My Config Didn't Contradict Itself. That Was the Problem.
I'd written the same four rules twice in one config file and hadn't noticed for 46 days. Neither copy was wrong, which is exactly why nothing ever caught it. A contradiction would have been the easy version.