[Android Software Development] the oob:
I had a bit more luck by uninstalling LMT and then restoring the APP + Data backup with Titanium Backup.

Here's the log when it works, which includes me allowing draw-over permission and root access:

05-12 14:53:49.793 D/LMT::LMT(20238): Starting GUI
05-12 14:53:50.042 D/LMT::PermissionChecker(20238): hasExternalStorageReadPermission(false)
05-12 14:53:50.064 D/LMT::PermissionChecker(20238): hasExternalStorageReadPermission(false)
05-12 14:53:50.067 D/LMT::PermissionChecker(20238): hasDrawOverAppsPermission(false)
05-12 14:53:53.485 D/LMT::InputContext(20307): InputContext started
05-12 14:54:08.199 D/LMT::PermissionChecker(20238): hasDrawOverAppsPermission(true)
05-12 14:54:10.811 D/LMT::TouchService(20238): TouchService created
05-12 14:54:10.812 D/LMT::TouchService(20238): App version v2.8
05-12 14:54:10.816 D/LMT::TouchServiceNative(20238): Lib version v2.8
05-12 14:54:10.816 D/LMT::TouchServiceNative(20238): Set input device
05-12 14:54:10.818 D/LMT::InputContext(20307): InputContext version v2.8
05-12 14:54:10.823 D/LMT::TouchServiceNative(20238): Opened input device
05-12 14:54:10.823 D/LMT::TouchServiceNative(20238): Single touch gestures enabled: 1
05-12 14:54:10.823 D/LMT::TouchServiceNative(20238): Single swipes BBox: 1
05-12 14:54:10.824 D/LMT::TouchServiceNative(20238): Min score: 70
05-12 14:54:10.824 D/LMT::TouchServiceNative(20238): Min path length: 7
05-12 14:54:10.824 D/LMT::TouchServiceNative(20238): Orientation: 0, 1440, 2559
05-12 14:54:10.876 D/LMT::TouchService(20238): Resource path /storage/emulated/0/Android/data/com.noname81.lmt/files/
05-12 14:54:10.877 D/LMT::TouchService(20238): Resource path is available containing 9 file(s)
05-12 14:54:10.901 D/LMT::TouchService(20238): TouchService started
05-12 14:54:20.259 D/LMT::Launcher(20238): Fire action type: App, string: com.onelouder.baconreader.premium

Here's the log from before where it wasn't working:

05-12 13:00:30.481 D/LMT::Launcher(9122): Fire action type: App, string: com.onelouder.baconreader.premium
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.RootContext.initRemoteStreams(Roo tContext.java:142)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.RootContext.initRemote(RootContex t.java:98)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.RootContext.runCommandRemote(Root Context.java:239)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.Launcher.doActivityAction(Launche r.java:431)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.Launcher.doAppAction(Launcher.jav a:394)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.Launcher.fireAction(Launcher.java :78)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.PieControl.onClick(PieControl.jav a:155)
05-12 13:00:30.482 W/System.err(9122): at com.noname81.lmt.PieMenu.fireClick(PieMenu.java:46 2)
05-12 13:00:30.483 W/System.err(9122): at com.noname81.lmt.PieMenu.onTouchEvent(PieMenu.java :652)
05-12 13:00:30.483 W/System.err(9122): at com.noname81.lmt.PieContainer$PieLayout.dispatchTo uchEvent(PieContainer.java:71)
05-12 13:00:30.484 E/LMT::RootContext(9122): Failed to write remote command!

You can see that the last line of the 'working' log is the same as the first line of the 'not working' log. So it seems LMT isn't logging anything extra when it works, just the 'Fire action type' line.