Up front, read Winlogon\Shell; if it isn't already cmd.exe, set it and do a clean reboot before running the toolchain — so the shell is genuinely cmd (not a killed-explorer half-state) for the whole servicing run. Idempotent: when the shell is already cmd (re-runs), skip the reboot. Replaces the earlier kill-explorer approach.