The substition invariant relies on keeping the in-scope
set in sync, and we weren't always doing so, which means that
a DEBUG compiler crashes sometimes with an assertion failure

This patch fixes a couple more cases.  Still not validate
clean (with -DEEBUG) but closer!