diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 1c0fe24f7b..2e9dba0c6d 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -39,6 +39,7 @@ mod format;
 mod globals;
 mod host;
 mod model;
+mod nesting;
 mod run;
 
 #[cfg(test)]
diff --git a/crates/js/src/nesting.rs b/crates/js/src/nesting.rs
new file mode 100644
index 0000000000..9f99c5351a
--- /dev/null
+++ b/crates/js/src/nesting.rs
@@ -0,0 +1,319 @@
+//! The nesting guard: whether a script nests deeper than boa's parser can take.
+//!
+//! boa parses by recursive descent with no depth limit of its own, and a stack overflow aborts
+//! the process (it is not a panic, so `catch_unwind` can't stop it). So every script is scanned
+//! before boa sees it, and one that nests too deeply is refused.
+//!
+//! A scan has to know which brackets are code, and that depends on where strings, templates,
+//! comments and regular expressions begin and end. Most of that follows from the bytes, but a
+//! `/` that isn't a comment is a division or the start of a regular expression depending on
+//! where the parser is, which a scan can't know. A scan that guesses can be put out of phase:
+//! after `/'/`, the quote in the regular expression made the real nesting that followed look
+//! like string text (#5079). So the scan doesn't guess. It follows every reading at once,
+//! splitting at each such `/` into a division and a regular expression, and counts nesting on
+//! each reading. boa's reading is always one of them, so the deepest is at least as deep as
+//! boa's. A reading boa would reject is dropped at the byte where boa stops with a syntax error
+//! (a string or regular expression running into a line break, a regular expression's groups not
+//! matching), which keeps divisions from leaving stray readings behind.
+
+/// Deepest nesting of `(`, `[`, `{` and template substitutions (`${`).
+pub(crate) const MAX_BRACKET_DEPTH: usize = 64;
+
+/// Longest run of prefix operators (`!`, `~`, `+`, `-`).
+pub(crate) const MAX_PREFIX_RUN: usize = 64;
+
+/// Most `?` (conditional expressions nest without brackets).
+pub(crate) const MAX_CONDITIONALS: usize = 4096;
+
+/// Most readings followed at once. Readings that differ only in their counts are merged first,
+/// keeping the larger counts; past this, the script is refused.
+const MAX_READINGS: usize = 16;
+
+/// Where a reading is in the script.
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Debug)]
+enum Mode {
+    Code,
+    /// In a string that this quote closes.
+    Str(u8),
+    /// In a template's text: after its backtick, or after a substitution's closing `}`.
+    Template,
+    /// In a regular expression literal: in a class (`[...]`), and the groups open outside one.
+    Regex {
+        class: bool,
+        groups: usize,
+    },
+    /// In a `//`, `<!--` or `-->` comment, to the end of the line.
+    LineComment,
+    /// In a `/* */` comment.
+    BlockComment,
+}
+
+/// One way of reading the script, and what it has counted so far.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Debug)]
+struct Reading {
+    mode: Mode,
+    /// Bytes to pass over: the rest of a two-byte token, or what a backslash escapes.
+    skip: usize,
+    /// For each open template substitution, the braces open inside it, so the `}` that closes
+    /// the substitution is told from one that closes a block.
+    substitutions: Vec<usize>,
+    depth: usize,
+    prefix: usize,
+    conditionals: usize,
+}
+
+impl Reading {
+    fn in_code() -> Self {
+        Self { mode: Mode::Code, skip: 0, substitutions: Vec::new(), depth: 0, prefix: 0, conditionals: 0 }
+    }
+
+    fn with_mode(&self, mode: Mode) -> Self {
+        Self { mode, ..self.clone() }
+    }
+
+    fn over_limit(&self) -> bool {
+        self.depth > MAX_BRACKET_DEPTH || self.prefix > MAX_PREFIX_RUN || self.conditionals > MAX_CONDITIONALS
+    }
+
+    fn open(&mut self) {
+        self.depth = self.depth.saturating_add(1);
+        self.prefix = 0;
+    }
+
+    fn close(&mut self) {
+        self.depth = self.depth.saturating_sub(1);
+        self.prefix = 0;
+    }
+
+    /// Read byte `i` of `b`. A second reading that splits off here goes to `forks`. Returns
+    /// false when boa would stop with a syntax error at this byte, ending this reading.
+    fn advance(&mut self, b: &[u8], i: usize, forks: &mut Vec<Reading>) -> bool {
+        if self.skip > 0 {
+            self.skip -= 1;
+            return true;
+        }
+        let Some(&c) = b.get(i) else { return true };
+        match self.mode {
+            Mode::Code => {
+                self.code(c, b, i, forks);
+                true
+            }
+            Mode::Str(quote) => self.string(quote, c, b, i),
+            Mode::Template => {
+                self.template(c, b, i);
+                true
+            }
+            Mode::Regex { class, groups } => self.regex(class, groups, c, b, i),
+            Mode::LineComment => {
+                let n = line_break(b, i);
+                if n > 0 {
+                    self.mode = Mode::Code;
+                    self.skip = n - 1;
+                }
+                true
+            }
+            Mode::BlockComment => {
+                if c == b'*' && at(b, i + 1, b"/") {
+                    self.mode = Mode::Code;
+                    self.skip = 1;
+                }
+                true
+            }
+        }
+    }
+
+    fn code(&mut self, c: u8, b: &[u8], i: usize, forks: &mut Vec<Reading>) {
+        match c {
+            b'\'' | b'"' => {
+                self.mode = Mode::Str(c);
+                self.prefix = 0;
+            }
+            b'`' => {
+                self.mode = Mode::Template;
+                self.prefix = 0;
+            }
+            b'/' if at(b, i + 1, b"/") => self.mode = Mode::LineComment,
+            b'/' if at(b, i + 1, b"*") => {
+                self.mode = Mode::BlockComment;
+                self.skip = 1;
+            }
+            b'/' => {
+                // A division, or the start of a regular expression: the parser decides, so
+                // follow both.
+                forks.push(self.with_mode(Mode::Regex { class: false, groups: 0 }));
+                self.prefix = 0;
+            }
+            b'(' | b'[' => self.open(),
+            b'{' => {
+                if let Some(open) = self.substitutions.last_mut() {
+                    *open = open.saturating_add(1);
+                }
+                self.open();
+            }
+            b')' | b']' => self.close(),
+            b'}' => {
+                self.close();
+                if self.substitutions.last() == Some(&0) {
+                    self.substitutions.pop();
+                    self.mode = Mode::Template;
+                } else if let Some(open) = self.substitutions.last_mut() {
+                    *open = open.saturating_sub(1);
+                }
+            }
+            b'!' | b'~' | b'+' | b'-' => {
+                // `-->` begins a comment at the start of a line (Annex B); followed anywhere.
+                if c == b'-' && at(b, i + 1, b"->") {
+                    forks.push(self.with_mode(Mode::LineComment));
+                }
+                self.prefix = self.prefix.saturating_add(1);
+            }
+            b'?' => {
+                self.conditionals = self.conditionals.saturating_add(1);
+                self.prefix = 0;
+            }
+            // `<!--` begins a comment (Annex B, in scripts); followed both ways.
+            b'<' if at(b, i + 1, b"!--") => {
+                forks.push(self.with_mode(Mode::LineComment));
+                self.prefix = 0;
+            }
+            // Whitespace and line breaks, and any non-ASCII byte, which may be part of either,
+            // leave a run of prefix operators going.
+            _ if c.is_ascii_whitespace() || !c.is_ascii() => {}
+            _ => self.prefix = 0,
+        }
+    }
+
+    /// In a string closed by `quote`. False at a line break boa rejects.
+    fn string(&mut self, quote: u8, c: u8, b: &[u8], i: usize) -> bool {
+        if c == quote {
+            self.mode = Mode::Code;
+            self.prefix = 0;
+        } else if c == b'\\' {
+            // An escape, or a line continuation (`\` and a line break, CR LF included).
+            self.skip = line_break(b, i + 1).max(1);
+        } else if c == b'\n' || c == b'\r' {
+            // U+2028 and U+2029 may stand in a string; LF and CR may not.
+            return false;
+        }
+        true
+    }
+
+    fn template(&mut self, c: u8, b: &[u8], i: usize) {
+        if c == b'`' {
+            self.mode = Mode::Code;
+            self.prefix = 0;
+        } else if c == b'\\' {
+            self.skip = 1;
+        } else if c == b'$' && at(b, i + 1, b"{") {
+            self.substitutions.push(0);
+            self.open();
+            self.mode = Mode::Code;
+            self.skip = 1;
+        }
+    }
+
+    /// In a regular expression literal. False where boa rejects it: a line break, or groups
+    /// that don't match (boa checks the pattern as it reads the literal).
+    fn regex(&mut self, class: bool, groups: usize, c: u8, b: &[u8], i: usize) -> bool {
+        if line_break(b, i) > 0 || (c == b'\\' && line_break(b, i + 1) > 0) {
+            return false;
+        }
+        match (c, class) {
+            (b'\\', _) => self.skip = 1,
+            (b']', true) => self.mode = Mode::Regex { class: false, groups },
+            (b'[', false) => self.mode = Mode::Regex { class: true, groups },
+            (b'(', false) => self.mode = Mode::Regex { class, groups: groups.saturating_add(1) },
+            (b')', false) if groups == 0 => return false,
+            (b')', false) => self.mode = Mode::Regex { class, groups: groups - 1 },
+            (b'/', false) if groups > 0 => return false,
+            (b'/', false) => {
+                self.mode = Mode::Code;
+                self.prefix = 0;
+            }
+            _ => {}
+        }
+        true
+    }
+}
+
+/// Whether `s` stands in `b` at `i`.
+fn at(b: &[u8], i: usize, s: &[u8]) -> bool {
+    b.get(i..).is_some_and(|rest| rest.starts_with(s))
+}
+
+/// How many bytes the line break at `i` takes: CR LF, LF, CR, U+2028 or U+2029. 0 if none.
+fn line_break(b: &[u8], i: usize) -> usize {
+    let rest = b.get(i..).unwrap_or_default();
+    if rest.starts_with(b"\r\n") {
+        2
+    } else if rest.starts_with(b"\n") || rest.starts_with(b"\r") {
+        1
+    } else if rest.starts_with("\u{2028}".as_bytes()) || rest.starts_with("\u{2029}".as_bytes()) {
+        3
+    } else {
+        0
+    }
+}
+
+/// Whether any reading of `source` nests brackets deeper than [`MAX_BRACKET_DEPTH`], runs more
+/// than [`MAX_PREFIX_RUN`] prefix operators together, or has more than [`MAX_CONDITIONALS`]
+/// conditionals; or the script has more ambiguous readings than the scan follows.
+pub(crate) fn too_deep(source: &str) -> bool {
+    let b = source.as_bytes();
+    // A leading `#!` is a hashbang comment: boa parses scripts and eval code from a goal that
+    // allows one. Read as code it could only be a syntax error (`#` must start a private name).
+    let first = if b.starts_with(b"#!") { Mode::LineComment } else { Mode::Code };
+    let mut readings = vec![Reading::in_code().with_mode(first)];
+    let mut next = Vec::with_capacity(MAX_READINGS + 1);
+    for i in 0..b.len() {
+        let mut ended: Option<Reading> = None;
+        for mut r in readings.drain(..) {
+            if r.advance(b, i, &mut next) {
+                next.push(r);
+            } else {
+                ended = Some(match ended {
+                    Some(e) => merged(e, &r),
+                    None => r,
+                });
+            }
+        }
+        if next.is_empty() {
+            // Every reading ends in a syntax error here, so boa stops by this byte. Carry on as
+            // code anyway, with the largest counts, rather than stop checking.
+            let ended = ended.unwrap_or_else(Reading::in_code);
+            next.push(Reading { mode: Mode::Code, skip: 0, ..ended });
+        }
+        if next.iter().any(Reading::over_limit) {
+            return true;
+        }
+        if next.len() > 1 && !settle(&mut next) {
+            return true;
+        }
+        std::mem::swap(&mut readings, &mut next);
+    }
+    false
+}
+
+/// `a` with the larger of each count in `a` and `b`.
+fn merged(a: Reading, b: &Reading) -> Reading {
+    Reading { depth: a.depth.max(b.depth), prefix: a.prefix.max(b.prefix), conditionals: a.conditionals.max(b.conditionals), ..a }
+}
+
+/// Drop duplicate readings, then merge those in the same place if there are too many. False if
+/// there are still too many to follow.
+fn settle(readings: &mut Vec<Reading>) -> bool {
+    readings.sort_unstable();
+    readings.dedup();
+    if readings.len() > MAX_READINGS {
+        // Sorted, readings in the same place are next to each other. Merging keeps the larger
+        // counts, so it can only refuse more.
+        readings.dedup_by(|r, kept| {
+            let same = r.mode == kept.mode && r.skip == kept.skip && r.substitutions == kept.substitutions;
+            if same {
+                *kept = merged(kept.clone(), r);
+            }
+            same
+        });
+    }
+    readings.len() <= MAX_READINGS
+}
diff --git a/crates/js/src/run.rs b/crates/js/src/run.rs
index edc6332ca8..dd6e3fccb8 100644
--- a/crates/js/src/run.rs
+++ b/crates/js/src/run.rs
@@ -19,86 +19,17 @@ pub(crate) const MAX_ARRAY_LENGTH: u64 = 1 << 20;
 /// Maximum calculated field scripts evaluated by `calculateNow()` during one JavaScript run.
 pub(crate) const MAX_CALCULATE_STEPS: usize = 4096;
 
-/// Deepest nesting of `(`, `[` and `{`.
-const MAX_BRACKET_DEPTH: usize = 64;
-
-/// Longest run of prefix operators (`!`, `~`, `+`, `-`).
-const MAX_PREFIX_RUN: usize = 64;
-
-/// Most `?` (conditional expressions nest without brackets).
-const MAX_CONDITIONALS: usize = 4096;
-
 /// The script thread's stack.
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) const SCRIPT_STACK: usize = 1 << 30;
 
-/// Why `source` is refused, if it is: too long, or nested deeper than any form needs. Strings
-/// and comments are skipped; brackets in regular expressions and templates count, which only
-/// errs on the safe side.
+/// Why `source` is refused, if it is: too long, or nested deeper than any form needs, which
+/// would overflow the stack in boa's parser ([`crate::nesting`]).
 pub(crate) fn refuse(source: &str) -> Option<String> {
     if source.len() > MAX_SCRIPT_BYTES {
         return Some(format!("the script is too long ({} KiB; the limit is {} KiB)", source.len() / 1024, MAX_SCRIPT_BYTES / 1024));
     }
-    let too_deep = || Some("the script is nested too deeply to run safely".to_string());
-    let b = source.as_bytes();
-    let (mut depth, mut prefix, mut conditionals) = (0usize, 0usize, 0usize);
-    let mut i = 0;
-    while let Some(&c) = b.get(i) {
-        i += 1;
-        match c {
-            b'\'' | b'"' => {
-                // To the closing quote (or the end of the line, where an unclosed string ends).
-                while let Some(&d) = b.get(i) {
-                    i += 1;
-                    if d == b'\\' {
-                        i += 1;
-                    } else if d == c || d == b'\n' {
-                        break;
-                    }
-                }
-                prefix = 0;
-            }
-            b'/' if b.get(i) == Some(&b'/') => {
-                while b.get(i).is_some_and(|d| *d != b'\n') {
-                    i += 1;
-                }
-            }
-            b'/' if b.get(i) == Some(&b'*') => {
-                i += 1;
-                while i < b.len() && !b[i..].starts_with(b"*/") {
-                    i += 1;
-                }
-                i += 2;
-            }
-            b'(' | b'[' | b'{' => {
-                depth += 1;
-                if depth > MAX_BRACKET_DEPTH {
-                    return too_deep();
-                }
-                prefix = 0;
-            }
-            b')' | b']' | b'}' => {
-                depth = depth.saturating_sub(1);
-                prefix = 0;
-            }
-            b'!' | b'~' | b'+' | b'-' => {
-                prefix += 1;
-                if prefix > MAX_PREFIX_RUN {
-                    return too_deep();
-                }
-            }
-            b'?' => {
-                conditionals += 1;
-                if conditionals > MAX_CONDITIONALS {
-                    return too_deep();
-                }
-                prefix = 0;
-            }
-            c if c.is_ascii_whitespace() => {}
-            _ => prefix = 0,
-        }
-    }
-    None
+    crate::nesting::too_deep(source).then(|| "the script is nested too deeply to run safely".to_string())
 }
 
 /// Run `script` for `event`, after the document-level scripts (`doc_scripts`, which define the
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index 36e6c04c60..8f887ce5f9 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -666,6 +666,8 @@ fn deeply_nested_scripts_fail_instead_of_crashing() {
     assert!(o.doc_errors.len() == 1 && o.doc_errors[0].contains("nested too deeply"), "{:?}", o.doc_errors);
 }
 
+/// Ordinary nesting below the guard's limits runs, and brackets in strings and comments don't
+/// count, however many there are.
 #[test]
 fn ordinary_nesting_still_runs() {
     let n = 40;
@@ -673,11 +675,164 @@ fn ordinary_nesting_still_runs() {
     let o = go(&s, &Event::field("Calculate", "a", ""));
     assert_eq!(o.error, None);
     assert_eq!(o.value, "5");
-    // Brackets in strings and comments don't count.
-    let s = format!("// {}\nevent.value = '{}'.length;", "(".repeat(1000), "[".repeat(1000));
+    let s = format!("// {}\n/* {} */ event.value = '{}'.length;", "(".repeat(1000), "{".repeat(1000), "[".repeat(1000));
     assert_eq!(go(&s, &Event::field("Calculate", "a", "")).value, "1000");
 }
 
+/// The reported #5079 reproduction: a regex literal whose body holds a quote (`/'/`) must not
+/// hide the brackets that follow it from the nesting guard. The old scan read `'` as the start
+/// of a string, so every `(` after `/'/` on the line was skipped; boa's unbounded recursive
+/// parser then overflowed the script thread's stack (the console's `js_run` path, on the
+/// `pdfcraft-js` thread) and aborted the app. With that scan, 200 brackets fail this assertion
+/// cleanly (boa reports a SyntaxError) and 64,000, the issue's file, overflow the stack.
+#[test]
+fn a_quote_in_a_regex_cannot_hide_nesting_from_the_guard() {
+    for n in [200, 64_000] {
+        let s = format!("event.value = /'/ {}1;", "(".repeat(n));
+        let o = go(&s, &Event::field("Calculate", "a", ""));
+        assert!(o.error.as_deref().is_some_and(|e| e.contains("nested too deeply")), "{n}: {:?}", o.error);
+    }
+}
+
+/// A quote in a regex character class, with the real nesting after it, is refused, while
+/// ordinary string and regex literals still run, strings of brackets of any length among them.
+#[test]
+fn nesting_guard_counts_brackets_hidden_by_a_regex_quote() {
+    let hidden = format!("var r = /['\"]/; event.value = {}1{}; event.value = 'ok';", "(".repeat(65), ")".repeat(65));
+    assert!(super::run::refuse(&hidden).is_some_and(|e| e.contains("nested too deeply")), "the regex quote must not hide parser nesting");
+
+    let o = go("event.value = '()[]{}'.length;", &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "6"));
+    let o = go("var r = /['\"]/; event.value = r.test(\"'\") ? 1 : 0;", &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+    for n in [64, 65, 10_000] {
+        let o = go(&format!("event.value = '{}'.length;", "(".repeat(n)), &Event::field("Calculate", "a", ""));
+        assert_eq!((o.error, o.value), (None, n.to_string()));
+    }
+}
+
+/// A script that nests one level deeper on each line, behind a quote inside a regular
+/// expression: `x=` followed by lines of `(/"/,"))))",` (#5079, after the first fix). A scan
+/// that reads the regex's quote as the start of a string is out of phase with the real strings
+/// from there on: it reads `"/,"` as a string and the closing brackets in the real string
+/// `"))))"` as code, so on every line its depth falls back to 0 while boa's grows by one. 5,000
+/// lines are 65 KB, under the size limit, and nest 5,000 deep. The same with `'`, and with
+/// template text, which that scan didn't skip at all, is refused too. As deep as the limit,
+/// closed properly, is ordinary code and runs.
+#[test]
+fn a_quote_in_a_regex_cannot_put_the_guard_out_of_phase() {
+    use super::nesting::MAX_BRACKET_DEPTH;
+    for q in ["\"", "'", "`"] {
+        let line = format!("(/{q}/,{q}))))){q},\n");
+        for n in [MAX_BRACKET_DEPTH + 1, 5_000] {
+            let s = format!("x={}", line.repeat(n));
+            assert!(s.len() <= super::MAX_SCRIPT_BYTES);
+            assert!(super::run::refuse(&s).is_some_and(|e| e.contains("nested too deeply")), "{q} x {n}");
+        }
+        // The real strings alone, with no regex in front.
+        let s = format!("x={}", format!("({q}))))){q},").repeat(MAX_BRACKET_DEPTH + 1));
+        assert!(super::run::refuse(&s).is_some_and(|e| e.contains("nested too deeply")), "{q} without the regex");
+
+        let n = MAX_BRACKET_DEPTH;
+        let s = format!("var x={}0{};\nevent.value = x;", line.repeat(n), ")".repeat(n));
+        let o = go(&s, &Event::field("Calculate", "a", ""));
+        assert_eq!((o.error, o.value.as_str()), (None, "0"), "{q}");
+    }
+}
+
+/// Template substitutions nest like brackets, and template text, comments and regular
+/// expressions full of brackets, quotes and slashes still run.
+#[test]
+fn nesting_guard_reads_templates_regexes_and_comments() {
+    use super::nesting::MAX_BRACKET_DEPTH;
+    let nested = |n: usize| (0..n).fold("1".to_string(), |s, _| format!("`${{{s}}}`"));
+    let o = go(&format!("event.value = {};", nested(10)), &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+    assert!(super::run::refuse(&nested(MAX_BRACKET_DEPTH + 1)).is_some_and(|e| e.contains("nested too deeply")));
+
+    let s = [
+        "var r = /[(\\[{'\"`/]+/g, s = \"a(b[c{d'e`f/g\";",
+        "var t = `((( [[[ {{{ ' \" / ${s.replace(r, '')} ${'}'} )`;",
+        "var u = /\\(/.source + /[)]/.source + /(a)(?:b)/.source + /a{2}/.source;",
+        "// a comment with ((( and ' and \"",
+        "/* another with [[[ and ` and / */",
+        "var v = 10 / 2 / 5, w = (10 / 2) / 5, z = 1; z--> 0; <!-- an old-style comment (((",
+        "event.value = [t.length, u, v, w].join(' ');",
+    ]
+    .join("\n");
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "29 \\([)](a)(?:b)a{2} 1 1"));
+}
+
+/// A leading `#!` line is a comment: brackets in it don't count, while nesting on the lines
+/// after it still does.
+#[test]
+fn a_hashbang_line_is_read_as_a_comment() {
+    use super::nesting::MAX_BRACKET_DEPTH;
+    let s = format!("#!{}\nevent.value = 1;", "(".repeat(MAX_BRACKET_DEPTH + 1));
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+    let n = MAX_BRACKET_DEPTH + 1;
+    let s = format!("#!\nevent.value = {}1{};", "(".repeat(n), ")".repeat(n));
+    assert!(super::run::refuse(&s).is_some_and(|e| e.contains("nested too deeply")));
+}
+
+/// Divisions don't add up to a refusal: a form's calculation rounds with `/` many times over,
+/// and on one long line, and each `/` could start a regular expression as far as the scan
+/// knows. The reading as a regular expression is dropped where boa would reject it.
+#[test]
+fn divisions_do_not_add_up_to_a_refusal() {
+    let s = format!("var a = 7, b = 2, x = 0;\n{}event.value = x;", "x = Math.round(a / b * 100) / 100; x = (a / b) / (b / b);\n".repeat(500));
+    assert!(s.len() <= super::MAX_SCRIPT_BYTES);
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "3.5"));
+    let s = format!("event.value = 1{};", "/1".repeat(2_000));
+    let o = go(&s, &Event::field("Calculate", "a", ""));
+    assert_eq!((o.error, o.value.as_str()), (None, "1"));
+}
+
+/// What the guard's reading assumes boa does: a string or regular expression can't run into a
+/// line break, and a regular expression's groups must match, all as syntax errors when boa
+/// reads the script. The guard drops a reading at those points; if boa ever accepted one of
+/// these, that reading could be boa's, and the guard would have to keep it.
+#[test]
+fn boa_rejects_what_the_nesting_guard_drops() {
+    for s in ["var r = /)/;", "var r = /(/;", "var r = /a)(b/;", "var r = /a\n/;", "var r = /a\\\n/;", "var s = 'a\nb';", "var s = \"a\rb\";"] {
+        // Rejected while boa reads the script, before the line in front of it runs.
+        let o = go(&format!("console.println('ran');\n{s}"), &Event::field("Calculate", "a", ""));
+        assert!(o.error.as_deref().is_some_and(|e| !e.contains("nested too deeply")), "{s:?}: {:?}", o.error);
+        assert!(o.console.is_empty(), "{s:?} was rejected only when it ran: {:?}", o.console);
+    }
+    for s in ["var r = /[(]/;", "var r = /\\)/;", "var r = /[)]/;", "var s = 'a\\\nb';", "var s = 'a\u{2028}b';"] {
+        let o = go(s, &Event::field("Calculate", "a", ""));
+        assert_eq!(o.error, None, "{s:?}");
+    }
+}
+
+/// The guard's three limits sit exactly where documented: 64 nested brackets, a run of 64
+/// prefix operators and 4,096 conditionals pass, and one more of each is refused.
+#[test]
+fn nesting_guard_limits_brackets_prefixes_and_conditionals_separately() {
+    assert_eq!(super::run::refuse(&format!("{}1{}", "(".repeat(64), ")".repeat(64))), None);
+    assert!(super::run::refuse(&format!("{}1{}", "(".repeat(65), ")".repeat(65))).is_some());
+
+    assert_eq!(super::run::refuse(&format!("{}1", "!".repeat(64))), None);
+    assert!(super::run::refuse(&format!("{}1", "!".repeat(65))).is_some());
+
+    assert_eq!(super::run::refuse(&"?".repeat(4096)), None);
+    assert!(super::run::refuse(&"?".repeat(4097)).is_some());
+}
+
+/// Closing brackets inside a comment don't cancel real nesting (#5079): 1,000 groups of 50
+/// opening brackets, each followed by a block comment holding 50 closing ones, nest 50,000 deep
+/// for the parser, and the guard refuses the script before boa parses it.
+#[test]
+fn closing_brackets_in_comments_do_not_cancel_nesting() {
+    let group = format!("{}/*{}*/", "(".repeat(50), ")".repeat(50));
+    let s = group.repeat(1000);
+    assert_eq!(super::run::refuse(&s).as_deref(), Some("the script is nested too deeply to run safely"));
+}
+
 /// Code built from strings at run time would reach the parser without the size and nesting
 /// checks the script itself passed, so `eval` and the `Function` constructors refuse it.
 #[test]
@@ -1989,6 +2144,22 @@ mod session {
         assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
     }
 
+    /// The #5079 reproduction on the XFA-open path: an initialize script of `/'/` followed by
+    /// 64,000 `(` overflowed the `pdfcraft-xfa-session` thread's stack and aborted the app. The
+    /// nesting guard reads past the regex's quote, so the script is refused and the session stays
+    /// alive for the next one. So is one where the quote puts later strings out of phase, nesting
+    /// a level deeper on each of 5,000 lines.
+    #[test]
+    fn a_quote_in_a_regex_cannot_hide_nesting_from_an_initialize_script() {
+        let mut s = XfaSession::new(XfaDoc::default());
+        for hostile in [format!("/'/ {}1", "(".repeat(64_000)), format!("x={}", "(/\"/,\"))))\",\n".repeat(5_000))] {
+            let o = s.run(script(&hostile, false, "form1[0].page1[0].total[0]", "initialize"));
+            assert!(o.error.as_deref().is_some_and(|e| e.contains("nested too deeply")), "{:?}", o.error);
+        }
+        assert_eq!(s.dead(), None);
+        assert_eq!(s.run(script("1 + 1", false, "form1[0].page1[0].total[0]", "calculate")).result.as_deref(), Some("2"));
+    }
+
     /// A JavaScript or FormCalc script whose engine takes longer to be ready than the script's
     /// time limit still runs and returns its result, and the session stays alive.
     #[test]