#verification 8 articles
A copy job reports "finished" before the target shows every file – verify after the target settles, and read authors with $expand gotchas / rest-api After CreateCopyJobs reports JobState 0, the target's /items can still miss hundreds of files for a while; re-read until two reads match, and compare authors via $expand on /items, not siteusers A file's time is not its item's time – a copy job carries the item time, and ListItemAllFields returns dates in the web's zone without "Z" gotchas / rest-api TimeCreated/TimeLastModified of a file can differ from the item's Created/Modified by seconds or years; copy jobs carry the item time, so compare items – and read them from /items(id) (UTC), because ListItemAllFields… A permission check that only asks "who has too much?" passes on an empty ACL gotchas / permissions "no principal outside the allow-list can write" is also satisfied when nobody can write at all; assert the opposite direction with a non-zero writer count, and read the principals strictly so a transient 429 cannot… A setup marker that measures only part of the step freezes a half-provisioned site forever gotchas / spfx The success flag measured the id lookups, not the addroleassignment POST, so a 403 froze a site with groups that carry no permission level at all Compiled files sitting next to sources fake your build verification gotchas / tooling Stale .js/.d.ts in src/ greps like live code while main points at lib/; ask require.resolve, date-check with git log, and keep the ignore rule narrow enough to spare hand-written .d.ts HasUniqueRoleAssignments proves the break, not the hardening — and a half-done break is worse than inheritance gotchas / permissions The flag is true after the break alone, so verifying on it reports "hardened" over a list whose trim never ran; with the safe copy=true form that state is worse than inheritance. Read roleassignments and measure… Uploaded .html grows after you set column values — SharePoint injects mso document properties (and rewrites Office files on upload) gotchas / rest-api Setting column values rewrites the file; hash read-back fails for markup, holds for PDF; Office packages change on upload itself… Verifying CORS by header presence passes every origin — compare the value to the Origin you sent gotchas / azure-functions The header comes back for every origin (servers answer with a fallback, not an omission), so presence proves nothing; compare it to the Origin you sent, keep at least one case that expects allowed, and point the probe…