by Steve Nisbet.
Hi folks
answering my own problem - solution turned out to be a nefarious setting in TMG which (curiously by default) neglects to send the original HOST header with the request it redirects internally to our server - effectively leaving Moodle wondering just which host it was actually serving. All sorted by turning this feature on.
thanks all