A ‘git bisect’ traced the problem to the proposal 171 changes, and then to [commit e8b9815711e7cd1ef0b83153aefcc0d05e817f4e](https://gitweb.torproject.org/tor.git/commitdiff/e8b9815711e7cd1ef0b83153aefcc0d05e817f4e). This commit causes `circuit_has_opened` to send two ESTABLISH_RENDEZVOUS cells on each rendezvous circuit, because `connection_ap_attach_pending` can never attach a stream to a `CIRCUIT_PURPOSE_C_ESTABLISH_REND` circuit. ‘wanoskarnet’ says that hidden service client support seemed to still be working in non-tor2web-mode versions of 0.2.3.x because they cannibalized pre-built three-hop circuits, and `circuit_has_opened` is never called for those. This is also the cause of legacy/trac#4171 (wanoskarnet diagnosed this, too).