Asymmetric routing keeps stateful firewall sessions failing after one return path changed quietly

Forward traffic reaches the service, but responses traverse another path and hit a stateful filter that never saw the original session setup.