We're now using exceptions for errors, and scanning/pushing tokens is exception-safe (using a set of "limbo tokens").