Well that weekend came and went. I now have a TinySA Ultra, which I'm very pleased with.
I decided to try using a freezer spray on the vector output board while in operation. I tried freezing the mixer chip and no change (still a small 2.7GHz peak). I tried freezing U80 (the RF amp after it) and the peak disappeared. Interesting. So I tried measuring at the mixer output and found the 4GHz signal I expected. The 2.7GHz signal was also there, but I think it was just coupled from somewhere else.
I removed the baluns between the mixer and U80 and tested them. They are fine, at least at DC. No damage visible under magnification.
I then tried measuring the input to U80 (disconnected from U80 -- straight into the spectrum analyser). What do you know, the signal I wanted! Also, U80's output is 6 Ohms to ground. That seems pretty suspicious, there aren't any external DC bias components on that pin.
So I suspect U80 (which is the same part that caused the problem in the Signal Path video, although not sure if it is the same device inside the Agilent package). I think I can try bypassing it with some coax, it will be a bit of a nasty job but should prove the principle.
Fingers crossed for this. There have been a lot of red herrings on this repair, some definitely because of dodgy coax connections. Others because of that 2.7GHz signal coupling everywhere. It's all a learning experience...
Edit: it seems unlikely that U80 is the same MSA-0686 as on the board revision shown in the TSP video. The IC on my board has +9V and -5.3V power inputs, the MSA-0686 has a single-ended power input.