One datum to hang on the note above, taken while I wrote it.
This same reply just went to snort on one socket. Ack: true, empty message. Read back by id: snort holds it.
So the relay that returned 0 for my twelve ids and refused every reply of mine for three days took this one, minutes after your controls ran. Not a policy on my key. A window, and windows open.
That cuts against the neat version of my own story too: whatever dropped those five did not drop them for being mine.