Collect what bays actually have, separately from what they are told to have

ShopDB knew what a bay SHOULD have and nothing about what it DOES. Adding the
observed half makes a rollout a review instead of a typing exercise: the floor
reports itself in, you look, and you adopt.

The collection uses the mechanism that already exists rather than a new one.
POST /api/collector/printers dispatches to the printers plugin's
apply_collector_payload, the same ADR-006 hook the computers and backups plugins
implement. New client script, new plugin-owned table, no new transport and no new
credential.

OBSERVED AND ASSIGNED STAY APART, and that is the point rather than a detail. A
collector report can never write an assignment row: _reconcile_edges is the only
function that writes usesprinter/defaultprinter, it has two call sites, and both
are authenticated routes a human calls. If a drifted bay's own state were allowed
to become what it is told to install, every configuration error would become
permanent the next time that PC checked in.

Seeding an assignment from observed state is explicit -
POST /assignments/seed-from-observed - because a rollout adopts many machines at
once. It routes through the same _reconcile_edges as the editor, so there is one
write path with two doors, and a queue matching no known printer is REFUSED
rather than guessed into an assignment. That last rule is the lesson from the
measuring tools: adopting on a weak key produced 43 duplicate instruments.

Two fixes on top of what the agents built. The replace deleted a host's previous
rows by exact case-folded name while the read path treats a short name and its
FQDN as one machine, so a PC that changed spelling appeared to hold every queue
twice - which reads as drift that is not there. And the client sent 'reportedat'
where the declared schema said 'observedat'.

Also here: the legacy loader now imports machines.printerid, the classic system's
record of each machine's default printer, which it silently dropped - the
production import would have lost every one. And Set-ShopdbPrinters.ps1 finally
registers the per-user logon task, staging Apply-ShopdbDefaultPrinter.ps1 to
C:\ProgramData first because the share it lives on is mounted only during the
enforcement cycle and the task runs at logon when it is gone.

VALIDATED ON WINDOWS 11 (build 26200), not just on Linux pwsh, which parses these
scripts happily and executes none of the spooler branches.

The reporter: posts a correct payload with the X-API-Key header; resolves BaseUrl
and CollectorKey from HKLM when given no arguments; suppresses the virtual queues
by port; resolves port addresses; and reads the CONSOLE USER's default out of
HKU rather than SYSTEM's own, which is a different and usually wrong answer.

Two results matter more than the rest. With the spooler stopped, both the cmdlet
and the CIM path fail and the script posts NOTHING - verified against a capture
server that recorded zero requests, where an empty list would instead have
erased that host's observed rows and read as a bay that lost its printers. A
genuinely empty host still posts [], because that is a real and different fact.

The logon task registers as the Users group at Limited, and falls back to the
well-known SID S-1-5-32-545 when the group name will not resolve, as it will not
on localised Windows. It was then run with the source directory RENAMED AWAY, to
stand in for the share being unmounted, and it still moved the user's default -
which is the whole reason the script is staged to C:\ProgramData rather than run
from where it lives.

The guarantees against damage were re-checked rather than assumed: an empty
assignment changes nothing, an unreachable server changes nothing, -WhatIfOnly
leaves no queue, no task, no staged file and no registry value behind, and a
drifted queue is repointed IN PLACE with Set-Printer so whoever has it as their
default keeps it.

Not covered by any of this: the driver-staging path, which needs a real vendor
package rather than the class drivers a VM ships with.

scripts/site_imports/wjf/run.py

@@ -51,6 +51,19 @@ def _upsert(h, path, payload, unique_field, idfield, list_path=None):
     return None
 
 
+def _put(h, path, payload):
+    """PUT through the harness client. The harness wraps post/get only, so the
+    reconcile-style assignment route goes direct with the same import-mode
+    headers. Returns (status, data)."""
+    headers = {'Authorization': f'Bearer {h.secret}', 'X-Import-Mode': 'true'}
+    resp = h.client.put(path, json=payload, headers=headers)
+    body = resp.get_json() or {}
+    data = body.get('data', body)
+    if resp.status_code >= 400:
+        h.errors.append((path, resp.status_code, payload, data))
+    return resp.status_code, data
+
+
 # --- classic machinetype routing (per the resolved import decisions) ---------
 # measuringtools are the physical instruments (the CMM/gauge machine types). A
 # PC that DRIVES one (pctype CMM/Genspect/Keyence/Wax) is still a computer, not a
@@ -350,10 +363,25 @@ def stage_printers(h):
             'modelnumberid': h.ids.get('model', p['modelid']),
             'locationid': h.ids.get('location', p['machineid']),
         }
-        status, _ = h.post('/api/printers', payload)
+        status, data = h.post('/api/printers', payload)
+        assetid = None
         if status in (200, 201):
+            assetid = _id_of(data, 'assetid')
             made += 1
-    return {'printers': made}
+        elif status == 409:
+            # Re-run: PRN-<printerid> is already an asset. Resolve it anyway -
+            # without this branch a resumed run crosswalks nothing and the
+            # defaultprinters stage silently links nothing.
+            _, rows = h.get(f"/api/printers?assetnumber={payload['assetnumber']}&per_page=5")
+            items = rows.get('items', rows) if isinstance(rows, dict) else rows
+            for row in (items or []):
+                if str(row.get('assetnumber', '')).strip().lower() == \
+                        payload['assetnumber'].lower():
+                    assetid = _id_of(row, 'assetid')
+                    break
+        if assetid:
+            h.ids.put('printer', p['printerid'], assetid)
+    return {'printers': made, 'crosswalked': h.ids.count('printer')}
 
 
 # classic pctype -> the measuring instrument that PC drives
@@ -676,6 +704,77 @@ def stage_relationships(h):
     return {'relationships': made, 'dropped_unresolved': dropped}
 
 
+def stage_defaultprinters(h):
+    """classic machines.printerid -> a printer assignment on the imported asset.
+
+    Classic records exactly one default printer per machine row. It goes through
+    the assignment reconcile route rather than raw relationship posts: the
+    usesprinter + defaultprinter pairing, printer-type validation, the
+    default-must-be-in-the-set rule and the soft-delete/reactivate semantics all
+    live there, and reconciling converges on a re-run instead of duplicating.
+
+    Runs after assets and printers - it resolves both ends through their
+    crosswalks and drops the row when either end did not import. Needs the
+    usesprinter/defaultprinter relationship types seeded (flask seed
+    reference-data): the route writes nothing without them and every row fails.
+    """
+    # printerid=0 means no printer recorded, not a dangling FK - excluded so it
+    # never lands in the drop count as something someone has to explain.
+    rows = h.source.rows('shopdb_src',
+                        'SELECT machineid, printerid FROM machines '
+                        'WHERE isactive=1 AND printerid IS NOT NULL AND printerid>0')
+    # Legacy names for the drop report. Most machines point at a retired
+    # placeholder printer, and a bare "dropped 560" reads like data loss.
+    printernames = {row['printerid']: (row['printerwindowsname'] or '').strip()
+                    for row in h.source.rows(
+                        'shopdb_src',
+                        'SELECT printerid, printerwindowsname FROM printers')}
+
+    counts = {'source_rows': len(rows), 'linked': 0, 'already': 0,
+              'dropped_no_asset': 0, 'dropped_printer_not_imported': 0,
+              'failed': 0}
+    dropped_printers = {}
+    for r in rows:
+        assetid = h.ids.get('asset', r['machineid'])
+        if not assetid:
+            # Machine became a Location, was the 9999 placeholder, a duplicate
+            # machinenumber, or a skipped type.
+            counts['dropped_no_asset'] += 1
+            continue
+        printerassetid = h.ids.get('printer', r['printerid'])
+        if not printerassetid:
+            counts['dropped_printer_not_imported'] += 1
+            label = '{0} {1}'.format(r['printerid'],
+                                     printernames.get(r['printerid'], '?'))
+            dropped_printers[label] = dropped_printers.get(label, 0) + 1
+            continue
+
+        # Read first: the PUT reconciles the WHOLE set, so a blind write would
+        # unassign anything else already on this asset. Matching state is left
+        # alone so a second run is a no-op, not a rewrite.
+        _, current = h.get(f'/api/printers/assignments/for-asset/{assetid}')
+        current = current if isinstance(current, dict) else {}
+        assigned = list(current.get('printerassetids') or [])
+        if (current.get('defaultprinterassetid') == printerassetid
+                and printerassetid in assigned):
+            counts['already'] += 1
+            continue
+        if printerassetid not in assigned:
+            assigned.append(printerassetid)
+        status, _ = _put(h, f'/api/printers/assignments/for-asset/{assetid}',
+                        {'printerassetids': assigned,
+                         'defaultprinterassetid': printerassetid})
+        if status in (200, 201):
+            counts['linked'] += 1
+        else:
+            counts['failed'] += 1
+
+    if dropped_printers:
+        counts['dropped_printers'] = dict(
+            sorted(dropped_printers.items(), key=lambda item: -item[1])[:10])
+    return counts
+
+
 def stage_subnets(h):
     """Subnets + VLANs. Classic cidr is the suffix only; full CIDR =
     INET_NTOA(ipstart)+suffix. VLANs are lookup-or-create by number; duplicate
@@ -792,6 +891,7 @@ STAGES = {
     'notifications': stage_notifications,
     'knowledgebase': stage_knowledgebase,
     'relationships': stage_relationships,
+    'defaultprinters': stage_defaultprinters,
     'subnets': stage_subnets,
     'usb': stage_usb,
     'verify': stage_verify,
@@ -804,7 +904,7 @@ def main():
         '--stages',
         default='reference,employees,catalog,assets,locations,printers,'
                 'metrology,communications,applications,warranties,notifications,'
-                'knowledgebase,relationships,subnets,usb,verify',
+                'knowledgebase,relationships,defaultprinters,subnets,usb,verify',
         help='comma list of stages to run')
     args = parser.parse_args()