Go paho IoT Core mqtt client problems

I wrote a simple IoT Core client to try to push messages using basic ingestion. The client is written in go. It is able to connect OK, but when I try to send a message I get this:

{
    "timestamp": "2022-11-14 21:56:42.078",
    "logLevel": "ERROR",
    "traceId": "22dd3237-1e62-6fde-fd45-d796ca4e4a2b",
    "accountId": "xxxx",
    "status": "Failure",
    "eventType": "Publish-In",
    "protocol": "MQTT",
    "topicName": "$aws/rules/stat",
    "clientId": "washnet-test-1",
    "principalId": "xxxx",
    "sourceIp": "xxx.xxx.xxx.xxx",
    "sourcePort": 47410
}

I'm not sure what this means. The code is publishing using MQTT version 3.1.1 and QOS level 0.

	status := StatusMessage{
		Status: "OK",
	}
	payload, err := json.Marshal(status)
	if err != nil {
		panic(err)
	}
	token := mqttClient.Publish("$aws/rules/stat", byte(0), true, payload)
	token.Wait()

This is with client v1.4.2. The client says:

[DEBUG] [client]   enter Publish
[DEBUG] [client]   sending publish message, topic: $aws/rules/stat
[DEBUG] [net]      obound msg to write 0
[DEBUG] [net]      obound wrote msg, id: 0
[DEBUG] [net]      outgoing waiting for an outbound message
2022/11/14 16:56:42 [OK] Message sent
2022/11/14 16:56:42 Sleeping
[DEBUG] [net]      incoming complete
[DEBUG] [net]      startIncomingComms: got msg on ibound
[DEBUG] [net]      logic waiting for msg on ibound
[DEBUG] [net]      startIncomingComms: ibound complete
[DEBUG] [net]      startIncomingComms goroutine complete
[DEBUG] [net]      outgoing waiting for an outbound message
[ERROR] [client]   Connect comms goroutine - error triggered EOF
[DEBUG] [client]   internalConnLost called

If I don't send a message, the client will happily stay connected all day. I confirmed the client actually connected by looking at the cloudwatch logs:

{
    "timestamp": "2022-11-14 21:56:37.060",
    "logLevel": "INFO",
    "traceId": "04d67121-c8d9-ef69-7995-a21fb9f8ca6f",
    "accountId": "xxxx",
    "status": "Success",
    "eventType": "Connect",
    "protocol": "MQTT",
    "clientId": "xxxx-test-1",
    "principalId": "xxxx",
    "sourceIp": "xxx.xxx.xxx.xxx",
    "sourcePort": 47410
}

so it seems to connect, but not give me any other info than ERROR, Publish-In. I have logging enabled for IOT itself (which is where the above come from) and I also have an error function on the Rule that should also write something if there was an actual failure. Neither the lambda nor the rule log anything.

I thought this was a permission problem, but all my Things have iot:Publish permissions on resource *.

I tried creating a simpler Rule and publishing to that. My simple rule had no lambda, it only published to Cloudwatch. That rule was named 'basic' and so I wrote to $aws/rules/basic but that didn't seem to get triggered, either.

My question is: how do I troubleshoot this?