When trying to stringify an unknown data structure, the encoder had a bug in the backtracking that would cause output corruption for refcounts > 1. Solution: Avoid tracking refs that we don't want to refer to using REFP/ALIAS.
ref_rewrite_pos used to be a copy of the pos pointer into the buffer. Alas, that would turn out to be a nasty, nasty problem if you realloc the buffer and then restore pos from ref_rewrite_pos to point outside the buffer. Fix: ref_rewrite_pos is now an offset into the buffer.