spfx

What it observes

A site's app catalog: which solutions lag their version.

m365-governance collect spfx \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --output ./evidence/spfx.json

Catalog only, and the second mode that is not a slice

The script has a second mode, SpfxPages, which reports which components are on which pages. It is not exposed as a slice.

The catalog is one call and feeds SPO-SPFX-001. SpfxPages opens every page, which is expensive, and no rule reads its evidence yet. Shipping it as a slice would have created a collection path that answers nothing about its own collection, which is the standing rule this engine holds itself to.

It remains a script only mode, opt in, bounded by -MaxPages, and it declares what it managed to inspect rather than presenting a truncated response as complete.

When a count cannot reconcile

Page inspection is bounded and says so. A count that does not reconcile is marked invalid rather than published as arithmetic that cannot be true. That outcome is invalid-evidence, which is a defect in the collector rather than a fact about the resource: see unknown versus invalid evidence.

What SPO-SPFX-001 does not establish

That the newer version is safe to deploy, or that anybody is affected. It finds that a solution is installed at an older version than the catalog holds.