diff --git a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1 b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
index 536d145..a11c3ee 100644
--- a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
+++ b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
@@ -60,10 +60,15 @@ function Section { param([string]$File, [scriptblock]$Body)
 }
 
 function CopyTree { param([string]$Src, [string]$Dst)
+    # /XF *.ppkg and /MAX are not optional. run-enrollment harvests
+    # C:\ProgramData\Microsoft\Provisioning into C:\Logs\PPKG, so the 8 GB
+    # provisioning package exists TWICE under the trees we copy. Without these
+    # the collection is 16 GB and Compress-Archive dies with "stream was too
+    # long" - it cannot exceed 2 GB.
     if (Test-Path $Src) {
         $d = Join-Path $work $Dst
         New-Item -ItemType Directory -Path $d -Force | Out-Null
-        robocopy $Src $d /E /R:0 /W:0 /NFL /NDL /NJH /NJS | Out-Null
+        robocopy $Src $d /E /R:0 /W:0 /NFL /NDL /NJH /NJS /XF *.ppkg *.wim *.iso /MAX:104857600 | Out-Null
         Write-Host ("  {0}\  <- {1}" -f $Dst, $Src)
     }
 }
@@ -285,7 +290,13 @@ Section 'geenforce-api.txt' {
         if (Test-Path $k) {
             $p = Get-ItemProperty $k
             foreach ($n in $p.PSObject.Properties.Name) {
-                if ($n -match '(?i)url|base|endpoint') { "$k\$n = $($p.$n)"; if (-not $base) { $base = $p.$n } }
+                # Match the NAME tightly and validate the VALUE looks like a URL.
+                # A loose "base" match picked up baseVersion=2.0.2 and the probe
+                # then tried to fetch "2.0.2/api/docs".
+                if ($n -match '(?i)^(baseurl|serverurl|shopdburl|endpoint|url)$') {
+                    "$k\$n = $($p.$n)"
+                    if (-not $base -and "$($p.$n)" -match '^https?://') { $base = $p.$n }
+                }
             }
         }
     }
@@ -309,6 +320,8 @@ Section 'geenforce-api.txt' {
                 "{0,-22} HTTP {1}  <- REACHABLE (service answered; 401/403 just means no token was sent)" -f $t.Name, $code
             } else {
                 "{0,-22} UNREACHABLE: {1}" -f $t.Name, $_.Exception.Message
+                '   NOTE: ShopDB is only reachable once the bay has joined the AESFMA wifi SSID.'
+                '   On the imaging LAN or plain wired, unreachable here is EXPECTED, not a fault.' 
             }
         }
     }