Even Dave knew I was going to be in trouble.
Welcome to hell! At the height of the debugging process, I was using the complete TC reader, a multimeter, a 4-channel scope with SPI decoding, and my laptop hooked up to the controller reading out print statements.
The SPI timing diagram for the MAX31856 TC reader I used for this project. Normally, I skip over these when reading a datasheet because it feels almost unnecessary, it's just standard SPI, and the library I'd use to communicate with it inherently handles this level of abstraction. Dear reader, note the explicit de-assertion and re-assertion of the CS line at the end of the command.
Hidden in plain sight on page 15 of the datasheet is the implication that two completely different addresses (commands) cannot be done while CS asserted. Only adjacent, sequential addresses can be accessed.