sync: auto-sync from GURU-5070 at 2026-07-06 13:43:08

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-07-06 13:43:08

wiki/clients/birth-biologic.md

@@ -168,7 +168,7 @@ Site IDs hardcoded in `$SITE_MAP` hashtable in the migration script. QSD site ID
 - **SharePoint 409 Conflict on retry:** If a chunked upload session is interrupted, a partial item remains in SharePoint. Subsequent upload sessions against the same path return 409 Conflict. Fix: DELETE the item before creating a new upload session.
 - **Long Windows paths (>260 chars) require `\\?\` prefix:** The Datto source tree contains paths exceeding MAX_PATH. Use `\\?\` prefix for `[IO.File]` reads in PowerShell. Note: `Rename-Item` and `File.Move` in PS5.1 do NOT support `\\?\` — use `robocopy` or SPMT for long-path rename/move operations.
 - **SharePoint single-session upload throttles ~40 Mbps:** For large migrations, parallel-stream uploaders (multiple concurrent file uploads, larger chunk sizes) would significantly improve throughput.
-- **Tenant Admin app cannot delete M365 groups (403):** The Tenant Admin app has GroupMember write only, not Group.ReadWrite.All. `DELETE /groups/{id}` returns 403 via Tenant Admin app. Use the **User Manager app** for group deletes (returns HTTP 204). Also: the Tenant Admin app cannot manage SP site lock/spoke-site grants (`Unsupported app only token` on SP REST) — use PnP PowerShell as SharePoint Admin.
+- **Tenant Admin app cannot delete M365 groups (403):** The Tenant Admin app has GroupMember write only, not Group.ReadWrite.All. `DELETE /groups/{id}` returns 403 via Tenant Admin app. Use the **User Manager app** for group deletes (returns HTTP 204). Also: **SharePoint app-only REST/CSOM requires the Tenant Admin app's CERTIFICATE, not the secret** — a `client_secret` token returns `Unsupported app only token` on every SP endpoint. Mint the cert token via `get-token.sh <tenant> sharepoint` (roles `Sites.FullControl.All`); do NOT reach for the secret or conclude "no SP access" (corrected 2026-07-06; the earlier "use PnP" note was wrong — the cert tier works app-only).
 - **Byte-array stringification bug — RETIRED path:** The 2026-06-26 custom-script upload path passed file bytes as `"$bytes"`, which stringified the .NET byte array to space-separated decimal text instead of raw binary. Corrupt files are inflated ~3-4x; headers are decimal (e.g. `80 75 3 4...` for PK, `37 80 68 70...` for %PDF). 84 files were corrupted and restored from Datto source. This code path is permanently retired. **Never stringify a byte array in PowerShell** — use `[IO.File]::WriteAllBytes` for binary output.
 - **SPMT requires sysadmin to be SharePoint admin:** SPMT destination access requires the running account to have SharePoint admin rights. Confirm before scheduling future SPMT runs.
 - **Syncro comment rendering:** Use `<br>` for line breaks in Syncro comments. `<ul>/<li>` collapses into a single line in the Syncro renderer.
@@ -185,6 +185,7 @@ Site IDs hardcoded in `$SITE_MAP` hashtable in the migration script. QSD site ID
 - **Tenant's real Business Premium skuId is `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`:** The scope doc had a stale GUID (`cbdc14ab-d96c-4132-b7f4-1f3a3a819bb4`). License assign 400'd until corrected. Pull skuId live from Graph `/subscribedSkus` before any license assignment.
 - **Datto→SharePoint additive push caused "reappearing files":** The April 2026 SPMT/script run was additive (never a live sync). Files deleted from Datto after April remained in SharePoint, creating phantom files that appeared to "reappear." Resolved 2026-06-27 by treating Datto as source of truth and mirroring SP to it (deleted 1,564 stale SP files to recycle bin). SharePoint and Datto are now synchronized.
 - **Quality content two-site confusion:** A `Quality Department` site (/sites/QualityDepartment) was the original April 2026 migration landing target; `Quality Systems Department` (/sites/QualitySystemsDepartment) was created 2026-06-02 as the canonical site. The old site was soft-deleted 2026-06-29 after content parity was verified and the one divergent file was preserved in QSD. Do not expect /sites/QualityDepartment to exist after ~2026-09-29 (recycle bin expiry).
+- **Migrated content owned by `SharePoint App` -> users get greyed-out Move/Copy/Rename (2026-07-06, warranty):** Everything migrated into SharePoint via the app-only Graph/SPMT uploads is authored by `SharePoint App` (no human owner). SharePoint disables Move/Copy/Rename + silently fails drag-drop on system/app-authored items, so users can move their *own* content but not the migrated tree — confirmed by contrast: `Quality General` (author Julie Beck) moves fine; every migrated folder (author `SharePoint App`) does not. NOT a permissions gap (Members group has `write`, inheritance intact, staff are all Members), NOT checkout (`ForceCheckout=false`, `CheckoutUserId` null), NOT retention (no labels). **Fix:** re-stamp `Author`/`Editor` to a real user via cert-token CSOM `SystemUpdate` (SystemUpdate preserves Modified dates — matters for the QMS). Affects ALL migrated libraries (Quality, Admin, Donor Services, Supply — same upload path). Diagnosed via the cert `sharepoint` tier (see the SharePoint cert note above).
 
 ## Active Work