[otrs] Can't change queue of some tickets

We have weird behavior since upgrading from 2.4.7 to 3.2.6. Some tickets (probably all tickets logged via the Customer portal - that is definitely one condition) cannot be moved to any other queues, even by agents. We do have an ACL on the CustomerTicketMessage and CustomerTicketZoom actions to limit possible queues to our Helpdesk queue. What's not working now is that even agents can't move those tickets to another queue. And even if I comment out that ACL entirely, stop Apache, & clean out the var/tmp cache directories, the situation persists (customers can only log to "Helpdesk" and agents cannot move tickets). We're probably missing something simple here, but don't know where to look. Any advice on where to start? Thanks, Geoff