@@ -98,18 +98,15 @@ fn version_bounds(spec: &str) -> Option<(Release, Release)> {
     })
 }
 
-/// The `packageManager` value of a `.modules.yaml`.
-fn modules_yaml_package_manager(text: &str) -> Option<String> {
-    super::modules_yaml::field(text, "packageManager")
-}
-
 /// Every pnpm version pin the project's files carry, as `(where, spec)`.
 fn pnpm_pins(
     package_json: Option<&str>,
     modules_yaml: Option<&str>,
 ) -> Vec<(&'static str, String)> {
     let mut pins = Vec::new();
-    if let Some(spec) = modules_yaml.and_then(modules_yaml_package_manager) {
+    if let Some(spec) =
+        modules_yaml.and_then(|text| super::modules_yaml::field(text, "packageManager"))
+    {
         if let Some(version) = pinned_version(&spec, "pnpm") {
             pins.push(("node_modules/.modules.yaml", version.to_string()));
         }
@@ -201,20 +198,13 @@ mod tests {
     /// #1918: a YAML `.modules.yaml` is read like every other pnpm settings
     /// file: the last top-level key wins, comments are not part of the value.
     #[test]
-    fn modules_yaml_package_manager_reads_the_last_key() {
+    fn modules_yaml_pin_reads_the_last_key() {
+        let pins = |text: &str| pnpm_pins(None, Some(text));
         let text = "packageManager: pnpm@9.0.0\npackageManager: pnpm@11.0.0 # newer\n";
-        assert_eq!(
-            modules_yaml_package_manager(text).as_deref(),
-            Some("pnpm@11.0.0")
-        );
-        assert_eq!(
-            modules_yaml_package_manager("packageManager: 'pnpm@8.6.0'\n").as_deref(),
-            Some("pnpm@8.6.0")
-        );
-        assert_eq!(
-            modules_yaml_package_manager("{\"packageManager\":\"pnpm@10.1.0\"}").as_deref(),
-            Some("pnpm@10.1.0")
-        );
+        let want = vec![("node_modules/.modules.yaml", "11.0.0".to_string())];
+        assert_eq!(pins(text), want);
+        assert_eq!(pins("packageManager: 'pnpm@11.0.0'\n"), want);
+        assert_eq!(pins("{\"packageManager\":\"pnpm@11.0.0\"}"), want);
     }
 
     #[test]
 
@@ -58,15 +58,20 @@ pub(crate) fn top_level_key(line: &str) -> Option<(String, &str)> {
 
 /// The value of the last top-level `key` in a YAML settings file
 /// (pnpm-workspace.yaml, .yarnrc.yml, a YAML `.modules.yaml`), decoded by
-/// [`yaml_scalar`]. An empty or block value is `Some("")`; callers that
-/// read empty as unset use [`yaml_top_level_value`]. [`top_level_key`]
+/// [`yaml_scalar`]. An empty value or a nested block is `Some("")`
+/// (callers that read empty as unset use [`yaml_top_level_value`]); a
+/// block scalar (`key: |`) is `None`, unread. [`top_level_key`]
 /// skips the first line's BOM. Every pnpm settings reader goes through
 /// this one function so a quoted value reads the same everywhere (#1918).
 pub(crate) fn top_level_scalar(text: &str, key: &str) -> Option<String> {
     text.lines()
         .filter_map(top_level_key)
         .rfind(|(k, _)| k == key)
-        .map(|(_, value)| yaml_scalar(value))
+        .and_then(|(_, value)| {
+            // A block scalar (`|`, `>-`) continues on the next lines; its
+            // value is not on this one, so it is not read here.
+            (!value.starts_with(['|', '>'])).then(|| yaml_scalar(value))
+        })
 }
 
 /// [`top_level_scalar`], with an empty value read as unset.
@@ -332,8 +337,13 @@ fn is_marker(line: &str, marker: &str) -> bool {
 pub(crate) fn strip_comment(text: &str) -> &str {
     let bytes = text.as_bytes();
     let mut quote = None;
+    let mut escaped = false;
     for (i, &b) in bytes.iter().enumerate() {
         match quote {
+            // Inside double quotes a backslash escapes the next byte, so
+            // `\"` does not close the scalar (#1918).
+            Some(b'"') if escaped => escaped = false,
+            Some(b'"') if b == b'\\' => escaped = true,
             Some(q) if b == q => quote = None,
             Some(_) => {}
             None if b == b'\'' || b == b'"' => quote = Some(b),
@@ -347,35 +357,60 @@ pub(crate) fn strip_comment(text: &str) -> &str {
 }
 
 /// A double-quoted scalar at the start of `s`: its value and byte length.
+/// Escapes decode as YAML 1.2 (and js-yaml) does, `\uD83D\uDE00`
+/// surrogate pairs included; a malformed escape is `None`, as the file
+/// does not parse.
 fn double_quoted(s: &str) -> Option<(String, usize)> {
+    /// `n` hex digits as a code point (`None` when short or not hex).
+    fn hex(chars: &mut impl Iterator<Item = (usize, char)>, n: usize) -> Option<u32> {
+        let digits: String = (0..n).map_while(|_| chars.next().map(|(_, h)| h)).collect();
+        (digits.len() == n && digits.chars().all(|c| c.is_ascii_hexdigit()))
+            .then(|| u32::from_str_radix(&digits, 16).ok())
+            .flatten()
+    }
     let mut out = String::new();
     let mut chars = s.char_indices().skip(1);
     while let Some((i, c)) = chars.next() {
         match c {
             '"' => return Some((out, i + 1)),
             '\\' => {
                 let (_, esc) = chars.next()?;
-                match esc {
-                    'n' => out.push('\n'),
-                    't' => out.push('\t'),
-                    'r' => out.push('\r'),
+                let decoded = match esc {
+                    '0' => '\0',
+                    'a' => '\u{7}',
+                    'b' => '\u{8}',
+                    't' | '\t' => '\t',
+                    'n' => '\n',
+                    'v' => '\u{b}',
+                    'f' => '\u{c}',
+                    'r' => '\r',
+                    'e' => '\u{1b}',
+                    'N' => '\u{85}',
+                    '_' => '\u{a0}',
+                    'L' => '\u{2028}',
+                    'P' => '\u{2029}',
+                    '"' | '\\' | '/' | ' ' => esc,
+                    'x' => char::from_u32(hex(&mut chars, 2)?)?,
+                    'U' => char::from_u32(hex(&mut chars, 8)?)?,
                     'u' => {
-                        let hex: String = (0..4)
-                            .filter_map(|_| chars.next().map(|(_, h)| h))
-                            .collect();
-                        let code = u32::from_str_radix(&hex, 16)
-                            .ok()
-                            .filter(|_| hex.len() == 4);
-                        out.push(code.and_then(char::from_u32)?);
-                    }
-                    '"' | '\\' | '/' | ' ' => out.push(esc),
-                    // Any other escape decodes to text no pnpm key uses;
-                    // keep it visibly distinct rather than guessing.
-                    other => {
-                        out.push('\\');
-                        out.push(other);
+                        let unit = hex(&mut chars, 4)?;
+                        if (0xD800..0xDC00).contains(&unit) {
+                            // A high surrogate pairs with a following `\uDCxx`.
+                            if chars.next()?.1 != '\\' || chars.next()?.1 != 'u' {
+                                return None;
+                            }
+                            let low = hex(&mut chars, 4)?;
+                            if !(0xDC00..0xE000).contains(&low) {
+                                return None;
+                            }
+                            char::from_u32(0x10000 + ((unit - 0xD800) << 10) + (low - 0xDC00))?
+                        } else {
+                            char::from_u32(unit)?
+                        }
                     }
-                }
+                    _ => return None,
+                };
+                out.push(decoded);
             }
             c => out.push(c),
         }
@@ -424,6 +459,15 @@ mod tests {
             ("k: 'a' b\n", Some("'a' b")),
             ("\u{feff}k: x\n", Some("x")),
             ("k: a\r\nk: 'b'\r\n", Some("b")),
+            // Review on #1973: escapes the old JSON decoder read, an escaped
+            // quote before ` #`, a malformed escape, and a block scalar.
+            ("k: \"/p/a\\\" #b/.pnpm\"\n", Some("/p/a\" #b/.pnpm")),
+            ("k: \"nm-\\ud83d\\ude00\"\n", Some("nm-\u{1f600}")),
+            ("k: \"a\\bb\\x41\\U0001F600\"\n", Some("a\u{8}bA\u{1f600}")),
+            ("k: \"\\u+041\"\n", Some("\"\\u+041\"")),
+            ("k: \"\\ud83d\"\n", Some("\"\\ud83d\"")),
+            ("k: >-\n  long value\n", None),
+            ("k: |\n  text\n", None),
             ("  k: nested\n", None),
             ("other: x\n", None),
         ] {
 
@@ -377,7 +377,7 @@ pub const TRUST_SCAFFOLD_LINES: [&str; 3] = [
 /// workspace surgery: untouched lines stay byte-identical, so a revert can
 /// remove exactly what was added.
 pub fn plan_workspace_trust(existing: Option<&str>) -> TrustPlan {
-    use crate::formats::pnpm::workspace::{block_insert_point, top_level_key};
+    use crate::formats::pnpm::workspace::{block_insert_point, top_level_key, yaml_scalar};
     let Some(text) = existing else {
         return TrustPlan::Create("packages:\n  - '.'\ntrustLockfile: true\n".to_string());
     };
@@ -401,17 +401,18 @@ pub fn plan_workspace_trust(existing: Option<&str>) -> TrustPlan {
     // Top-level key only (every spelling pnpm reads: quoted, `key :`, a
     // trailing comment): an indented `trustLockfile:` under some other
     // mapping is not the setting pnpm reads.
-    for line in &lines {
-        if let Some((key, value)) = top_level_key(line) {
-            if key != "trustLockfile" {
-                continue;
-            }
-            let value = value.trim_matches(|c| c == '\'' || c == '"');
-            if value == "true" {
-                return TrustPlan::AlreadyTrue;
-            }
-            return TrustPlan::UserSet(value.to_string());
+    // The last assignment is the one pnpm reads, decoded by the shared pnpm
+    // settings reader (#1918).
+    let existing = lines
+        .iter()
+        .filter_map(|line| top_level_key(line))
+        .rfind(|(key, _)| key == "trustLockfile");
+    if let Some((_, value)) = existing {
+        let value = yaml_scalar(value);
+        if value == "true" {
+            return TrustPlan::AlreadyTrue;
         }
+        return TrustPlan::UserSet(value);
     }
     // After the document's last non-empty line (no blank separator; before a
     // `...` end marker): a revert removes exactly one line and the file's
@@ -662,6 +663,24 @@ mod tests {
         assert!(!merged.contains("packageManager"), "{merged}");
     }
 
+    /// #1918: the last `trustLockfile:` is the one pnpm reads, decoded by
+    /// the shared pnpm settings reader (an unpaired quote is not `true`).
+    #[test]
+    fn workspace_trust_plan_reads_the_last_key_as_yaml() {
+        assert!(matches!(
+            plan_workspace_trust(Some("trustLockfile: false\ntrustLockfile: true\n")),
+            TrustPlan::AlreadyTrue
+        ));
+        match plan_workspace_trust(Some("trustLockfile: \"true'\n")) {
+            TrustPlan::UserSet(value) => assert_eq!(value, "\"true'"),
+            _ => panic!("expected UserSet"),
+        }
+        assert!(matches!(
+            plan_workspace_trust(Some("trustLockfile: 'true'\n")),
+            TrustPlan::AlreadyTrue
+        ));
+    }
+
     /// #904 (hosted): a BOM-prefixed `trustLockfile:` first line is the
     /// user's explicit setting — kept, never shadowed by an appended
     /// duplicate key — and a BOM file that needs the key keeps its BOM.
 
@@ -559,7 +559,7 @@ fn yaml_path_in(lines: &[String], path: &[&str]) -> Result<Option<String>, Strin
         return Ok(None);
     }
     if rest.is_empty() {
-        let value = value.trim_matches(['"', '\'']).to_string();
+        let value = crate::formats::pnpm::workspace::yaml_scalar(&value);
         return Ok((!value.is_empty()).then_some(value));
     }
     if !value.is_empty() {
@@ -1314,7 +1314,7 @@ fn yaml_block_value(text: &str, section: &str, key: &str) -> Option<String> {
         })
         .filter_map(top_level_key)
         .rfind(|(k, _)| k == key)
-        .map(|(_, value)| value.trim_matches(['"', '\'']).to_string())
+        .map(|(_, value)| crate::formats::pnpm::workspace::yaml_scalar(value))
         .filter(|value| !value.is_empty())
 }
 
@@ -1549,10 +1549,7 @@ fn pnpm_lock_tarball_evidence(
 /// (`.modules.yaml`'s `packageManager`, package.json's corepack pin,
 /// `+sha…` suffix allowed).
 fn pnpm_spec_version(spec: &str) -> Option<PnpmVersion> {
-    let version = spec
-        .trim()
-        .trim_matches(['"', '\''])
-        .strip_prefix("pnpm@")?;
+    let version = spec.trim().strip_prefix("pnpm@")?;
     pnpm_version(version)
 }
 
@@ -4459,4 +4456,28 @@ mod tests {
             "common/config/subspaces/x/"
         );
     }
+
+    /// #1918: nested pnpm/yarn settings values decode YAML quoting through
+    /// the same decoder as the top-level reader.
+    #[test]
+    fn nested_settings_values_decode_yaml_quoting() {
+        assert_eq!(
+            super::yaml_block_value(
+                "registries:\n  default: 'https://r/it''s/'\n",
+                "registries",
+                "default"
+            )
+            .as_deref(),
+            Some("https://r/it's/")
+        );
+        assert_eq!(
+            super::yaml_path_value(
+                "npmScopes:\n  s:\n    npmRegistryServer: \"https://r/\\u0041\"\n",
+                &["npmScopes", "s", "npmRegistryServer"]
+            )
+            .unwrap()
+            .as_deref(),
+            Some("https://r/A")
+        );
+    }
 }