[SizzleUnrlsd]

Summary

The four documented limits, closed at Hugo's request.

• Tests first (test: define positional patterns, nonlocal, local classes and while conditions), implementation follows.
• Positional class patterns: case Point(0, y) uses the class's __match_args__ when the class is defined in the module, explicitly or as the field order of a @dataclass, which needed the HIR to keep bare annotated declarations (Declaration) instead of dropping them; for an unknown class each position becomes a conservative attribute of the subject, so the match lowers and taint still flows through the captures.
• nonlocal: the declared name becomes a local of the nested function initialised from the captured value, so the body is analysed and a sink inside it sees the write. The write does not flow back to the enclosing function yet; the test pins that down as the remaining approximation.
• Classes defined inside functions: a MakeClass value bound to the name, bases and decorators evaluated, and the methods analysed as nested functions (outer.Inner.run), captured variables included.
• Control flow inside a while condition: the loop becomes while True with the condition laid out at the top of the body and a break, the else clause running before it, so the condition is recomputed every iteration.
• The tests that used a class inside a function as the canonical unsupported construct now use a break outside a loop, which the parser accepts and the CFG rejects.

On the sixteen repositories nothing changes.