Thanks for the suggestion mnbp.
Happy resolution: I used CBP's "Contact Us" on their website and got a response a few days later (they promised 15 day turnaround, so that was pleasant.)
"I have reviewed your Trusted Traveler account and repaired any and all account issues/discrepancies (if any). Your account should be fully active without any issues."
And sure enough, returning to the same terminal today (JFK T7), and using the same kiosk, I had no problem.