Apparently this has been broken since like March... It seems communication over port 8448 is required for server-to-server comms, even if the client doesn't use it.
https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
This makes future composition possible