How bad would it be to reuse the random blinding factor in a scheme like Paillier?
The first obvious objection is that it would do a lousy job of blinding values; if you reuse the blinding factor, then it would be practical to correlate the blinded values with their original ones (and the entire point of blinding values is to prevent anyone from doing so).

Suppose we had two original encrypted values $c$, $d$, and the corresponded blinded versions $x = c \cdot r_1^n$ and $y = d \cdot r_2^n$.  Knowing nothing else, it would be infeasible to decide whether $x$ is a blinded copy of $c$, or a blinded copy of $d$.

However, if $r_1 = r_2 = r$, we can check if $c \cdot y = d \cdot x$.  If $x$ is a blinded version of $c$, and $y$ is a blinded version of $d$, then this check gives us $c \cdot d \cdot r^n = d \cdot c \cdot r^n$, or in other words, equality holds.

In addition, you ask:


  Since multiplication by $s$ "should" be large-enough to trigger a modulo wrap-around, it seems like successive $s^i$ values would not give any information about any of the previous $s^k,k&lt;i$ (and thus preserve the security of all ciphertexts). Is this correct?


That is also not correct.  Given $c \cdot s^2$ and $c \cdot s$, the attacker can recover $c$ by computing:

$$(c \cdot s^2)^{-1} \cdot (c \cdot s)^2 = c$$

$(c \cdot s^2)^{-1}$ is the inverse of $c \cdot s^2$ modulo $n^2$, it can be computed as long as $c \cdot s^2$ is relatively prime to $n^2$