I just bought a Telonic RHO-TECTOR TRB-50 return loss bridge off eBay.
It's suitable for swept antenna measurements of 0.5Mhz to 1GHz.
Amazingly, it functions. However, I'm curious as to exactly how it
works and what's inside. Duz anyone have a theory of operation,
schematic, or other useful clues?

The best I have so far is:
http://www.qsl.net/n9zia/rlb/texscan.png
which may be the schematic, but I can't tell without tearing it apart
(which with my luck, will probably destroy it). Using my
ohms-guesser, it seems correct.