diff --git a/internal b/internal
index c29fd9df..5739cae0 160000
--- a/internal
+++ b/internal
@@ -1 +1 @@
-Subproject commit c29fd9dfa3d20d2223e1dd3c9606e494d7365aae
+Subproject commit 5739cae0ae4673d32deff2a16649755f9444eb64
diff --git a/src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts b/src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts
index 156a2965..313e1d15 100644
--- a/src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts
+++ b/src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts
@@ -1085,7 +1085,7 @@ export interface CollectorConfiguration {
   windowsUpdateOperationalEventIds: number[];
   /** Master switch for the servicing watcher on the Setup log (Microsoft-Windows-Servicing EventIDs 1/2/3/4/6): the CBS package steps of an OS update — staged, installed, reboot required, failed. Default: true. */
   servicingWatcherEnabled: boolean;
-  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Shadow". */
+  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Active". */
   oobeUpdatePhaseMode: string;
   /** Lookback window in minutes for the Windows Update backfill scan on startup. OOBE quality updates run at the early "Getting updates" screen — often BEFORE the agent starts — but the WindowsUpdateClient/Operational .evtx persists across the mid-OOBE reboot, so a generous backfill catches them. Set higher than the ModernDeployment backfill because the update scan/download can begin well before MDM enrollment. 0 = backfill disabled. Default: 60 minutes. */
   windowsUpdateBackfillLookbackMinutes: number;
diff --git a/src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs b/src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs
index 99d0ed0b..cf735774 100644
--- a/src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs
+++ b/src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs
@@ -519,9 +519,9 @@ namespace AutopilotMonitor.Shared.Models
         /// today's rule still decides.
         /// Active: the phase holds that window while Windows installs an update in OOBE and waits
         /// a bounded time for the sign-in after the update restart instead of failing the session.
-        /// Any other value counts as Shadow. Default: "Shadow".
+        /// Any other value counts as Shadow. Default: "Active".
         /// </summary>
-        public string OobeUpdatePhaseMode { get; set; } = "Shadow";
+        public string OobeUpdatePhaseMode { get; set; } = "Active";
 
         /// <summary>
         /// Lookback window in minutes for the Windows Update backfill scan on startup. OOBE quality
diff --git a/src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts b/src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts
index e32a0047..8c1c8e21 100644
--- a/src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts
+++ b/src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts
@@ -423,7 +423,7 @@ export const SHARED_MANIFEST = {
         41
       ],
       "servicingWatcherEnabled": true,
-      "oobeUpdatePhaseMode": "Shadow",
+      "oobeUpdatePhaseMode": "Active",
       "windowsUpdateBackfillLookbackMinutes": 60,
       "windowsUpdateChannelCensusEnabled": true,
       "mdmRebootPolicyWatcherEnabled": true,
diff --git a/src/Web/autopilot-monitor-web/utils/shared-manifests.json b/src/Web/autopilot-monitor-web/utils/shared-manifests.json
index bb14cd77..7c2de35e 100644
--- a/src/Web/autopilot-monitor-web/utils/shared-manifests.json
+++ b/src/Web/autopilot-monitor-web/utils/shared-manifests.json
@@ -419,7 +419,7 @@
         41
       ],
       "servicingWatcherEnabled": true,
-      "oobeUpdatePhaseMode": "Shadow",
+      "oobeUpdatePhaseMode": "Active",
       "windowsUpdateBackfillLookbackMinutes": 60,
       "windowsUpdateChannelCensusEnabled": true,
       "mdmRebootPolicyWatcherEnabled": true,
@@ -5736,7 +5736,7 @@
             "kind": "primitive",
             "name": "string"
           },
-          "doc": "Mode of the OOBE update phase: \"Off\", \"Shadow\" or \"Active\". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: \"Shadow\"."
+          "doc": "Mode of the OOBE update phase: \"Off\", \"Shadow\" or \"Active\". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: \"Active\"."
         },
         {
           "name": "windowsUpdateBackfillLookbackMinutes",
diff --git a/src/Web/autopilot-monitor-web/utils/wire-types.generated.ts b/src/Web/autopilot-monitor-web/utils/wire-types.generated.ts
index 70c4d619..4bd9b57e 100644
--- a/src/Web/autopilot-monitor-web/utils/wire-types.generated.ts
+++ b/src/Web/autopilot-monitor-web/utils/wire-types.generated.ts
@@ -1085,7 +1085,7 @@ export interface CollectorConfiguration {
   windowsUpdateOperationalEventIds: number[];
   /** Master switch for the servicing watcher on the Setup log (Microsoft-Windows-Servicing EventIDs 1/2/3/4/6): the CBS package steps of an OS update — staged, installed, reboot required, failed. Default: true. */
   servicingWatcherEnabled: boolean;
-  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Shadow". */
+  /** Mode of the OOBE update phase: "Off", "Shadow" or "Active". Off: Windows/.NET update activity is only shown on the timeline. Shadow: the update watchers also feed it into the decision engine, which records the phase and reports at the post-ESP-exit completion window what the phase would decide; today's rule still decides. Active: the phase holds that window while Windows installs an update in OOBE and waits a bounded time for the sign-in after the update restart instead of failing the session. Any other value counts as Shadow. Default: "Active". */
   oobeUpdatePhaseMode: string;
   /** Lookback window in minutes for the Windows Update backfill scan on startup. OOBE quality updates run at the early "Getting updates" screen — often BEFORE the agent starts — but the WindowsUpdateClient/Operational .evtx persists across the mid-OOBE reboot, so a generous backfill catches them. Set higher than the ModernDeployment backfill because the update scan/download can begin well before MDM enrollment. 0 = backfill disabled. Default: 60 minutes. */
   windowsUpdateBackfillLookbackMinutes: number;