Clean BIN, matching AVS, fresh IP — still getting hard declines. What am I missing?

[Oliver]

Posted a run this week. Everything lined up: BIN matches the cardholder region, AVS was an exact match on street + zip, used a residential IP in the same city, and the drop was aged 3+ weeks with prior activity on it. Merchant was a mid-tier retail site with a working checker.
Result: hard decline, no soft decline, no OTP challenge. Just dead.
I've already ruled out the obvious stuff — card wasn't live-checked to death, IP wasn't a datacenter, drop wasn't burned. So what else is at play here that intermediates keep missing? I'm talking the non-obvious variables: issuer-side velocity on the BIN itself, MCC mismatch, fraud scoring that triggers off your session behavior rather than the card data, etc.
If you've broken past this stage, drop what actually changed the outcome for you. Not theory — what variable did you fix.