iOS 10.3 Universal Links Not Working

I've gone through pretty much every Universal Links question on SO that I can find and have yet to have any luck. For the record, this all appears to pass Branch's validator.

I'm running iOS 10.3 and serving up my aasa file behind https, so in theory I shouldn't need to sign it.

Here's where I stand:

When the app is installed, tailing Heroku's logs for my staging server gives me this:

7-07-27T17:24:59.818724+00:00 heroku[router]: at=info method=GET path="/.well-known/apple-app-site-association" host=trueey-staging.herokuapp.com request_id=54b817e2-1d89-4c7a-9ed8-f52bdb3ad46e fwd="24.23.197.78" dyno=web.1 connect=1ms service=6ms status=200 bytes=618 protocol=https
2017-07-27T17:24:59.812926+00:00 app[web.1]: Started GET "/.well-known/apple-app-site-association" for 24.23.197.78 at 2017-07-27 17:24:59 +0000
2017-07-27T17:24:59.814845+00:00 app[web.1]: Processing by Web::AppSiteController#show as */*
2017-07-27T17:24:59.815538+00:00 app[web.1]: Completed 200 OK in 1ms (Views: 0.1ms | ActiveRecord: 0.0ms)

1) My entitlements:

applinks:trueey-staging.herokuapp.com
applinks:https://trueey-staging.herokuapp.com

Are these the same thing? Probably, but let's double-down

2) My apple-app-site-association file, route, and Rails controller that serves it up:

apple-app-site-association (lives in /public as apple-app-site):

{
    "applinks": {
        "apps": [ ],
        "details": [
            {
                "appID": "[Prefix].[AppId]",    
                "paths": [ "*", "/" ]
            }
        ]
    }   
}

route(s):

  get "/apple-app-site-association", to: "web/app_site#show"
  get "/.well-known/apple-app-site-association", to: "web/app_site#show"

Controller:

module Web

class AppSiteController < ApplicationController
    def show
        data = File.read("#{Rails.root}/public/apple-app-site")
        render json: data
    end
end

end

3) In My AppDelegate I've implemented the application:continueUserActivity:restorationHandler: function and it is set up to do the exact same thing as when didFinishLaunchingWithOptions is called (plus print out a ton of ==== for kicks)

AND YET...

Nothing. After deploying to staging I load up the app on my phone, go through our share functionality to generate a link, save it to notes, and click it only to have it open up in Safari. Long press doesn't do anything, and there's no other indication that Safari is opening instead of the app. Device logs do not seem to indicate any problems, but maybe I'm not searching for the right thing?

Halp.

Ultimately what made it work was adding an application-identifier entitlement with a value similar to the appID from the AASA file; I used a wildcard $() for the suffix, so in theory it'll work across deployment environments. No idea where that is supposed to come from, or what presumptions were being made on the part of Apple's documentation, but...the app opens from links, now!