I'm going to answer myself although I'm open to more suggestions on a proper fix.
My laptop is dual-boot Linux and Windows - Linux being my OS of choice but since I got the laptop with a Win10 license I'm keeping it too. Each OS has its own dedicated partition, Linux detects the Windows one and setups GRUB with dual boot options (always boots last pick). The MBR is standard with the only change being after the Windows install I set the Linux partition back to Active so GRUB can present the choices.
For a long time I've had this issue that after the initial install, the next Cumulative Update would fail. I've tried reinstalling fresh, stuck to Windows Updates drivers only, etc. Eventually the next Cumulative Update would get shipped and laptop would fail to update again. I looked at all troubleshooting option, skimmed through the WU logs, tried all possible fixes out there (rebuilding WU catalog, etc.) but nothing worked.
The symptoms were WU reporting an error during the update phase following the first reboot and rebooting again to undo the update. The latest reported error codes in the updates history were 0x800f0922 and 0x80070643 (I could get alternatively either one for the same update - the last failed ones were 2018-11, 2019-01 and 2019-02).
As it turns out all I had to do was make Windows partition active again before reboot and the update went through. Besides pointing out how ridiculous this is, I'm wondering if there could be ways to avoid this, ex add hooks to set active partition before reboot following a WU install and back afterward, or verified Windows bootloader configuration that would provide similar behavior (allow selecting OS at boot and making last choice the default). I would also hope someone from MS sees this and either fix it or at least improve error reporting do ppl don't spend months/years figuring it out.