Hey There!
Sounds like you're doing a lot of things by-the-books and "right" "on paper" but it's really tough to know if you're on the right track for sure without seeing the site or an example of some of the links being build, or content, etc.
I say this because "40 links a month" for example sounds like a nice number, but also sounds suspect because that's a pretty sizable amount of links, which makes me wonder about the quality of them.
What I'd be curious about is - what are the things outside of SEO or SEO tactics/fixes have been done? I'm thinking in regards to social, audience building, brand building, design upgrades, content, adding value etc? Also, what type of site is this and how big is it?
The other thing that's tough to know is how well the technical things were implemented. For example, switching to https among other things can create a lot of redirect chains. I would try to undo redirect chains and only do page->page redirects (instead of having chains of page->page->page->page etc).
And right, it's tough to know if your disavow is helping or hurting without knowing a lot of the specifics.
If it was me, I'd make sure you're focusing enough on others things besides just directly on SEO. That doesn't mean you'd ignore SEO when doing social, content, audience building etc - just that you're taking a more holistic view. I think Google definitely favors recovering sites that prove they are building something people want.