Here's a final follow-up
First - thanks for the tip about running the SQL in the portal window - I've never had occassion to use it, but I will now.
The pain continued for me (seemingly random errors, slow response too), so I got a bit more drastic. I did a parallel fresh install of DNN 4.3.1, then scripted out all of the SPs, since I figured my problems were in there somewhere. I ran the script in my original install and things got a lot better. No errors yet and it feels faster.
I still couldn't log in with admin accounts on some portals though, but I realized they were the portals created when the application name was changed (see above). I verified this idea by looking at the aspnet tables, but I fixed it by creating new admin users instead of manually trying to change the application GUID for the users - that seemed like a dangerous thing to me!
I then deleted the old users through the portals, which caused an error because the user and app name combination didn't exist in the aspnet tables. There are a few remnant users in there now, but I don't think it matters - they can't be deleted manually anyway.
I can now login with all my accounts and create child portals