Found it at last.
The LM324 is responsible for buffering the voltage reference from the main AD588 reference for the input voltage on the hold ICs. The hold ICs are expecting 0.5v as the reference voltage but the LM324 has blown up and the output is being pulled down. This is saturating the transistor which is holding it at -1.2v.
The only reason channel 1 and 3 works are because they are exceptionally high gain amplifiers in the control loop on that side of things which are saturating providing offset. No sign of anything nasty around the LM324 so will just swap it out and see what happens. There's a tant across the output I will test however as if that thing goes short it will sink 54mA constantly through the opamp which will eventually blow its arse out.
This is working off an HP54600A schematic but it traces out the same:
There are a couple of 100nF ceramic decoupling caps as well on the 0.5v rail so will check that too.