The domain was paid, the registrar took the money, but .io didn't renew it, because they need the renewal notice at least 3 days prior to expiry.
It was a registrar screw up, but my main take away is: avoid .io like plague.
See also: https://hackernoon.com/stop-using-io-domain-names-for-produc...