Finally... I'd been restarting Windows rather than cold booting, but I thought it was worth trying. As soon as I shut down, up came a message saying it was installing 11 updates. Why these weren't being applied before when I restarted, I've no idea.
Booted the PC and checked Windows Update. Two updates: one important and one optional. Selected them both. They were downloaded but failed to install. Message code was 8024402C. Tried again with the same result. Left it for a couple of hours in case it was a Microsoft server error (sometimes happens), then tried once more. This time it all went smoothly.
Why Microsoft couldn't identify the incomplete installs as the initial problem, and why the installs weren't completed during a restart, remains a mystery. However, all is good again.