Nesting, element count and length are capped in the reader - 64, 100,000 and 16 MiB against a largest-seen 5, 931 and 137KB - and a document past any of them is an error rather than something to survive. Ten thousand elements inside each other overflowed the stack and aborted: the reader is a loop, but writing a tree, asking whether it is intact and dropping it all recurse. An abort in wasm is a trap, so a page holding somebody's force loses it. `Kept` keeps its fields to itself in the same change, so nothing can leave a document claiming to be bytes that no longer describe it, and a bad span prints the element rather than silently dropping it. Three things fell out: the writer no longer stamps an empty chassis or an invented crew onto an element that had neither, no longer writes a crew figure over one it could not read, and the reader no longer truncates `gunnery="99999"` to 159.