The solution, for me anyway, is not to generate unique values in the Portal but go back to my tried and tested method of doing it as part of classic rules extensions with a lookup against the Metaverse and AD. This was supposed to be an all Declarative design, but if the result is a risk of deadlocking then the provisioning Sync Rule, at least, has had to go.