OK, finally had time to examine unit #1 more closely. Swapping the input divider AND the U9 ROM with the working unit made no difference. This meant it had to be either the range switches or the U8 DVM chip. The range switches are working, as changing range manually causes the DP to move to the expected location. So I put the scope on pins 28-30 of U8 and... nothing on pin 30, ever. This explains why the unit is trying to autorange but failing to select the correct divider values; pins 28-30 select one of 8 outputs from the ROM, which turns on the appropriate divider relays. Moving the scope to the working unit #2 shows correct logic levels on pins 28-30 as the range is selected manually, and they cycle in autorange.
I thought it was really unlikely that only one of the range selector signals was bad, especially since closer examination showed a signal with no noise or activity at all; a bad output should either float or be susceptible to some glitching when other signals were active. On a hunch, I pulled the U9 ROM and U8 from their sockets and measured pins 28, 29 and 30 to ground. 28 and 29 measured about 10MΩ; pin 30 was about 1Ω.
Grabbed the magnifying glass and followed the trace around the board. It went through the board a couple of times, which slowed me down as I flipped the board over to find it again. Then, over near the power supply, was a tiny whisker of solder bridging the signal line and the adjacent ground trace. It was so delicate that just heating it caused it to retract into the blob where it came from. Signal trace now measured 10MΩ!
Replaced U8 and U9, and powered it up.
Ohms and DCV looked pretty good immediately. I will now replace the AC converter (have to pull it to get to U9) and clean up some of the flux still lingering on the board , then run a full sanity check on the meter. This makes me happy, because of the two, this one is in better cosmetic condition and zeroes with a shorted input; which gives me some confidence that the input buffer FETs are not leaky.