What'd I say? What did I say?
Turns out I was clearing CY when I was clearing OV, S and Z at the start of the handler for ADD/ADC/ADDI/ADCI and SUB/SBC/SUBI/SBCI.
Man, I positively suck at bug hunting. I was even looking for exactly
that kind of bug. I saw the r = sreg part and totally ignored the clear carry right below it. Glad you figured it out, at least!