From c4aeaaaa17efc0634f2e81f554af2a8829633f1e Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Thu, 6 Aug 2026 15:38:42 -0400
Subject: [PATCH] Collector: exclude the 8 GB package, fix base-URL detection,
 note the AESFMA dependency

Three defects found by the first real run, on 579C144.

16 GB collection, zip failed. run-enrollment harvests
C:\ProgramData\Microsoft\Provisioning into C:\Logs\PPKG, so the 8 GB
provisioning package existed TWICE under the trees being copied. Compress-Archive
cannot exceed 2 GB and died with "stream was too long". Copies now exclude
*.ppkg, *.wim and *.iso and cap individual files at 100 MB.

Base-URL detection matched the wrong value. The name pattern accepted anything
containing "base", so it picked up baseVersion=2.0.2 from
HKLM:\SOFTWARE\GE\SFLD\Credentials and then probed "2.0.2/api/docs" - making
both UNREACHABLE lines meaningless. Now matches the name exactly and requires the
value to start with http.

Unreachable was reported as a bare failure. ShopDB is only reachable once the bay
has joined the AESFMA wifi SSID, so on the imaging LAN or plain wired an
unreachable result is EXPECTED. It now says so, rather than looking like a fault.

The run still answered the question it was written for: no enforce client is
installed and nothing is scheduled to call the API, so this bay was never going
to reach GE-Enforce regardless of network.
---
 .../Collect-ImagingDiagnostics.ps1              | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1 b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
index 536d145..a11c3ee 100644
--- a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
+++ b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
@@ -60,10 +60,15 @@ function Section { param([string]$File, [scriptblock]$Body)
 }
 
 function CopyTree { param([string]$Src, [string]$Dst)
+    # /XF *.ppkg and /MAX are not optional. run-enrollment harvests
+    # C:\ProgramData\Microsoft\Provisioning into C:\Logs\PPKG, so the 8 GB
+    # provisioning package exists TWICE under the trees we copy. Without these
+    # the collection is 16 GB and Compress-Archive dies with "stream was too
+    # long" - it cannot exceed 2 GB.
     if (Test-Path $Src) {
         $d = Join-Path $work $Dst
         New-Item -ItemType Directory -Path $d -Force | Out-Null
-        robocopy $Src $d /E /R:0 /W:0 /NFL /NDL /NJH /NJS | Out-Null
+        robocopy $Src $d /E /R:0 /W:0 /NFL /NDL /NJH /NJS /XF *.ppkg *.wim *.iso /MAX:104857600 | Out-Null
         Write-Host ("  {0}\  <- {1}" -f $Dst, $Src)
     }
 }
@@ -285,7 +290,13 @@ Section 'geenforce-api.txt' {
         if (Test-Path $k) {
             $p = Get-ItemProperty $k
             foreach ($n in $p.PSObject.Properties.Name) {
-                if ($n -match '(?i)url|base|endpoint') { "$k\$n = $($p.$n)"; if (-not $base) { $base = $p.$n } }
+                # Match the NAME tightly and validate the VALUE looks like a URL.
+                # A loose "base" match picked up baseVersion=2.0.2 and the probe
+                # then tried to fetch "2.0.2/api/docs".
+                if ($n -match '(?i)^(baseurl|serverurl|shopdburl|endpoint|url)$') {
+                    "$k\$n = $($p.$n)"
+                    if (-not $base -and "$($p.$n)" -match '^https?://') { $base = $p.$n }
+                }
             }
         }
     }
@@ -309,6 +320,8 @@ Section 'geenforce-api.txt' {
                 "{0,-22} HTTP {1}  <- REACHABLE (service answered; 401/403 just means no token was sent)" -f $t.Name, $code
             } else {
                 "{0,-22} UNREACHABLE: {1}" -f $t.Name, $_.Exception.Message
+                '   NOTE: ShopDB is only reachable once the bay has joined the AESFMA wifi SSID.'
+                '   On the imaging LAN or plain wired, unreachable here is EXPECTED, not a fault.' 
             }
         }
     }