I followed the advice of trying the upcoming build and see, and indeed upgrading from 1803 to 1809 the issue seems fixed. I've been for 8 months on the workaround of "enter recovery, select 7", disabling driver sign. check.
(Following the major upgrade I am left with another annnoying bug, but I'm opening a new question about it.)