Thanks Roger,
That helped a lot. The big piece I was missing was that hiddenservices are on v3 now (clearly I've not been paying attention here).
And I misunderstood HSDirs thinking they were in the data path not just the look up so could collude on traffic timing. I guess lookups are part of that signal but this is more analogus to DNS leaks or poisoning than it is to a malicious exit that manages to capture all traffic (or predictable fraction) to a particular destination.
Thanks, -Jon