access denied to selected files in a stream. how to debug?

after our migration this last weekend, one user cannot access all the files in a stream.
two files in one folder in one component.  the migration was from 3.0.1 to 4.0.4

I can see them all and open them without trouble.

the stream is owned by the project,
and the components are also owned by the project
the files in the component show project and team owernship. and the user is a member of the team with source access rights (Team Member, out of the box configuration).

I have set the permission to component, and back to project/team. with no change.

the two files are way down the component file tree.

in 4.0.4, one file shows but reports does not exist when open is attempted,
the other file does not appear
using  3.0.1 he gets access denied. (and 4.03  ont he web ui)..

the upgrade was indirect. 3.0.1 to a middle box, streams and workspaces were duplicated/copied
the middle box was upgraded to 4.0.4 and then the streams and workspaces were duplicated/copied
to the production machine.

there were difficulties copying the streams 4.0.4 to 4.0.4 with both the api and the eclispe ui.
they reported the copy failed, but the stream was in fact present and appears to be accurate for everyone
we created a new workspace from it, and compared to the last workspace used by build on friday afternoon,
and the workspaces compare ok.

any suggestions on how to debug this?