Universal Links not opening in app (in dev)

I believe I have everything configured correctly for Universal Links to be working, but every method I try to launch a link just takes me to safari. Any ideas would be appreciated!

The app in question is not yet in the app store, but some previous versions are in TestFlight.

Entitlements file:

<plist version="1.0">
<dict>
  ...
  <key>com.apple.developer.associated-domains</key>
  <array>
    <string>webcredentials:o.s.com</string>
    <string>applinks:o.s.com</string>
    <string>webcredentials:p.d.org:3011?mode=developer</string>
    <string>applinks:p.d.org:3011?mode=developer</string>
    <string>applinks:p.d.org?mode=developer</string>
  </array>

p.d.org:3011 (not the real url) is a public DNS record that resolves to the LAN IP of my macbook where a dev instance of our server is running with a valid TLS certificate from Let's Encrypt.

o.s.com is the url of the our staging environment, which some TestFlight builds connect to.

The AASA file served by both servers is currently a combination of both old and new formats, but I originally just had what I believe to be the new format (from here):

{
  "applinks": {
    "apps": [],
    "details": [{
      "appIDs": [
        "the.real.app.id", // <--- redacted
        "the.second.app.id"
      ],
      "components": [{
        "?": "no_universal_link",
        "exclude": true,
        "comment": "Exclude any URL with no_universal_link in the query params"
      }, {
        "/": "/group/browse",
        "exclude": true,
        "comment": "Exclude group browse list"
      }, {
        "/": "/invited*",
        "comment": "Match invited link"
      }]
    }, {
      "appID:": "the.real.app.id",
      "paths": ["/invited*", "/group/*"]
    },  {
      "appID:": "the.second.app.id",
      "paths": ["/invited*", "/group/*"]
    }]
  },
  "webcredentials": {
    "apps": [
      "the.real.app.id",
      "the.second.app.id"
    ]
  },
  "activitycontinuation": {
    "apps": [
      "the.real.app.id",
      "the.second.app.id"
    ]
  }
}

I have two phones and an iPad I test on, one phone with the iOS beta installed (currently 15.5 beta 4) and one phone + the iPad with the current public iOS (15.4.1). On all devices, Settings->Developer->Associated Domains Development is ON.

Upon install of a Debug build of the.real.app.id, I confirmed that /.well-known/apple-app-site-association was fetched from my local dev server.

Settings->Developer->Universal Links->Diagnostics shows the following for https://p.d.org:3011:

for https://o.s.com, though, it show a problem, which I'm assuming is due to the debug build not matching a url with ?mode=developer:

In the AppDelegate, I've implemented:

func application(_ application: UIApplication, 
    continue userActivity: NSUserActivity,
    restorationHandler: @escaping ([UIUserActivityRestoring]?) -> Void) -> Bool {
  logger.info("continue user activity: \(userActivity.activityType, privacy: .public)")
  return true
}

and in the SwiftUI App subclass, I also have:

var body: some Scene {
  WindowGroup {
   MainContentView()
    .onContinueUserActivity(NSUserActivityTypeBrowsingWeb, perform: launchUrl(userActivity:))
    .onOpenURL { url in
     print("On open url: \(url)")
    }
  }
 }

func launchUrl(userActivity: NSUserActivity) {
  logger.info("launchUrl continue user activity: \(userActivity.activityType, privacy: .public)")
 }

I've sent myself messages with links to p.d.org:3011 in a number of apps, including iMessage. I've rendered a link into a QR code for use in the camera app. I've even built a second app into which I've hard coded the link to ensure that it calls UIApplication.shared.open(url, options: [:], completionHandler: nil). All of these methods take me to the browser (safari).

For completeness, I'm using the link: https://p.d.org:3011/invited?id=...

When the web opens, a blank app preview banner appears sometimes. I expect that it's blank because the app in question hasn't been publicly released to the app store yet. The landing page doesn't have enough content to scroll the page, and pulling down on the page doesn't reveal the app preview banner when the banner doesn't show.

The logging statements in the app never print.

I've also tried building both Ad Hoc and TestFlight versions of the app for o.s.com. Server logs similarly show the AASA being fetched. But the Diagnostics in Settings show the yellow triangle screen for both p.d.org:3011 and o.s.com.

I'm not sure what I'm doing wrong here, and I can't find any more information on the web. Can someone help me out ...or put me out of my misery?