David, thank you very kindly - the recipe now seems to work as I expected it to do.
Do you have any comment on the overall premise? Am I doing the right thing to just drop non-subscriber mail on the floor? (After I watch that reject.nosub file for a while, I plan to change it to /dev/null if it looks like nothing useful is getting filed there...)