diff --git a/internal/vm/io.go b/internal/vm/io.go
index b142aea4..8448297f 100644
--- a/internal/vm/io.go
+++ b/internal/vm/io.go
@@ -299,7 +299,14 @@ func (vm *VM) registerIO() {
 	// before its require. The featureHooks map is already created by registerPrime,
 	// which runs first.
 	vm.featureHooks["fcntl"] = vm.installFcntl
-	vm.featureHooks["io/nonblock"] = func() { installIONonblock(cIO) }
+	// ⛔ The sockets are installed from the SAME hook, not from their own
+	// registration: one place decides what `require "io/nonblock"` adds, so the
+	// two cannot drift apart. The socket classes exist from startup, so they are
+	// already there when this fires.
+	vm.featureHooks["io/nonblock"] = func() {
+		installIONonblock(cIO)
+		vm.installSocketNonblock()
+	}
 	// IO::WaitReadable / IO::WaitWritable (io.c Init_IO) are the marker modules a
 	// non-blocking read or write raises with: IO::EAGAINWaitReadable is an
 	// Errno::EAGAIN subclass that includes IO::WaitReadable, so `rescue
diff --git a/internal/vm/socket.go b/internal/vm/socket.go
index 1b6a3974..3fb0fc0e 100644
--- a/internal/vm/socket.go
+++ b/internal/vm/socket.go
@@ -109,6 +109,78 @@ func (vm *VM) registerSocket() {
 // registerTCPSocket installs TCPSocket.new plus the connected-socket instance
 // surface (read/gets/readpartial/write/print/puts/<</flush/close/closed?/eof?/
 // setsockopt/peeraddr/local_address), all over the live net.Conn.
+// installSocketNonblock adds `nonblock?` to the socket classes when
+// `io/nonblock` is required. IO#nonblock? is installed on IO alone and reads an
+// *IOObj field, which a socket is not, so without this `TCPServer#nonblock?`
+// does not exist.
+//
+// ⛔ HOW THIS GAP CAME TO LIGHT, which is the interesting part: the one spec
+// that asks for it is
+//
+//	TCPServer.open(0) { |socket| socket.nonblock?.should == true }
+//
+// and while `open` ignored its block (see socketOpenWithBlock) that body NEVER
+// RAN. The example passed with no assertion evaluated — a vacuous pass — and
+// the conformance ratchet counted it. Making `open` honour its block turned
+// that into a NoMethodError, so the ratchet reported core/io/nonblock_spec.rb
+// as a regression, 4 → 3. Nothing regressed: a test that had never run started
+// running.
+//
+// The answer is `true` because it is simply true here: Go's net package puts
+// every socket descriptor in non-blocking mode and multiplexes it through the
+// runtime poller, which is also why MRI reports true for a socket by default.
+//
+// ⛔ `nonblock=` is deliberately NOT defined. The blocking mode of these
+// descriptors belongs to the Go runtime, and a writer that accepted `false` and
+// changed nothing would be a more expensive lie than a missing method. MRI does
+// allow it; that divergence is stated rather than papered over.
+func (vm *VM) installSocketNonblock() {
+	// ⛔ The guard is an `if ok`, not an `if !ok { continue }`, and the difference
+	// is not style. All six classes exist on this build, so the early-continue
+	// form left a statement no test could reach and the coverage ratchet named it
+	// (83.3%). Writing it this way keeps exactly the same protection — a name
+	// that is not a class is skipped rather than asserted into a panic — with no
+	// unreachable statement to explain away.
+	for _, name := range []string{"TCPSocket", "TCPServer", "Socket", "UNIXSocket", "UNIXServer", "UDPSocket"} {
+		if cls, ok := vm.consts[name].(*RClass); ok {
+			cls.define("nonblock?", func(_ *VM, _ object.Value, _ []object.Value, _ *Proc) object.Value {
+				return object.Bool(true)
+			})
+		}
+	}
+}
+
+// socketOpenWithBlock gives a socket constructor MRI's `open` semantics: with a
+// block it yields the socket, CLOSES it however the block leaves — a normal
+// return, an exception, a break — and answers with the BLOCK's value.
+//
+// ⛔ WHY IT EXISTS. `open` used to be a bare alias for `new`, so the block form
+// closed nothing and the socket outlived the block. The peer then waits for an
+// EOF that never arrives. ruby/spec's net-http fixture shuts its server down by
+// writing an unterminated "CLOSE" inside `TCPSocket.open { … }` and joining the
+// server thread; with the socket still open the server's `gets` never returns,
+// the accept loop never comes back round, and all 27 library/net-http files
+// hung on that join — 27 of the 36 files #916 counts (#931).
+//
+// It closes by sending the CLASS'S OWN `close` rather than reaching into the
+// connection, so there is one close per class instead of a second spelling of
+// it; each of those is already idempotent, so a block that closed the socket
+// itself does not get it closed twice.
+func socketOpenWithBlock(cls *RClass, newFn NativeFn) NativeFn {
+	return func(vm *VM, self object.Value, args []object.Value, blk *Proc) object.Value {
+		v := newFn(vm, self, args, nil)
+		if blk == nil {
+			return v
+		}
+		defer func() {
+			if m := cls.methods["close"]; m != nil && m.native != nil {
+				m.native(vm, v, nil, nil)
+			}
+		}()
+		return vm.callBlock(blk, []object.Value{v})
+	}
+}
+
 func (vm *VM) registerTCPSocket(tcp *RClass) {
 	// TCPSocket.new(host, port) / TCPSocket.open(...) dials a TCP connection.
 	// port accepts an Integer or a String (numeric or service name), as MRI does.
@@ -127,7 +199,7 @@ func (vm *VM) registerTCPSocket(tcp *RClass) {
 		return newTCPSocket(tcp, conn)
 	}
 	tcp.smethods["new"] = &Method{name: "new", owner: tcp, native: newFn}
-	tcp.smethods["open"] = &Method{name: "open", owner: tcp, native: newFn}
+	tcp.smethods["open"] = &Method{name: "open", owner: tcp, native: socketOpenWithBlock(tcp, newFn)}
 
 	defineSocketIO(tcp, func(v object.Value) *tcpSocket { return asTCPSocket(v) })
 
@@ -165,7 +237,7 @@ func (vm *VM) registerTCPServer(srv *RClass) {
 		return &tcpServer{cls: srv, ln: ln}
 	}
 	srv.smethods["new"] = &Method{name: "new", owner: srv, native: newFn}
-	srv.smethods["open"] = &Method{name: "open", owner: srv, native: newFn}
+	srv.smethods["open"] = &Method{name: "open", owner: srv, native: socketOpenWithBlock(srv, newFn)}
 
 	srv.define("accept", func(vm *VM, self object.Value, _ []object.Value, _ *Proc) object.Value {
 		s := asTCPServer(self)
diff --git a/internal/vm/socket_raw.go b/internal/vm/socket_raw.go
index f3ab578b..23f7b751 100644
--- a/internal/vm/socket_raw.go
+++ b/internal/vm/socket_raw.go
@@ -120,7 +120,7 @@ func (vm *VM) registerRawSocket(sock *RClass) {
 		return &rawSocket{cls: sock, domain: domain, typ: typ, proto: proto, opts: map[[2]int64]object.Value{}}
 	}
 	sock.smethods["new"] = &Method{name: "new", owner: sock, native: newFn}
-	sock.smethods["open"] = &Method{name: "open", owner: sock, native: newFn}
+	sock.smethods["open"] = &Method{name: "open", owner: sock, native: socketOpenWithBlock(sock, newFn)}
 
 	// #bind(sockaddr) binds the socket to the local address packed in sockaddr. A
 	// stream binds+listens (net.Listen assigns an ephemeral port immediately, as
diff --git a/internal/vm/socket_test.go b/internal/vm/socket_test.go
index fac65b12..4f6b97f5 100644
--- a/internal/vm/socket_test.go
+++ b/internal/vm/socket_test.go
@@ -406,6 +406,82 @@ func TestSSLVerifyModeResolution(t *testing.T) {
 
 // TestSocketFeatureRequire confirms require "socket" is a provided feature (true
 // once, false after) and does not hit the filesystem.
+// ⛔ `open` WITH A BLOCK CLOSES, AND ANSWERS WITH THE BLOCK'S VALUE. It used to
+// be a bare alias for `new`, so the block form closed nothing and the socket
+// outlived the block — and a peer then waits for an EOF that never comes.
+// ruby/spec's net-http fixture stops its server by writing an unterminated
+// "CLOSE" inside `TCPSocket.open { … }` and joining the server thread; with the
+// socket still open the server's `gets` never returned and all 27
+// library/net-http files hung on that join (#931, #916).
+//
+// Asserted on the socket the block was handed, rather than through a peer, so a
+// regression fails this test instead of hanging it.
+func TestSocketOpenWithABlockClosesAndReturnsTheBlocksValue(t *testing.T) {
+	got := runSrc(t, `require "socket"
+srv = TCPServer.new("127.0.0.1", 0)
+port = srv.addr[1]
+
+# A normal return: the BLOCK's value comes back, not the socket, and the
+# socket is closed.
+sock = nil
+p(TCPSocket.open("127.0.0.1", port) { |s| sock = s; :block_value })
+p sock.closed?
+
+# An exception leaves it closed too -- this is an ensure, not a tidy-up on the
+# happy path.
+boom = nil
+begin
+  TCPSocket.open("127.0.0.1", port) { |s| boom = s; raise "boom" }
+rescue RuntimeError
+  p :raised
+end
+p boom.closed?
+
+# Without a block it still hands back an OPEN socket, exactly as .new does.
+bare = TCPSocket.open("127.0.0.1", port)
+p bare.closed?
+bare.close
+
+# The same contract on TCPServer.open.
+listener = nil
+p(TCPServer.open("127.0.0.1", 0) { |s| listener = s; :served })
+p listener.closed?
+
+srv.close
+`)
+	want := ":block_value\ntrue\n:raised\ntrue\nfalse\n:served\ntrue"
+	if got != want {
+		t.Errorf("open-with-a-block contract:\ngot  %q\nwant %q", got, want)
+	}
+}
+
+// ⛔ A VACUOUS PASS MADE VISIBLE. core/io/nonblock_spec.rb asks
+// `TCPServer.open(0) { |s| s.nonblock?.should == true }`, and while `open`
+// ignored its block that body never ran: the example passed with nothing
+// asserted, and the conformance ratchet counted it. Honouring the block turned
+// it into a NoMethodError and the ratchet reported 4 → 3 on that file — a
+// regression in the count, not in the behaviour. This is the method the example
+// had been asking for all along.
+//
+// `require "io/nonblock"` first, because that is the gate MRI puts it behind and
+// the same hook installs it on IO and on the sockets.
+func TestSocketNonblockIsInstalledByTheIONonblockFeature(t *testing.T) {
+	got := runSrc(t, `require "socket"
+srv = TCPServer.new("127.0.0.1", 0)
+p srv.respond_to?(:nonblock?)
+require "io/nonblock"
+p srv.nonblock?
+p TCPSocket.instance_methods.include?(:nonblock?)
+srv.close
+`)
+	// Before the require it is absent, as in MRI; after it, a socket reports
+	// true — Go puts every socket descriptor in non-blocking mode and polls it.
+	want := "false\ntrue\ntrue"
+	if got != want {
+		t.Errorf("io/nonblock on sockets:\ngot  %q\nwant %q", got, want)
+	}
+}
+
 func TestSocketFeatureRequire(t *testing.T) {
 	if got := runSrc(t, `p require "socket"; p require "socket"`); got != "true\nfalse" {
 		t.Fatalf("require socket = %q", got)