Serve the OOBE update phase as Active by default (D-324)

The backend default of CollectorConfiguration.OobeUpdatePhaseMode is now Active. While Windows
installs its OOBE quality update, the decision engine holds the post-ESP completion window (at most
3 h) and then waits 60 min for the sign-in; a session nobody signs in to ends as awaiting the user
or incomplete instead of failed. Agents still count a missing or unknown value as Shadow. Shared
manifest and generated wire types regenerated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts

@@ -1085,7 +1085,7 @@ export interface CollectorConfiguration {
   windowsUpdateOperationalEventIds: number[];
   /** Master switch for the servicing watcher on the Setup log (Microsoft-Windows-Servicing EventIDs 1/2/3/4/6): the CBS package steps of an OS update — staged, installed, reboot required, failed. Default: true. */
   servicingWatcherEnabled: boolean;
-  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Shadow". */
+  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Active". */
   oobeUpdatePhaseMode: string;
   /** Lookback window in minutes for the Windows Update backfill scan on startup. OOBE quality updates run at the early "Getting updates" screen — often BEFORE the agent starts — but the WindowsUpdateClient/Operational .evtx persists across the mid-OOBE reboot, so a generous backfill catches them. Set higher than the ModernDeployment backfill because the update scan/download can begin well before MDM enrollment. 0 = backfill disabled. Default: 60 minutes. */
   windowsUpdateBackfillLookbackMinutes: number;

src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs

@@ -519,9 +519,9 @@ namespace AutopilotMonitor.Shared.Models
         /// today's rule still decides.
         /// Active: the phase holds that window while Windows installs an update in OOBE and waits
         /// a bounded time for the sign-in after the update restart instead of failing the session.
-        /// Any other value counts as Shadow. Default: "Shadow".
+        /// Any other value counts as Shadow. Default: "Active".
         /// </summary>
-        public string OobeUpdatePhaseMode { get; set; } = "Shadow";
+        public string OobeUpdatePhaseMode { get; set; } = "Active";
 
         /// <summary>
         /// Lookback window in minutes for the Windows Update backfill scan on startup. OOBE quality

src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts

@@ -423,7 +423,7 @@ export const SHARED_MANIFEST = {
         41
       ],
       "servicingWatcherEnabled": true,
-      "oobeUpdatePhaseMode": "Shadow",
+      "oobeUpdatePhaseMode": "Active",
       "windowsUpdateBackfillLookbackMinutes": 60,
       "windowsUpdateChannelCensusEnabled": true,
       "mdmRebootPolicyWatcherEnabled": true,

src/Web/autopilot-monitor-web/utils/shared-manifests.json

@@ -419,7 +419,7 @@
         41
       ],
       "servicingWatcherEnabled": true,
-      "oobeUpdatePhaseMode": "Shadow",
+      "oobeUpdatePhaseMode": "Active",
       "windowsUpdateBackfillLookbackMinutes": 60,
       "windowsUpdateChannelCensusEnabled": true,
       "mdmRebootPolicyWatcherEnabled": true,
@@ -5736,7 +5736,7 @@
             "kind": "primitive",
             "name": "string"
           },
-          "doc": "Mode of the OOBE update phase: \"Off\", \"Shadow\" or \"Active\". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: \"Shadow\"."
+          "doc": "Mode of the OOBE update phase: \"Off\", \"Shadow\" or \"Active\". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: \"Active\"."
         },
         {
           "name": "windowsUpdateBackfillLookbackMinutes",

src/Web/autopilot-monitor-web/utils/wire-types.generated.ts

@@ -1085,7 +1085,7 @@ export interface CollectorConfiguration {
   windowsUpdateOperationalEventIds: number[];
   /** Master switch for the servicing watcher on the Setup log (Microsoft-Windows-Servicing EventIDs 1/2/3/4/6): the CBS package steps of an OS update — staged, installed, reboot required, failed. Default: true. */
   servicingWatcherEnabled: boolean;
-  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Shadow". */
+  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Active". */
   oobeUpdatePhaseMode: string;
   /** Lookback window in minutes for the Windows Update backfill scan on startup. OOBE quality updates run at the early "Getting updates" screen — often BEFORE the agent starts — but the WindowsUpdateClient/Operational .evtx persists across the mid-OOBE reboot, so a generous backfill catches them. Set higher than the ModernDeployment backfill because the update scan/download can begin well before MDM enrollment. 0 = backfill disabled. Default: 60 minutes. */
   windowsUpdateBackfillLookbackMinutes: number;