Also, if I'm reading it correctly then each plaintext message from a particular client ends up at the same location within an epoch, due to the one-time shuffle

Also, if I'm reading it correctly then each plaintext message from a particular client ends up at the same location within an epoch, due to the one-time shuffle at the beginning of each epoch. That might be able to reveal information about a client's activity within the epoch. I also wonder if the presence of distinguishably-mandatory plaintext messages could be used within an epoch, particularly with respect to the previous point. E.g. maybe knowing the the same client was active in rounds 1 & 2, the inactive in round 3, then active in round 4, then inactive in rounds 5 & 6, then active in rounds 7 & 8 could be used to identify the client (imagine a low-latency system, and keystroke timings or voice packet lengths).