Hello Kem
Many thanks for this suggestion. The only troubleshooting I have carried out so far is to run dism /online /cleanup-image /scanhealth and sfc /verifyonly. Both come up clean, and dism reports image version 10.0.16299.214 i.e. the correct updated version despite the "requires reboot" notification. I will likely try a repair upgrade if the next CU also "fails" but am not keen to mess with a reasonably stable system before I have to, also as I understand it the repair upgrade will lose all non-store applications, which is inconvenient. I notice that Control Panel/Programs and Features/Installed Updates shows KB4058258 as installed, along with the "hidden" KB4074608 which does not show in settings installed update history. I see that KB4058258 makes "stability improvements for the Windows 10 Version 1709 servicing stack" and I wonder whether this may have a bearing on the issue with KB4058258.
Best wishes...