My problem is caused by having some RDM LUNs sync'd besides the one used by my test VM. It works fine with just the one LUN being replicated.
I'll work on this...
EDIT - yes, I needed a VM in the protection group that had access to all of the LUNs in the consistency group. I was being careful, and tried it with a test VM, which did not work - but it works fine with the "real" VM.
I think I can say that this is working now - for a test failover. Next we have to try a "real" datacenter migration.