So I've now established that the CRX fixes were not properly applied (the repository was not in the default location). Things are now making a lot more sense. I'm much more comfortable about CRX corruption on an unpached 2.2 crx (which I remember having numerous issues when it was released).
I'm still interested in any good CRX on Windows battle stories though...
1) Yes. Make sure that CRX Hotfix is installed correctly. For that you can go to CRX HOST:PORT/crx and check the version number on header. It should show something like 220.127.116.11
2) In some cases the consistency checker is able to resolve the issues
I doubt consistency check will resolve file not found issue. Please see http://www.wemblog.com/2011/11/how-to-fix-file-not-found-issue-in-crx.html if that helps.
Thanks Yogesh, yeah that's exactly how I realised that they'd botched the installation of the fixes!
They did try the consistency checker before getting me involved, but the damage was too severe (effectively a huge chunk of the repository had gone).
I guess the missing TAR file (or erroneous index entries) are a bug in the PM's logic to remove data TAR files which are no longer referenced in the indexes. I vaguely remember CQ 54 / CRX 2.2 having a few issues of this type, but I'd never seen anybody leave it unpatched long enough to allow these kinds of problems to occur...