed to satisfy constraint: ...`` with the field
+capitalised and no value echoed, and several faults are reported in one
+message in the order Limit, Segment, TotalSegments. When a field is a float
+or outside int32, or an ``ExpressionAttributeValues`` entry is not one
+AttributeValue, the service saturates or truncates the value and uses the
+older form, ``Value '<n>' at '<field>' ...``, with ``limit`` last. A float or
+an out-of-range integer that satisfies the constraint is accepted.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+from botocore.awsrequest import AWSRequest
+
+from helpers import unique_name, wait_for_active, wait_for_deleted
+
+ITEMS = 12
+
+LIMIT = (
+    "Value at 'Limit' failed to satisfy constraint: "
+    "Member must have value greater than or equal to 1"
+)
+SEGMENT_LOW = (
+    "Value at 'Segment' failed to satisfy constraint: "
+    "Member must have value greater than or equal to 0"
+)
+SEGMENT_HIGH = (
+    "Value at 'Segment' failed to satisfy constraint: "
+    "Member must have value less than or equal to 999999"
+)
+TOTAL_LOW = (
+    "Value at 'TotalSegments' failed to satisfy constraint: "
+    "Member must have value greater than or equal to 1"
+)
+TOTAL_HIGH = (
+    "Value at 'TotalSegments' failed to satisfy constraint: "
+    "Member must have value less than or equal to 1000000"
+)
+
+
+def one(clause: str) -> str:
+    return "1 validation error detected: " + clause
+
+
+def older(value: str, field: str, constraint: str) -> str:
+    return (
+        f"Value '{value}' at '{field}' failed to satisfy constraint: "
+        f"Member must have value {constraint}"
+    )
+
+
+OLDER_LIMIT_0 = older("0", "limit", "greater than or equal to 1")
+OLDER_LIMIT_MIN = older("-2147483648", "limit", "greater than or equal to 1")
+
+# (id, the fields after TableName as JSON text, the expected message)
+NEWER_FORM = [
+    ("Limit-0", '"Limit": 0', one(LIMIT)),
+    ("Limit-int32-min", '"Limit": -2147483648', one(LIMIT)),
+    ("Segment-minus-1", '"Segment": -1', one(SEGMENT_LOW)),
+    ("Segment-minus-1-of-2", '"Segment": -1, "TotalSegments": 2', one(SEGMENT_LOW)),
+    ("Segment-1000000-of-1000000", '"Segment": 1000000, "TotalSegments": 1000000',
+     one(SEGMENT_HIGH)),
+    ("TotalSegments-0", '"TotalSegments": 0', one(TOTAL_LOW)),
+    ("TotalSegments-0-Segment-0", '"Segment": 0, "TotalSegments": 0', one(TOTAL_LOW)),
+    ("TotalSegments-minus-1-Segment-0", '"Segment": 0, "TotalSegments": -1', one(TOTAL_LOW)),
+    ("TotalSegments-1000001", '"TotalSegments": 1000001', one(TOTAL_HIGH)),
+    ("Limit-Segment-TotalSegments", '"Limit": 0, "Segment": -1, "TotalSegments": 1000001',
+     f"3 validation errors detected: {LIMIT}; {SEGMENT_LOW}; {TOTAL_HIGH}"),
+    ("Limit-TotalSegments", '"Limit": 0, "TotalSegments": 0',
+     f"2 validation errors detected: {LIMIT}; {TOTAL_LOW}"),
+    ("Segment-low-TotalSegments-high", '"Segment": -1, "TotalSegments": 1000001',
+     f"2 validation errors detected: {SEGMENT_LOW}; {TOTAL_HIGH}"),
+    ("Segment-high-TotalSegments-low", '"Segment": 1000000, "TotalSegments": 0',
+     f"2 validation errors detected: {SEGMENT_HIGH}; {TOTAL_LOW}"),
+]
+
+OLDER_FORM = [
+    ("Limit-below-int32", '"Limit": -2147483649', one(OLDER_LIMIT_MIN)),
+    ("TotalSegments-above-int32", '"Segment": 0, "TotalSegments": 2147483648',
+     one(older("2147483647", "totalSegments", "less than or equal to 1000000"))),
+    ("Limit-0.0", '"Limit": 0.0', one(OLDER_LIMIT_0)),
+    ("Limit-below-int32-Segment-minus-1", '"Limit": -2147483649, "Segment": -1',
+     "2 validation errors detected: "
+     f"{older('-1', 'segment', 'greater than or equal to 0')}; {OLDER_LIMIT_MIN}"),
+    ("TotalSegments-1000001-Limit-0.0", '"TotalSegments": 1000001, "Limit": 0.0',
+     "2 validation errors detected: "
+     f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; {OLDER_LIMIT_0}"),
+]
+
+# ExpressionAttributeValues entries the service does not read as one
+# AttributeValue (older form beside Limit 0), and two it does (newer form).
+UNREADABLE = [("empty", {}), ("unknown-type", {"X": "1"}), ("two-types", {"S": "x", "N": "1"})]
+READABLE = [("empty-NS", {"NS": []}), ("duplicate-NS", {"NS": ["1", "1"]})]
+
+
+def _raw(client, operation: str, body_text: str):
+    """POST ``body_text`` exactly as written, signed with the client's credentials."""
+    req = AWSRequest(method="POST", url=client.meta.endpoint_url, data=body_text,
+                     headers={"Content-Type": "application/x-amz-json-1.0",
+                              "X-Amz-Target": f"DynamoDB_20120810.{operation}"})
+    client._request_signer.sign(operation, req)
+    resp = client._endpoint.http_session.send(req.prepare())
+    return resp.status_code, json.loads(resp.content.decode("utf-8", "replace") or "{}")
+
+
+def _scan(client, table: str, fields: str):
+    return _raw(client, "Scan", '{"TableName": %s, %s}' % (json.dumps(table), fields))
+
+
+def _validation_message(status: int, payload: dict) -> str:
+    assert status == 400, payload
+    assert payload.get("__type", "").endswith("ValidationException"), payload
+    return payload.get("message", payload.get("Message"))
+
+
+@pytest.fixture(scope="module")
+def table(dynamodb_client):
+    """pk S, sk S, with ITEMS items."""
+    name = unique_name("scanrange")
+    dynamodb_client.create_table(
+        TableName=name,
+        AttributeDefinitions=[
+            {"AttributeName": "pk", "AttributeType": "S"},
+            {"AttributeName": "sk", "AttributeType": "S"},
+        ],
+        KeySchema=[
+            {"AttributeName": "pk", "KeyType": "HASH"},
+            {"AttributeName": "sk", "KeyType": "RANGE"},
+        ],
+        BillingMode="PAY_PER_REQUEST",
+    )
+    wait_for_active(dynamodb_client, name)
+    for i in range(ITEMS):
+        dynamodb_client.put_item(TableName=name, Item={
+            "pk": {"S": f"p{i}"}, "sk": {"S": "s"}, "a": {"N": str(i)}})
+    yield name
+    dynamodb_client.delete_table(TableName=name)
+    wait_for_deleted(dynamodb_client, name)
+
+
+class TestIntegersInsideInt32:
+    """The newer form, every fault in one message, Limit, Segment, TotalSegments."""
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in NEWER_FORM],
+                             ids=[r[0] for r in NEWER_FORM])
+    def test_rows(self, dynamodb_client, table, fields, expected):
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == expected
+
+
+class TestFloatsAndValuesOutsideInt32:
+    """The older form: the value saturated or truncated and echoed, limit last."""
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in OLDER_FORM],
+                             ids=[r[0] for r in OLDER_FORM])
+    def test_rows(self, dynamodb_client, table, fields, expected):
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == expected
+
+
+class TestFloatsAndValuesOutsideInt32AreAccepted:
+    """A value that satisfies its constraint once saturated or truncated is
+    accepted and used as saturated or truncated."""
+
+    @pytest.mark.parametrize("fields", [
+        '"Limit": 2147483648', '"Limit": 9223372036854775808', '"Limit": 1e2',
+    ], ids=["Limit-2147483648", "Limit-2-to-the-63", "Limit-1e2"])
+    def test_large_limits_are_accepted(self, dynamodb_client, table, fields):
+        status, payload = _scan(dynamodb_client, table, fields + ', "ConsistentRead": true')
+        assert status == 200, payload
+        assert (payload["Count"], payload["ScannedCount"]) == (ITEMS, ITEMS)
+
+    @pytest.mark.parametrize("fields", ['"Limit": 1.5', '"Limit": 1.0'],
+                             ids=["Limit-1.5", "Limit-1.0"])
+    def test_a_fractional_limit_is_truncated(self, dynamodb_client, table, fields):
+        status, payload = _scan(dynamodb_client, table, fields + ', "ConsistentRead": true')
+        assert status == 200, payload
+        assert (payload["Count"], payload["ScannedCount"]) == (1, 1)
+
+    def test_a_fractional_segment_is_truncated(self, dynamodb_client, table):
+        # The TotalSegments of 2 is this test's; the table records only Segment 1.5.
+        status, half = _scan(dynamodb_client, table,
+                             '"Segment": 1.5, "TotalSegments": 2, "ConsistentRead": true')
+        assert status == 200, half
+        status, whole = _scan(dynamodb_client, table,
+                              '"Segment": 1, "TotalSegments": 2, "ConsistentRead": true')
+        assert status == 200, whole
+
+        def keys(page):
+            return sorted(item["pk"]["S"] for item in page["Items"])
+
+        assert keys(whole), "segment 1 of 2 holds at least one item"
+        assert keys(half) == keys(whole)
+
+
+class TestBesideAnExpressionAttributeValuesEntry:
+    """Limit 0 beside an entry that is not one AttributeValue answers the older
+    form on Scan and on Query (measured 12:56 UTC); beside an empty or a
+    duplicate NS, the newer form."""
+
+    @pytest.mark.parametrize("entry", [e for _, e in UNREADABLE], ids=[i for i, _ in UNREADABLE])
+    def test_scan_unreadable_entry(self, dynamodb_client, table, entry):
+        fields = '"Limit": 0, "ExpressionAttributeValues": ' + json.dumps({":a": entry})
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == one(OLDER_LIMIT_0)
+
+    @pytest.mark.parametrize("entry", [e for _, e in READABLE], ids=[i for i, _ in READABLE])
+    def test_scan_readable_entry(self, dynamodb_client, table, entry):
+        fields = '"Limit": 0, "ExpressionAttributeValues": ' + json.dumps({":a": entry})
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == one(LIMIT)
+
+    @pytest.mark.parametrize("entry, expected",
+                             [(e, one(OLDER_LIMIT_0)) for _, e in UNREADABLE]
+                             + [(e, one(LIMIT)) for _, e in READABLE],
+                             ids=[i for i, _ in UNREADABLE] + [i for i, _ in READABLE])
+    def test_query(self, dynamodb_client, table, entry, expected):
+        body = json.dumps({
+            "TableName": table, "KeyConditionExpression": "pk = :p", "Limit": 0,
+            "ExpressionAttributeValues": {":p": {"S": "p0"}, ":a": entry},
+        })
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == expected
diff --git a/tests/test_query_scan.py b/tests/test_query_scan.py
index 44a82f4a2..f75a88c27 100755
--- a/tests/test_query_scan.py
+++ b/tests/test_query_scan.py
@@ -614,17 +614,17 @@ def test_scan_segment_at_max_accepted(self, dynamodb_client, scan_table):
     def test_scan_segment_one_over_max_rejected(
         self, dynamodb_client_no_validation, scan_table
     ):
-        """Segment > 999999 returns the Coral-format ValidationException."""
+        """Segment > 999999 answers the range constraint, field capitalised and no value echoed."""
         with pytest.raises(ClientError) as exc_info:
             dynamodb_client_no_validation.scan(
                 TableName=scan_table, Segment=1_000_000, TotalSegments=1_000_000
             )
         err = exc_info.value.response["Error"]
         assert err["Code"] == "ValidationException"
-        msg = err["Message"]
-        assert "1 validation error detected" in msg
-        assert "'1000000' at 'segment'" in msg
-        assert "Member must have value less than or equal to 999999" in msg
+        assert err["Message"] == (
+            "1 validation error detected: Value at 'Segment' failed to satisfy "
+            "constraint: Member must have value less than or equal to 999999"
+        )
 
     def test_scan_total_segments_at_max_accepted(self, dynamodb_client, scan_table):
         """TotalSegments=1000000 with Segment=0 is at the documented bound."""
@@ -635,17 +635,17 @@ def test_scan_total_segments_at_max_accepted(self, dynamodb_client, scan_table):
     def test_scan_total_segments_one_over_max_rejected(
         self, dynamodb_client_no_validation, scan_table
     ):
-        """TotalSegments > 1000000 returns the Coral-format ValidationException."""
+        """TotalSegments > 1000000 answers the range constraint, field capitalised and no value echoed."""
         with pytest.raises(ClientError) as exc_info:
             dynamodb_client_no_validation.scan(
                 TableName=scan_table, Segment=0, TotalSegments=1_000_001
             )
         err = exc_info.value.response["Error"]
         assert err["Code"] == "ValidationException"
-        msg = err["Message"]
-        assert "1 validation error detected" in msg
-        assert "'1000001' at 'totalSegments'" in msg
-        assert "Member must have value less than or equal to 1000000" in msg
+        assert err["Message"] == (
+            "1 validation error detected: Value at 'TotalSegments' failed to satisfy "
+            "constraint: Member must have value less than or equal to 1000000"
+        )
 
     def test_scan_all_projected_attributes_without_index_rejected(
         self, dynamodb_client, scan_table

From 32aee558a1d0c189701f9ca6b6d5f97cfbaccd67 Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sat, 31 Oct 2026 12:27:00 +0000
Subject: [PATCH 2/3] fix(scan): reverse the older-form range fault order and
 read L and M members

Measured against the service on 2026-10-30 at 12:40 UTC, each request
sent twice, as a raw signed Scan:

- A fault in each of Limit, Segment and TotalSegments in the older form
  (Limit 0.0, Segment -1, TotalSegments 1000001, and the same with
  TotalSegments 1000001.0 and Limit 0) answers "3 validation errors
  detected: Value '1000001' at 'totalSegments' ...; Value '-1' at
  'segment' ...; Value '0' at 'limit' ...". The older form lists the
  faults in the reverse of the newer form's order, which agrees with the
  two-fault rows measured on 2026-10-25. The check put segment ahead of
  totalSegments.
- Limit 0 beside an ExpressionAttributeValues entry {"L": [{}]} or
  {"M": {"k": {"X": "1"}}} answers the older form, Value '0' at 'limit'.
  The check read only the top level of each entry and answered the
  newer form. Query reads the entries with the same function, so its
  answer to Limit 0 beside these entries changes too.
- Limit -1.5 answers Value '-1', and Limit -0.5 and Limit -0 answer
  Value '0'. The check already answered these as measured.

The tests send each measured row. The rows no test sent before were
measured on 2026-10-31 at 12:36 UTC, each request sent twice, and the
tests cite that measurement: Limit 0 beside a readable entry of each of
the ten types answers the newer form, Segment 0 with TotalSegments 1
returns the whole table, a Query with Limit -2147483649 beside an empty
entry echoes -2147483648 in the older form, and a Query with Limit 0
beside the two nested entries or the lower-case descriptor answers the
older form. The combinations test, which said its rows were not sent,
is renamed for what it checks: every fault in one message, and nothing
reported for a field inside its bounds; its eleven rows were measured
the same day.
---
 crates/core/src/types/query.rs                |   7 +-
 crates/engine/src/query_key_values.rs         |  49 ++++++---
 crates/engine/src/query_key_values/tests.rs   |   7 +-
 crates/engine/src/scan_request.rs             |  18 ++--
 crates/engine/src/scan_request/range_tests.rs | 102 ++++++++++++++++--
 tests/python/test_scan_range_constraints.py   |  70 ++++++++++--
 6 files changed, 211 insertions(+), 42 deletions(-)

diff --git a/crates/core/src/types/query.rs b/crates/core/src/types/query.rs
index 695c63928..70cb53186 100755
--- a/crates/core/src/types/query.rs
+++ b/crates/core/src/types/query.rs
@@ -191,7 +191,9 @@ pub struct ScanInput {
 /// item, `Limit: 1e2`, `Limit: 2147483648` and `Limit: 9223372036854775808`
 /// are accepted, `Segment: 1.5` of `TotalSegments: 2` returns the items of
 /// segment 1, `Limit: 0.0` is reported as `0`, `Limit: -2147483649` as
-/// `-2147483648` and `TotalSegments: 2147483648` as `2147483647`.
+/// `-2147483648` and `TotalSegments: 2147483648` as `2147483647`. Measured
+/// 2026-10-30 12:40 UTC: `Limit: -1.5` is reported as `-1`, and `Limit: -0.5`
+/// and `Limit: -0` as `0`.
 #[must_use]
 pub fn saturated_int32(number: &serde_json::Number) -> i32 {
     if let Some(value) = number.as_i64() {
@@ -255,6 +257,9 @@ mod tests {
             ("1.5", 1),
             ("1.0", 1),
             ("0.0", 0),
+            ("-1.5", -1),
+            ("-0.5", 0),
+            ("-0", 0),
             ("1e2", 100),
             ("1e40", i32::MAX),
             ("-1e40", i32::MIN),
diff --git a/crates/engine/src/query_key_values.rs b/crates/engine/src/query_key_values.rs
index 56408ef64..d508f01b5 100644
--- a/crates/engine/src/query_key_values.rs
+++ b/crates/engine/src/query_key_values.rs
@@ -208,25 +208,42 @@ pub(crate) fn non_empty(body: &Value, field: &str) -> bool {
 const TYPE_DESCRIPTORS: &[&str] = &["S", "N", "B", "SS", "NS", "BS", "M", "L", "NULL", "BOOL"];
 
 /// Whether an `ExpressionAttributeValues` entry is an object that is not one
-/// AttributeValue: empty, with a type descriptor the service does not have, or
-/// with more than one. Beside such an entry the service reports a range fault
-/// in its older form (measured 2026-10-25 12:56 UTC: `Limit: 0` beside `{}`,
-/// `{"X": "1"}` or `{"S": "x", "N": "1"}` answers `Value '0' at 'limit'` on
-/// Query and Scan, and beside an empty or duplicate `NS` the newer form). An
-/// entry that is not an object is a shape fault, reported ahead of the checks.
+/// AttributeValue: empty, with a type descriptor the service does not have
+/// (a lower-case `s` included), or with more than one, at the top or as a
+/// member of an `L` or `M` at any depth. Beside such an entry the service
+/// reports a range fault in its older form (measured 2026-10-25 12:56 UTC:
+/// `Limit: 0` beside `{}`, `{"X": "1"}` or `{"S": "x", "N": "1"}` answers
+/// `Value '0' at 'limit'` on Query and Scan, and beside an empty or duplicate
+/// `NS` the newer form; measured 2026-10-30 12:40 UTC on Scan and 2026-10-31
+/// 12:36 UTC on Query: beside `{"L": [{}]}`, `{"M": {"k": {"X": "1"}}}` or
+/// `{"s": "x"}`, the older form).
+/// An entry that is not an object is a shape fault, reported ahead of the
+/// checks.
 pub(crate) fn has_unreadable_attribute_value(body: &Value) -> bool {
     body.get("ExpressionAttributeValues")
         .and_then(Value::as_object)
-        .is_some_and(|values| {
-            values.values().any(|entry| {
-                entry.as_object().is_some_and(|descriptors| {
-                    descriptors.len() != 1
-                        || descriptors
-                            .keys()
-                            .any(|key| !TYPE_DESCRIPTORS.contains(&key.as_str()))
-                })
-            })
-        })
+        .is_some_and(|values| values.values().any(is_unreadable_attribute_value))
+}
+
+/// Whether `entry` is an object that is not one AttributeValue, or an `L` or
+/// `M` with such a member; see [`has_unreadable_attribute_value`].
+fn is_unreadable_attribute_value(entry: &Value) -> bool {
+    let Some(descriptors) = entry.as_object() else {
+        return false;
+    };
+    let mut fields = descriptors.iter();
+    match (fields.next(), fields.next()) {
+        (Some((descriptor, value)), None) => match descriptor.as_str() {
+            "L" => value
+                .as_array()
+                .is_some_and(|members| members.iter().any(is_unreadable_attribute_value)),
+            "M" => value
+                .as_object()
+                .is_some_and(|members| members.values().any(is_unreadable_attribute_value)),
+            descriptor => !TYPE_DESCRIPTORS.contains(&descriptor),
+        },
+        _ => true,
+    }
 }
 
 /// Refuse the first `N` value in `ExpressionAttributeValues` (including `NS`
diff --git a/crates/engine/src/query_key_values/tests.rs b/crates/engine/src/query_key_values/tests.rs
index e48eec7fb..179014e7c 100644
--- a/crates/engine/src/query_key_values/tests.rs
+++ b/crates/engine/src/query_key_values/tests.rs
@@ -566,11 +566,16 @@ fn a_shape_fault_in_another_field_is_reported_ahead_of_the_checks() {
     // unknown type descriptor, which the deserializer reports as a
     // SerializationException, an empty one or one with two descriptors): the
     // service answers the Limit ValidationException in its older form, with
-    // the value echoed (measured 2026-10-25 12:56 UTC).
+    // the value echoed (measured 2026-10-25 12:56 UTC). An unreadable member
+    // of an L or M and a lower-case descriptor do the same (measured on Scan
+    // 2026-10-30 12:40 UTC and on Query 2026-10-31 12:36 UTC).
     for entry in [
         serde_json::json!({"X": "1"}),
         serde_json::json!({}),
         serde_json::json!({"S": "x", "N": "1"}),
+        serde_json::json!({"L": [{}]}),
+        serde_json::json!({"M": {"k": {"X": "1"}}}),
+        serde_json::json!({"s": "x"}),
     ] {
         let unreadable = serde_json::json!({
             "TableName": "t", "KeyConditionExpression": "pk = :p",
diff --git a/crates/engine/src/scan_request.rs b/crates/engine/src/scan_request.rs
index 21b16169b..fa78eac66 100644
--- a/crates/engine/src/scan_request.rs
+++ b/crates/engine/src/scan_request.rs
@@ -4,7 +4,7 @@
 //! The `Scan` checks that run on the request body alone, before the body is
 //! deserialized and before the table is looked up, in the service's order.
 //!
-//! Measured 2026-10-25 (us-east-1, each request twice):
+//! Measured 2026-10-25 and 2026-10-30 (us-east-1, each request twice):
 //!
 //! 1. the range constraints on `Limit` (at least 1), `Segment` (0 to 999999)
 //!    and `TotalSegments` (1 to 1000000), each checked when present, whether or
@@ -15,8 +15,8 @@
 //!    `TotalSegments`. A float or a value outside int32 in any of the three,
 //!    or an `ExpressionAttributeValues` entry that is not one AttributeValue,
 //!    switches the message to the older form, `Value '-2147483648' at 'limit'
-//!    ...`, with the value saturated or truncated and `limit` last; see
-//!    `validate_ranges`;
+//!    ...`, with the value saturated or truncated, in the order
+//!    `totalSegments`, `segment`, `limit`; see `validate_ranges`;
 //! 2. the expression and non-expression parameter mix;
 //! 3. the `ReturnConsumedCapacity` enum;
 //! 4. every number in `ExpressionAttributeValues`, `NS` members and values
@@ -127,9 +127,10 @@ fn scan_request_checks(body: &Value) -> Result<(), DynamoDbError> {
 /// `ExpressionAttributeValues` entry is not one AttributeValue (see
 /// [`has_unreadable_attribute_value`]), the older form: `Value '<n>' at
 /// '<field>' ...` with the value as [`saturated_int32`] reads it and the field
-/// in lower camel case, with `limit` last. The service's order of `segment`
-/// and `totalSegments` in the older form is not measured; they keep the order
-/// of the newer form.
+/// in lower camel case, in the reverse of the newer form's order:
+/// `totalSegments`, `segment`, `limit` (measured 2026-10-30 12:40 UTC with a
+/// fault in each of the three, and on 2026-10-25 with `segment` then `limit`
+/// and `totalSegments` then `limit`).
 fn validate_ranges(body: &Value) -> Result<(), DynamoDbError> {
     let numbers: Vec<(&RangeField, &serde_json::Number)> = RANGE_FIELDS
         .iter()
@@ -145,7 +146,7 @@ fn validate_ranges(body: &Value) -> Result<(), DynamoDbError> {
                 .as_i64()
                 .is_none_or(|value| i32::try_from(value).is_err())
         });
-    let mut faults: Vec<(&RangeField, i32, String)> = numbers
+    let faults: Vec<(&RangeField, i32, String)> = numbers
         .into_iter()
         .filter_map(|(range, number)| {
             let value = saturated_int32(number);
@@ -167,10 +168,9 @@ fn validate_ranges(body: &Value) -> Result<(), DynamoDbError> {
         return Ok(());
     }
     let clauses: Vec<String> = if older_form {
-        // `limit` last; the stable sort keeps `segment` ahead of `totalSegments`.
-        faults.sort_by_key(|(range, ..)| range.field == "Limit");
         faults
             .iter()
+            .rev()
             .map(|(range, value, constraint)| {
                 format!(
                     "Value '{value}' at '{}' failed to satisfy constraint: Member must have value {constraint}",
diff --git a/crates/engine/src/scan_request/range_tests.rs b/crates/engine/src/scan_request/range_tests.rs
index 0ead01928..eeb7592d5 100644
--- a/crates/engine/src/scan_request/range_tests.rs
+++ b/crates/engine/src/scan_request/range_tests.rs
@@ -3,10 +3,10 @@
 
 //! The range constraints on `Limit`, `Segment` and `TotalSegments`.
 //!
-//! The rows in every test but the last are requests sent to the service on
-//! 2026-10-25 (us-east-1, 09:23 to 12:56 UTC, each request twice, a Scan of an
-//! existing table) with the answers it gave. The last test applies the same
-//! rules to requests that were not sent.
+//! Every row is a request sent to the service (us-east-1, each request twice,
+//! a Scan of an existing table) with the answer it gave: on 2026-10-25 between
+//! 09:23 and 12:56 UTC, and on 2026-10-30 at 12:40 UTC or 2026-10-31 at 12:36
+//! UTC where a test says so.
 
 use extenddb_core::error::DynamoDbError;
 use serde_json::Value;
@@ -151,11 +151,96 @@ fn an_entry_that_is_not_one_attribute_value_switches_to_the_older_form() {
     }
 }
 
-/// Requests the service was not sent. The answers follow from the measured
-/// ones: every fault in one message, in the order Limit, Segment,
-/// TotalSegments, and nothing reported for a field inside its bounds.
+/// Measured 2026-10-30 12:40 UTC: a fault in each of the three fields in the
+/// older form is reported `totalSegments`, `segment`, `limit`, whichever field
+/// is the float.
 #[test]
-fn combinations_the_service_was_not_sent_follow_the_measured_rules() {
+fn three_older_form_faults_are_reported_total_segments_segment_limit() {
+    let expected = format!(
+        "3 validation errors detected: {}; {}; {}",
+        older("1000001", "totalSegments", "less than or equal to 1000000"),
+        older("-1", "segment", "greater than or equal to 0"),
+        older("0", "limit", "greater than or equal to 1")
+    );
+    for fields in [
+        r#""Limit": 0.0, "Segment": -1, "TotalSegments": 1000001"#,
+        r#""Limit": 0, "Segment": -1, "TotalSegments": 1000001.0"#,
+    ] {
+        assert_eq!(
+            check(&scan(fields)).as_deref(),
+            Some(expected.as_str()),
+            "{fields}"
+        );
+    }
+}
+
+/// Measured 2026-10-30 12:40 UTC: a negative fraction is truncated toward
+/// zero, and `-0` is read as 0.
+#[test]
+fn a_negative_fraction_is_truncated_toward_zero() {
+    for (fields, value) in [
+        (r#""Limit": -1.5"#, "-1"),
+        (r#""Limit": -0.5"#, "0"),
+        (r#""Limit": -0"#, "0"),
+    ] {
+        assert_eq!(
+            check(&scan(fields)),
+            Some(one(&older(value, "limit", "greater than or equal to 1"))),
+            "{fields}"
+        );
+    }
+}
+
+/// Measured 2026-10-30 12:40 UTC: an unreadable member of an `L` or an `M`
+/// entry, and a lower-case type descriptor, switch to the older form. Each
+/// entry sits under `:d` beside a filter that reads `:p`, as sent.
+#[test]
+fn an_unreadable_member_of_a_list_or_map_entry_switches_to_the_older_form() {
+    let older_limit = one(&older("0", "limit", "greater than or equal to 1"));
+    for entry in [
+        r#"{"L": [{}]}"#,
+        r#"{"M": {"k": {"X": "1"}}}"#,
+        r#"{"s": "x"}"#,
+    ] {
+        let fields = format!(
+            r#""Limit": 0, "FilterExpression": "a = :p", "ExpressionAttributeValues": {{":p": {{"S": "x"}}, ":d": {entry}}}"#
+        );
+        assert_eq!(
+            check(&scan(&fields)).as_deref(),
+            Some(older_limit.as_str()),
+            "{entry}"
+        );
+    }
+}
+
+/// Measured 2026-10-31 12:36 UTC: `Limit: 0` beside a readable entry of each
+/// type, and beside an `L` and an `M` whose members are readable, keeps the
+/// newer form, as the empty and duplicate `NS` measured on 2026-10-25 do.
+#[test]
+fn a_readable_entry_of_any_type_keeps_the_newer_form() {
+    for entry in [
+        r#"{"S": "x"}"#,
+        r#"{"N": "1"}"#,
+        r#"{"B": "AA=="}"#,
+        r#"{"SS": ["x"]}"#,
+        r#"{"NS": ["1"]}"#,
+        r#"{"BS": ["AA=="]}"#,
+        r#"{"M": {"k": {"S": "x"}}}"#,
+        r#"{"L": [{"N": "1"}, {"L": []}]}"#,
+        r#"{"NULL": true}"#,
+        r#"{"BOOL": false}"#,
+    ] {
+        let fields = format!(r#""Limit": 0, "ExpressionAttributeValues": {{":a": {entry}}}"#);
+        assert_eq!(check(&scan(&fields)), Some(one(LIMIT)), "{entry}");
+    }
+}
+
+/// Measured 2026-10-31 12:36 UTC: every fault in one message, in the order
+/// Limit, Segment, TotalSegments, and nothing reported for a field inside its
+/// bounds. `Segment: 0, TotalSegments: 1` was sent with `ConsistentRead: true`
+/// and returned the whole table in one page.
+#[test]
+fn every_fault_is_reported_in_one_message_and_a_field_inside_its_bounds_is_not() {
     let cases = [
         (r#""Limit": -1"#, one(LIMIT)),
         (r#""Segment": 0, "TotalSegments": 1000001"#, one(TOTAL_HIGH)),
@@ -188,6 +273,7 @@ fn combinations_the_service_was_not_sent_follow_the_measured_rules() {
     for fields in [
         r#""Limit": 2147483647"#,
         r#""Limit": null"#,
+        r#""Segment": 0, "TotalSegments": 1"#,
         r#""Segment": 999999, "TotalSegments": 1000000"#,
     ] {
         assert_eq!(check(&scan(fields)), None, "{fields}");
diff --git a/tests/python/test_scan_range_constraints.py b/tests/python/test_scan_range_constraints.py
index aad2375b9..e621a57d5 100644
--- a/tests/python/test_scan_range_constraints.py
+++ b/tests/python/test_scan_range_constraints.py
@@ -6,19 +6,23 @@
 Every request below is sent as raw signed JSON, so a number keeps the form
 written here (``0.0``, ``1e2``, ``9223372036854775808``). Each request is a
 row of the table measured against DynamoDB (us-east-1) on 2026-10-25 at 09:23,
-09:25, 09:28, 10:38, 10:55 and 12:56 UTC, each sent twice, and each expected
-answer is the service's. Where that table records only that the service
-accepted a request, the test asserts what a Scan with that limit returns on
-this table of 12 items.
+09:25, 09:28, 10:38, 10:55 and 12:56 UTC, or of the ones measured on
+2026-10-30 at 12:40 UTC and 2026-10-31 at 12:36 UTC where a row says so, each
+sent twice, and each expected answer is the service's. Where a table records
+only that the service accepted a request, the test asserts what a Scan with
+that limit returns on this table of 12 items. ``Segment: 0, TotalSegments: 1``
+with ``ConsistentRead: true`` returned the whole table in one page on
+2026-10-31, and the test asserts the same here.
 
 When each field present is an integer inside the int32 range, a fault reads
 ``Value at '<Field>' failed to satisfy constraint: ...`` with the field
 capitalised and no value echoed, and several faults are reported in one
 message in the order Limit, Segment, TotalSegments. When a field is a float
 or outside int32, or an ``ExpressionAttributeValues`` entry is not one
-AttributeValue, the service saturates or truncates the value and uses the
-older form, ``Value '<n>' at '<field>' ...``, with ``limit`` last. A float or
-an out-of-range integer that satisfies the constraint is accepted.
+AttributeValue (an ``L`` or ``M`` member included), the service saturates or
+truncates the value and uses the older form, ``Value '<n>' at '<field>' ...``,
+in the order totalSegments, segment, limit. A float or an out-of-range integer
+that satisfies the constraint is accepted.
 """
 
 from __future__ import annotations
@@ -101,12 +105,31 @@ def older(value: str, field: str, constraint: str) -> str:
     ("TotalSegments-1000001-Limit-0.0", '"TotalSegments": 1000001, "Limit": 0.0',
      "2 validation errors detected: "
      f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; {OLDER_LIMIT_0}"),
+    # Measured 2026-10-30 12:40 UTC.
+    ("three-faults-Limit-0.0", '"Limit": 0.0, "Segment": -1, "TotalSegments": 1000001',
+     "3 validation errors detected: "
+     f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; "
+     f"{older('-1', 'segment', 'greater than or equal to 0')}; {OLDER_LIMIT_0}"),
+    ("three-faults-TotalSegments-1000001.0",
+     '"Limit": 0, "Segment": -1, "TotalSegments": 1000001.0',
+     "3 validation errors detected: "
+     f"{older('1000001', 'totalSegments', 'less than or equal to 1000000')}; "
+     f"{older('-1', 'segment', 'greater than or equal to 0')}; {OLDER_LIMIT_0}"),
+    ("Limit-minus-1.5", '"Limit": -1.5',
+     one(older("-1", "limit", "greater than or equal to 1"))),
+    ("Limit-minus-0.5", '"Limit": -0.5', one(OLDER_LIMIT_0)),
+    ("Limit-minus-0", '"Limit": -0', one(OLDER_LIMIT_0)),
 ]
 
 # ExpressionAttributeValues entries the service does not read as one
 # AttributeValue (older form beside Limit 0), and two it does (newer form).
 UNREADABLE = [("empty", {}), ("unknown-type", {"X": "1"}), ("two-types", {"S": "x", "N": "1"})]
 READABLE = [("empty-NS", {"NS": []}), ("duplicate-NS", {"NS": ["1", "1"]})]
+# Measured 2026-10-30 12:40 UTC on Scan, each under :d beside a filter that
+# reads :p: older form.
+UNREADABLE_MEMBERS = [("L-empty-member", {"L": [{}]}),
+                      ("M-member-type-X", {"M": {"k": {"X": "1"}}}),
+                      ("lower-case-s", {"s": "x"})]
 
 
 def _raw(client, operation: str, body_text: str):
@@ -206,6 +229,12 @@ def keys(page):
         assert keys(whole), "segment 1 of 2 holds at least one item"
         assert keys(half) == keys(whole)
 
+    def test_segment_0_of_1_returns_every_item(self, dynamodb_client, table):
+        status, payload = _scan(dynamodb_client, table,
+                                '"Segment": 0, "TotalSegments": 1, "ConsistentRead": true')
+        assert status == 200, payload
+        assert (payload["Count"], payload["ScannedCount"]) == (ITEMS, ITEMS)
+
 
 class TestBesideAnExpressionAttributeValuesEntry:
     """Limit 0 beside an entry that is not one AttributeValue answers the older
@@ -232,3 +261,30 @@ def test_query(self, dynamodb_client, table, entry, expected):
             "ExpressionAttributeValues": {":p": {"S": "p0"}, ":a": entry},
         })
         assert _validation_message(*_raw(dynamodb_client, "Query", body)) == expected
+
+    def test_query_limit_below_int32_beside_an_empty_entry(self, dynamodb_client, table):
+        # Measured 2026-10-31 12:36 UTC: the echoed value is saturated to
+        # int32, as the Scan row Limit -2147483649 is.
+        body = json.dumps({
+            "TableName": table, "KeyConditionExpression": "pk = :p", "Limit": -2147483649,
+            "ExpressionAttributeValues": {":p": {"S": "p0"}, ":a": {}},
+        })
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == one(OLDER_LIMIT_MIN)
+
+    @pytest.mark.parametrize("entry", [e for _, e in UNREADABLE_MEMBERS],
+                             ids=[i for i, _ in UNREADABLE_MEMBERS])
+    def test_scan_unreadable_member(self, dynamodb_client, table, entry):
+        fields = ('"Limit": 0, "FilterExpression": "a = :p", "ExpressionAttributeValues": '
+                  + json.dumps({":p": {"S": "x"}, ":d": entry}))
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == one(OLDER_LIMIT_0)
+
+    @pytest.mark.parametrize("entry", [e for _, e in UNREADABLE_MEMBERS],
+                             ids=[i for i, _ in UNREADABLE_MEMBERS])
+    def test_query_unreadable_member(self, dynamodb_client, table, entry):
+        # Measured on Query 2026-10-31 12:36 UTC, each entry under :d beside
+        # the key condition's :p.
+        body = json.dumps({
+            "TableName": table, "KeyConditionExpression": "pk = :p", "Limit": 0,
+            "ExpressionAttributeValues": {":p": {"S": "p0"}, ":d": entry},
+        })
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == one(OLDER_LIMIT_0)

From a78d31f75a14f240b86c8ba88f2c39a7d1bae9bb Mon Sep 17 00:00:00 2001
From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com>
Date: Sun, 1 Nov 2026 01:11:41 +0000
Subject: [PATCH 3/3] fix(scan): read the start key and condition lists for the
 older form

Measured against the service on 2026-10-31 between 23:54 and 23:56 UTC,
each request sent twice, as a raw signed Scan or Query:

- Limit 0 answers the older form, Value '0' at 'limit', beside an empty
  value or one with an unknown type descriptor in ExclusiveStartKey or in a
  ScanFilter AttributeValueList on Scan, and beside an empty value in
  ExclusiveStartKey or in a KeyConditions or QueryFilter AttributeValueList
  on Query. Segment -1 with TotalSegments 2 beside an empty
  ExclusiveStartKey value answers Value '-1' at 'segment'. The check read
  only ExpressionAttributeValues and answered the newer form for these.
- Limit 0 beside a readable value keeps the newer form: a number as the
  value of an S key in ExclusiveStartKey, an N entry in a ScanFilter list
  and an S entry in a KeyConditions list.

The older-form check now reads ExclusiveStartKey and the
AttributeValueList entries of ScanFilter on Scan and of KeyConditions and
QueryFilter on Query, with the rule it applies to ExpressionAttributeValues
entries. It reads the L and M members of those values the same way, which
is not measured.

range_tests.rs and query_key_values/tests.rs have the measured rows, and
tests/python/test_scan_range_constraints.py sends them as raw signed
requests: seven Scan and four Query tests.
---
 crates/engine/src/query_key_values.rs         | 77 ++++++++++++++-----
 crates/engine/src/query_key_values/tests.rs   | 39 ++++++++++
 crates/engine/src/scan_request.rs             | 12 +--
 crates/engine/src/scan_request/range_tests.rs | 44 ++++++++++-
 tests/python/test_scan_range_constraints.py   | 72 +++++++++++++++--
 5 files changed, 212 insertions(+), 32 deletions(-)

diff --git a/crates/engine/src/query_key_values.rs b/crates/engine/src/query_key_values.rs
index d508f01b5..6948b5db1 100644
--- a/crates/engine/src/query_key_values.rs
+++ b/crates/engine/src/query_key_values.rs
@@ -119,10 +119,10 @@ fn query_request_checks(body: &Value) -> Result<(), DynamoDbError> {
     if let Some(limit) = body.get("Limit").and_then(Value::as_i64)
         && limit < 1
     {
-        // Beside an ExpressionAttributeValues entry that is not one
-        // AttributeValue the service answers its older form, with the value
-        // echoed (measured 2026-10-25 12:56 UTC on Query and Scan).
-        if has_unreadable_attribute_value(body) {
+        // Beside a value that is not one AttributeValue the service answers
+        // its older form, with the value echoed (measured 2026-10-25 12:56 UTC
+        // on Query and Scan, and 2026-10-31 for the key and the lists).
+        if has_unreadable_attribute_value(body, QUERY_CONDITIONS) {
             return Err(DynamoDbError::ValidationException(format!(
                 "1 validation error detected: Value '{}' at 'limit' failed to satisfy constraint: \
                  Member must have value greater than or equal to 1",
@@ -207,22 +207,61 @@ pub(crate) fn non_empty(body: &Value, field: &str) -> bool {
 /// The type descriptors an AttributeValue may carry.
 const TYPE_DESCRIPTORS: &[&str] = &["S", "N", "B", "SS", "NS", "BS", "M", "L", "NULL", "BOOL"];
 
-/// Whether an `ExpressionAttributeValues` entry is an object that is not one
-/// AttributeValue: empty, with a type descriptor the service does not have
-/// (a lower-case `s` included), or with more than one, at the top or as a
-/// member of an `L` or `M` at any depth. Beside such an entry the service
-/// reports a range fault in its older form (measured 2026-10-25 12:56 UTC:
-/// `Limit: 0` beside `{}`, `{"X": "1"}` or `{"S": "x", "N": "1"}` answers
-/// `Value '0' at 'limit'` on Query and Scan, and beside an empty or duplicate
-/// `NS` the newer form; measured 2026-10-30 12:40 UTC on Scan and 2026-10-31
-/// 12:36 UTC on Query: beside `{"L": [{}]}`, `{"M": {"k": {"X": "1"}}}` or
-/// `{"s": "x"}`, the older form).
-/// An entry that is not an object is a shape fault, reported ahead of the
+/// The legacy condition maps of `Scan` whose `AttributeValueList` entries
+/// [`has_unreadable_attribute_value`] reads.
+pub(crate) const SCAN_CONDITIONS: &[&str] = &["ScanFilter"];
+
+/// The legacy condition maps of `Query` whose `AttributeValueList` entries
+/// [`has_unreadable_attribute_value`] reads.
+pub(crate) const QUERY_CONDITIONS: &[&str] = &["KeyConditions", "QueryFilter"];
+
+/// Whether the request holds an object that is not one AttributeValue: empty,
+/// with a type descriptor the service does not have (a lower-case `s`
+/// included), or with more than one, at the top or as a member of an `L` or
+/// `M` at any depth. The values read are the `ExpressionAttributeValues`
+/// entries, the `ExclusiveStartKey` values and the `AttributeValueList`
+/// entries of the `conditions` maps. Beside such a value the service reports a
+/// range fault in its older form, and beside a readable value, of the wrong
+/// type for a key or not, the newer form.
+///
+/// Measured on 2026-10-25 at 12:56 UTC: `Limit: 0` beside an entry `{}`,
+/// `{"X": "1"}` or `{"S": "x", "N": "1"}` answers `Value '0' at 'limit'` on
+/// Query and Scan, and beside an empty or duplicate `NS` the newer form. On
+/// 2026-10-30 at 12:40 UTC on Scan and 2026-10-31 at 12:36 UTC on Query:
+/// beside an entry `{"L": [{}]}`, `{"M": {"k": {"X": "1"}}}` or `{"s": "x"}`,
+/// the older form. On 2026-10-31 between 23:54 and 23:56 UTC: beside `{}` or
+/// `{"X": "1"}` as an `ExclusiveStartKey` value or a `ScanFilter`
+/// `AttributeValueList` entry on Scan, and `{}` as an `ExclusiveStartKey`
+/// value or a `KeyConditions` or `QueryFilter` `AttributeValueList` entry on
+/// Query, the older form, for a `Segment` fault too; beside `{"N": "1"}` as
+/// the value of an `S` key, `{"N": "1"}` in a `ScanFilter` list and `{"S":
+/// "p0"}` in a `KeyConditions` list, the newer form. An `L` or `M` member of
+/// an `ExclusiveStartKey` value or of a list entry is read as one of an
+/// `ExpressionAttributeValues` entry is; that is not measured.
+///
+/// A value that is not an object is a shape fault, reported ahead of the
 /// checks.
-pub(crate) fn has_unreadable_attribute_value(body: &Value) -> bool {
-    body.get("ExpressionAttributeValues")
-        .and_then(Value::as_object)
-        .is_some_and(|values| values.values().any(is_unreadable_attribute_value))
+pub(crate) fn has_unreadable_attribute_value(body: &Value, conditions: &[&str]) -> bool {
+    let in_map = |field: &str| {
+        body.get(field)
+            .and_then(Value::as_object)
+            .is_some_and(|values| values.values().any(is_unreadable_attribute_value))
+    };
+    let in_lists = |field: &&str| {
+        body.get(*field)
+            .and_then(Value::as_object)
+            .is_some_and(|conditions| {
+                conditions.values().any(|condition| {
+                    condition
+                        .get("AttributeValueList")
+                        .and_then(Value::as_array)
+                        .is_some_and(|list| list.iter().any(is_unreadable_attribute_value))
+                })
+            })
+    };
+    in_map("ExpressionAttributeValues")
+        || in_map("ExclusiveStartKey")
+        || conditions.iter().any(in_lists)
 }
 
 /// Whether `entry` is an object that is not one AttributeValue, or an `L` or
diff --git a/crates/engine/src/query_key_values/tests.rs b/crates/engine/src/query_key_values/tests.rs
index 179014e7c..50bb71683 100644
--- a/crates/engine/src/query_key_values/tests.rs
+++ b/crates/engine/src/query_key_values/tests.rs
@@ -597,3 +597,42 @@ fn a_shape_fault_in_another_field_is_reported_ahead_of_the_checks() {
     });
     assert!(validate_query_request_body(&shape_fault_only).is_ok());
 }
+
+/// Measured 2026-10-31 between 23:54 and 23:56 UTC: an empty value in
+/// `ExclusiveStartKey`, or as an `AttributeValueList` entry of `KeyConditions`
+/// or `QueryFilter`, answers a `Limit` of 0 in the older form, as an entry of
+/// `ExpressionAttributeValues` does; a readable `KeyConditions` entry keeps the
+/// newer form.
+#[test]
+fn an_unreadable_value_in_the_start_key_or_a_condition_list_switches_to_the_older_form() {
+    let older_limit = "1 validation error detected: Value '0' at 'limit' failed to satisfy constraint: Member must have value greater than or equal to 1";
+    let key_conditions = |entry: serde_json::Value| serde_json::json!({"pk": {"ComparisonOperator": "EQ", "AttributeValueList": [entry]}});
+    let start_key = serde_json::json!({
+        "TableName": "t", "KeyConditionExpression": "pk = :p", "Limit": 0,
+        "ExpressionAttributeValues": {":p": {"S": "p0"}},
+        "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}},
+    });
+    let query_filter = serde_json::json!({
+        "TableName": "t", "KeyConditions": key_conditions(serde_json::json!({"S": "p0"})),
+        "Limit": 0,
+        "QueryFilter": {"a": {"ComparisonOperator": "EQ", "AttributeValueList": [{}]}},
+    });
+    let key_condition = serde_json::json!({
+        "TableName": "t", "KeyConditions": key_conditions(serde_json::json!({})), "Limit": 0,
+    });
+    for body in [start_key, query_filter, key_condition] {
+        assert_eq!(
+            message(validate_query_request_body(&body)).as_deref(),
+            Some(older_limit),
+            "{body}"
+        );
+    }
+    let readable = serde_json::json!({
+        "TableName": "t", "KeyConditions": key_conditions(serde_json::json!({"S": "p0"})),
+        "Limit": 0,
+    });
+    assert_eq!(
+        message(validate_query_request_body(&readable)).as_deref(),
+        Some(LIMIT_BELOW_ONE)
+    );
+}
diff --git a/crates/engine/src/scan_request.rs b/crates/engine/src/scan_request.rs
index fa78eac66..2fb57e206 100644
--- a/crates/engine/src/scan_request.rs
+++ b/crates/engine/src/scan_request.rs
@@ -13,7 +13,8 @@
 //!    constraint: Member must have value greater than or equal to 1`, or `2
 //!    validation errors detected: ...; ...` in the order `Limit`, `Segment`,
 //!    `TotalSegments`. A float or a value outside int32 in any of the three,
-//!    or an `ExpressionAttributeValues` entry that is not one AttributeValue,
+//!    or a value that is not one AttributeValue in `ExpressionAttributeValues`,
+//!    in `ExclusiveStartKey` or in a `ScanFilter` `AttributeValueList`,
 //!    switches the message to the older form, `Value '-2147483648' at 'limit'
 //!    ...`, with the value saturated or truncated, in the order
 //!    `totalSegments`, `segment`, `limit`; see `validate_ranges`;
@@ -41,7 +42,7 @@ use extenddb_core::types::{AttributeValue, ScanInput, saturated_int32};
 use serde_json::Value;
 
 use crate::query_key_values::{
-    has_unreadable_attribute_value, non_empty, present, shape_fault_first,
+    SCAN_CONDITIONS, has_unreadable_attribute_value, non_empty, present, shape_fault_first,
     validate_expression_attribute_value_numbers,
 };
 
@@ -123,8 +124,9 @@ fn scan_request_checks(body: &Value) -> Result<(), DynamoDbError> {
 /// When each field present is an integer inside the int32 range, the newer
 /// form: `Value at '<Field>' failed to satisfy constraint: ...` with the field
 /// capitalised and no value echoed, in the order `Limit`, `Segment`,
-/// `TotalSegments`. When any of the three is a float or outside int32, or an
-/// `ExpressionAttributeValues` entry is not one AttributeValue (see
+/// `TotalSegments`. When any of the three is a float or outside int32, or a
+/// value in `ExpressionAttributeValues`, `ExclusiveStartKey` or a `ScanFilter`
+/// `AttributeValueList` is not one AttributeValue (see
 /// [`has_unreadable_attribute_value`]), the older form: `Value '<n>' at
 /// '<field>' ...` with the value as [`saturated_int32`] reads it and the field
 /// in lower camel case, in the reverse of the newer form's order:
@@ -140,7 +142,7 @@ fn validate_ranges(body: &Value) -> Result<(), DynamoDbError> {
                 .map(|number| (range, number))
         })
         .collect();
-    let older_form = has_unreadable_attribute_value(body)
+    let older_form = has_unreadable_attribute_value(body, SCAN_CONDITIONS)
         || numbers.iter().any(|(_, number)| {
             number
                 .as_i64()
diff --git a/crates/engine/src/scan_request/range_tests.rs b/crates/engine/src/scan_request/range_tests.rs
index eeb7592d5..0554cb1d5 100644
--- a/crates/engine/src/scan_request/range_tests.rs
+++ b/crates/engine/src/scan_request/range_tests.rs
@@ -5,8 +5,8 @@
 //!
 //! Every row is a request sent to the service (us-east-1, each request twice,
 //! a Scan of an existing table) with the answer it gave: on 2026-10-25 between
-//! 09:23 and 12:56 UTC, and on 2026-10-30 at 12:40 UTC or 2026-10-31 at 12:36
-//! UTC where a test says so.
+//! 09:23 and 12:56 UTC, and on 2026-10-30 at 12:40 UTC, 2026-10-31 at 12:36
+//! UTC or 2026-10-31 between 23:54 and 23:56 UTC where a test says so.
 
 use extenddb_core::error::DynamoDbError;
 use serde_json::Value;
@@ -213,6 +213,46 @@ fn an_unreadable_member_of_a_list_or_map_entry_switches_to_the_older_form() {
     }
 }
 
+/// Measured 2026-10-31 between 23:54 and 23:56 UTC: an empty value or one with
+/// an unknown type descriptor in `ExclusiveStartKey` or in a `ScanFilter`
+/// `AttributeValueList` switches to the older form, for a `Segment` fault too;
+/// a readable value keeps the newer form, also a number for an `S` key.
+#[test]
+fn an_unreadable_value_in_the_start_key_or_a_scan_filter_switches_to_the_older_form() {
+    let older_limit = one(&older("0", "limit", "greater than or equal to 1"));
+    let filter = |entry: &str| {
+        format!(
+            r#""ScanFilter": {{"a": {{"ComparisonOperator": "EQ", "AttributeValueList": [{entry}]}}}}"#
+        )
+    };
+    for fields in [
+        r#""ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}"#.to_owned(),
+        r#""ExclusiveStartKey": {"pk": {"X": "1"}, "sk": {"S": "x"}}"#.to_owned(),
+        filter("{}"),
+        filter(r#"{"X": "1"}"#),
+    ] {
+        let fields = format!(r#""Limit": 0, {fields}"#);
+        assert_eq!(
+            check(&scan(&fields)).as_deref(),
+            Some(older_limit.as_str()),
+            "{fields}"
+        );
+    }
+    let segment =
+        r#""Segment": -1, "TotalSegments": 2, "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}"#;
+    assert_eq!(
+        check(&scan(segment)),
+        Some(one(&older("-1", "segment", "greater than or equal to 0")))
+    );
+    for fields in [
+        r#""ExclusiveStartKey": {"pk": {"N": "1"}, "sk": {"S": "x"}}"#.to_owned(),
+        filter(r#"{"N": "1"}"#),
+    ] {
+        let fields = format!(r#""Limit": 0, {fields}"#);
+        assert_eq!(check(&scan(&fields)), Some(one(LIMIT)), "{fields}");
+    }
+}
+
 /// Measured 2026-10-31 12:36 UTC: `Limit: 0` beside a readable entry of each
 /// type, and beside an `L` and an `M` whose members are readable, keeps the
 /// newer form, as the empty and duplicate `NS` measured on 2026-10-25 do.
diff --git a/tests/python/test_scan_range_constraints.py b/tests/python/test_scan_range_constraints.py
index e621a57d5..cb897d749 100644
--- a/tests/python/test_scan_range_constraints.py
+++ b/tests/python/test_scan_range_constraints.py
@@ -7,8 +7,9 @@
 written here (``0.0``, ``1e2``, ``9223372036854775808``). Each request is a
 row of the table measured against DynamoDB (us-east-1) on 2026-10-25 at 09:23,
 09:25, 09:28, 10:38, 10:55 and 12:56 UTC, or of the ones measured on
-2026-10-30 at 12:40 UTC and 2026-10-31 at 12:36 UTC where a row says so, each
-sent twice, and each expected answer is the service's. Where a table records
+2026-10-30 at 12:40 UTC, 2026-10-31 at 12:36 UTC and 2026-10-31 between 23:54
+and 23:56 UTC where a row says so, each sent twice, and each expected answer
+is the service's. Where a table records
 only that the service accepted a request, the test asserts what a Scan with
 that limit returns on this table of 12 items. ``Segment: 0, TotalSegments: 1``
 with ``ConsistentRead: true`` returned the whole table in one page on
@@ -18,10 +19,12 @@
 ``Value at '<Field>' failed to satisfy constraint: ...`` with the field
 capitalised and no value echoed, and several faults are reported in one
 message in the order Limit, Segment, TotalSegments. When a field is a float
-or outside int32, or an ``ExpressionAttributeValues`` entry is not one
-AttributeValue (an ``L`` or ``M`` member included), the service saturates or
-truncates the value and uses the older form, ``Value '<n>' at '<field>' ...``,
-in the order totalSegments, segment, limit. A float or an out-of-range integer
+or outside int32, or a value is not one AttributeValue (an
+``ExpressionAttributeValues`` entry or an ``L`` or ``M`` member of one, an
+``ExclusiveStartKey`` value, or an ``AttributeValueList`` entry of
+``ScanFilter``, or on Query of ``KeyConditions`` or ``QueryFilter``), the
+service saturates or truncates the value and uses the older form,
+``Value '<n>' at '<field>' ...``, in the order totalSegments, segment, limit. A float or an out-of-range integer
 that satisfies the constraint is accepted.
 """
 
@@ -132,6 +135,45 @@ def older(value: str, field: str, constraint: str) -> str:
                       ("lower-case-s", {"s": "x"})]
 
 
+def _conditions(name: str, entry: dict) -> dict:
+    return {name: {"ComparisonOperator": "EQ", "AttributeValueList": [entry]}}
+
+
+def _scan_filter(entry: dict) -> str:
+    return '"ScanFilter": ' + json.dumps(_conditions("a", entry))
+
+
+# Measured 2026-10-31 between 23:54 and 23:56 UTC: a value that is not one
+# AttributeValue in ExclusiveStartKey or in a condition list answers the older
+# form; a readable one, also of the wrong type for the key, the newer form.
+KEY_AND_LISTS = [
+    ("ExclusiveStartKey-empty", '"Limit": 0, "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}',
+     one(OLDER_LIMIT_0)),
+    ("ExclusiveStartKey-type-X",
+     '"Limit": 0, "ExclusiveStartKey": {"pk": {"X": "1"}, "sk": {"S": "x"}}', one(OLDER_LIMIT_0)),
+    ("ScanFilter-empty", '"Limit": 0, ' + _scan_filter({}), one(OLDER_LIMIT_0)),
+    ("ScanFilter-type-X", '"Limit": 0, ' + _scan_filter({"X": "1"}), one(OLDER_LIMIT_0)),
+    ("Segment-beside-ExclusiveStartKey-empty",
+     '"Segment": -1, "TotalSegments": 2, "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}',
+     one(older("-1", "segment", "greater than or equal to 0"))),
+    ("ExclusiveStartKey-N-on-an-S-key",
+     '"Limit": 0, "ExclusiveStartKey": {"pk": {"N": "1"}, "sk": {"S": "x"}}', one(LIMIT)),
+    ("ScanFilter-N", '"Limit": 0, ' + _scan_filter({"N": "1"}), one(LIMIT)),
+]
+QUERY_KEY_AND_LISTS = [
+    ("ExclusiveStartKey-empty",
+     {"KeyConditionExpression": "pk = :p", "Limit": 0,
+      "ExpressionAttributeValues": {":p": {"S": "p0"}},
+      "ExclusiveStartKey": {"pk": {}, "sk": {"S": "x"}}}, one(OLDER_LIMIT_0)),
+    ("QueryFilter-empty",
+     {"KeyConditions": _conditions("pk", {"S": "p0"}), "Limit": 0,
+      "QueryFilter": _conditions("a", {})}, one(OLDER_LIMIT_0)),
+    ("KeyConditions-empty", {"KeyConditions": _conditions("pk", {}), "Limit": 0},
+     one(OLDER_LIMIT_0)),
+    ("KeyConditions-S", {"KeyConditions": _conditions("pk", {"S": "p0"}), "Limit": 0}, one(LIMIT)),
+]
+
+
 def _raw(client, operation: str, body_text: str):
     """POST ``body_text`` exactly as written, signed with the client's credentials."""
     req = AWSRequest(method="POST", url=client.meta.endpoint_url, data=body_text,
@@ -288,3 +330,21 @@ def test_query_unreadable_member(self, dynamodb_client, table, entry):
             "ExpressionAttributeValues": {":p": {"S": "p0"}, ":d": entry},
         })
         assert _validation_message(*_raw(dynamodb_client, "Query", body)) == one(OLDER_LIMIT_0)
+
+
+class TestBesideAnUnreadableValueInTheKeyOrAConditionList:
+    """Measured 2026-10-31 between 23:54 and 23:56 UTC: a value that is not one
+    AttributeValue in ExclusiveStartKey, or in the AttributeValueList of a
+    ScanFilter, KeyConditions or QueryFilter condition, switches to the older
+    form, as an ExpressionAttributeValues entry does."""
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in KEY_AND_LISTS],
+                             ids=[r[0] for r in KEY_AND_LISTS])
+    def test_scan(self, dynamodb_client, table, fields, expected):
+        assert _validation_message(*_scan(dynamodb_client, table, fields)) == expected
+
+    @pytest.mark.parametrize("fields, expected", [r[1:] for r in QUERY_KEY_AND_LISTS],
+                             ids=[r[0] for r in QUERY_KEY_AND_LISTS])
+    def test_query(self, dynamodb_client, table, fields, expected):
+        body = json.dumps({"TableName": table, **fields})
+        assert _validation_message(*_raw(dynamodb_client, "Query", body)) == expected