WIDENED 2026-09-23 by the spice-verify seat: /sites/my-claude-code/Lists/Nope AND /sites/my-totally-made-up-xyz/Lists/AgentAssets both return 200 with an empty list shell; only the bare site route 404s. The MCP query path is honest (total 0). SharePoint returns 404 for both. Fix in the list-route controller: 404 when the site or the list is not provisioned.
GET /sites/Projects/Lists/Zzzqq is 200, so a smoke on a list URL proves nothing.