I tried that again just now: I wrapped the whole caboodle of initing and publishing inside [self.runLoop performBlock:^{ … }];, and scheduled the advertising service onto [NSRunLoop currentRunLoop] to drive home the point. Unfortunately the behaviour is identical to my original message. :( didPublish yes, didAccept no.

For 340 bytes, yes unfortunately. There are lots of ways to approach it. One I've used successfully in the past is to have sentinel "message start" and "message end" values with anything sent in the middle being the payload. You could include a checksum, or rely on write with response to have stronger assurances that each chunk was sent (at the cost of higher latency). The peripheral can keep a simple state machine per UUID of each central that is writing, which forwards the request for handling when it it gets the "message end". This style has a benefit of working for any characteristic write size, which you only learn at runtime.