Site-to-site VPN comes up but traffic still needs NAT exemption for the internal subnet

IKE and tunnel status look healthy, but packets still do not pass because the interesting traffic is translated before it can match the VPN policy.