That didn't sort it but thanks for the input.
For any other casual readers, i did get to the bottom of it and it was SQL permissions missing from the default roles needed to access the new tables in support of the changes to dynamic port functionality. I believe this is resolved in a CU1 although I had the DBA make the permission changes before I found this official fix.
support.microsoft.com/…/2838133
I'm doing some testing on a new sandbox this week, and will come back and confirm if the cu1 also sorts out the permissions.
the differences in behavior I experienced were to do with elevated permissions remaining on my SQL access in the UAT. That confused matters, but once that was understood it was fairly straightforward to find the problems.