[Ramses Sanchez-Hernandez (ramsessanchez)]

No linked issue; this is the existing ChangeNotifications migration PR, finally revalidated after the normal #3886 merge.

Changes proposed in this pull request

• Preserve the shared-only audit: zero shared cmdlet directives, empty reviewed mappings, no artificial overrides or groups, and unchanged original shared AutoRest require/placeholder intent. Both compatible profiles remain supported; no profile is excluded.
• Ignore src/readme.graph.md and every profile-local directive. Parameter aliases/transforms and schema/response directives remain deferred classes; none are present in this shared source. Preserve existing naming, finite operation evidence, unaffected neighbors and historical generated boundaries.
• Integrate actual powershell-v3 target 6475f3f normally. Add module-specific positive PATCH regressions and docs for the new contract, then fully regenerate v1.0 followed by beta. No global framework/Auth/template edits, optional-query sweep, Fix Kiota PostPath typed navigation without renaming operation types #3881 overlay, or extra readback switch.

Current head and preserved history

Current pushed head: 8100cbd, same PR and branch, preserving prior head 9ed2a18c6a1f5c856b7c20718ebc030626fa5be6 and every original migration/profile commit.

1. 75b44954bb9515adc5f363401d2961fbd9e412f8 - normal target merge.
2. ed3208464347214feb8a2d63fc96dca077114e13 - own Subscription PATCH single-operation tests and documentation.
3. 87c491d84bfd47fa90e6810f0b80af27f682562c - separate combined v1.0 full client/cmdlet generation boundary.
4. 8100cbd6450ef3fd967e5d790d489281bdbf2335 - separate combined beta full generation boundary.

No rebase, amend, force push, new PR, PR merge or protection bypass. Full Git scope, including added/deleted/renamed paths, was inspected rather than relying on a capped REST file list; all paths are ChangeNotifications-owned source/generated output or its test file. No bin/obj, packages, DLLs, logs or proof artifacts are committed.

Profile	Compatible operations	Exact compatible spec Git blob	Tracked output
v1.0	7	e53bd7d80255a87fe5c11b94c5d1f09e15adc854	wrapper/v1.0
beta	7	14bf6c727c87c5433274bfec78a4a681169e5390	wrapper/Beta

Specs, Kiota client source, lock files, wrapper projects, public export names and seven unique routes reproduce unchanged from the prior head. Each generated profile removes the implicit PATCH GET readback; three GET files also receive a generator-produced blank line. The unchanged client/project/lock output was actually regenerated, not skipped or hand-edited. Existing beta casing and beta naming remain.

Positive PATCH contract, not a relabeled old failure

The old PATCH-204 generic-header-loss-on-implicit-GET result in ChangeNotifications-844672-wave3 is user-superseded historical evidence, not a current waived failure. This new target removes the implicit GET entirely:

• 204: exactly one PATCH, success, no returned object, no GET, even while the test endpoint rejects GET with 403.
• 200 with model: exactly one PATCH, the actual typed Subscription response (patch-response-id / actual-patch-response), no GET.
• A caller-explicit Get-MgSubscription independently owns its headers, query, result and error: an explicit GET is separately rejected with 403, then an explicitly requested GET with its own $select and header succeeds.

Own generation tests exercise the real compatible Subscription specs in both profiles with derived data enabled and disabled. PATCH has no native query inputs in either compatible spec. Compiled surfaces have zero mandatory Query inputs; no GET-only Property/Top inputs or PassThru/ReadBack/Refetch switch were added to Update. The real current method surfaces, not invented required queries or mutations, determine coverage.

Full generation and actual test results

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot 'C:\Users\ramsess\Repos\copilot-worktrees\msgraph-sdk-powershell\ramsessanchez-expert-fortnight' -Module ChangeNotifications -ApiVersion v1.0 -Configuration Release
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot 'C:\Users\ramsess\Repos\copilot-worktrees\msgraph-sdk-powershell\ramsessanchez-expert-fortnight' -Module ChangeNotifications -ApiVersion beta -Configuration Release

Both actual full four-mutex queued runs used Kiota 1.36.1+fd3bf87790149b87f40f7eae1a5feb9016625943, process-local parallelism 1, normal accepted Authentication 2.41.2, and only openApiDocs_KiotaCompat. No SkipKiota, GenerateOnly, NoCollisionData or fallback input. Slots released automatically. Queue wait time is recorded separately from per-module build seconds.

Profile	Full exit / status	Module build seconds	Fresh normal exports	Exact unique routes
v1.0	0 / OK	82.5	8	7
beta	0 / OK	135.2	8	7

Additional non-incremental compile commands, both exit 0:

dotnet build .\src\ChangeNotifications\wrapper\v1.0\Microsoft.Graph.Wrapper.ChangeNotifications.csproj --no-incremental --no-restore -c Release --nologo -v minimal
dotnet build .\src\ChangeNotifications\wrapper\Beta\Microsoft.Graph.Wrapper.ChangeNotifications.csproj --no-incremental --no-restore -c Release --nologo -v minimal

dotnet test .\tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-restore --filter 'FullyQualifiedName~ChangeNotificationsDirectiveMigrationTests|FullyQualifiedName~CmdletConfiguratorTests|FullyQualifiedName~NamingTests|FullyQualifiedName~RequiredQueryTests' --logger 'trx;LogFileName=targeted.trx' --results-directory 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final' --verbosity minimal
.\tools\Get-WrapperDirectiveMigrationInventory.ps1 -Module ChangeNotifications -FailOnUnresolved

Actual TRX: 161 total/executed/passed, 0 failed/not-executed, exit 0. Ordinary strict shared inventory: zero rows/mapped/deferred/unresolved, exit 0. The isolation addendum did not trigger a completed source/full-generation/TRX rerun.

Actual normal transport and post-import memory isolation

Fresh normal-manifest probe commands, all exit 0 / PASS:

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\Test-SubscriptionFinal.ps1' -Profile v1.0 -Environment Global
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\Test-SubscriptionFinal.ps1' -Profile v1.0 -Environment USGov
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\Test-SubscriptionFinal.ps1' -Profile beta -Environment Global
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\Test-SubscriptionFinal.ps1' -Profile beta -Environment USGov

Each row captures 13 authenticated offline HTTP requests, 4 genuine declined Confirm prompts, 0 live requests, and verifies 8 exports / all 7 unique GraphRoutes. Coverage includes ordinary List default and mandatory item identity, typed GET/list/VAPID outputs, optional query/header binding, typed JSON POST/PATCH bodies/results, bodyless DELETE with If-Match and reauthorize, zero HTTP for WhatIf/declines/invalid Top, positive PATCH204/200 above, independent GET, request-context/reconnect invalidation, disconnect and normal Auth/Kiota assembly contexts.

The actual GraphHttpClientFactory token pipeline, existing in-memory helper and test-only terminal handler are used, not a bare marker client. Beta requests send /beta on the correct Global/USGov host even though the factory client defaults to https://graph.microsoft.com/v1.0/; the shared BaseAddress is not mutated.

The first final probe incorporated the runtime isolation addendum before any final transport run. All additional runspace imports happen before Connect; Set-MgTestDataStore is reapplied after the last import. Actual reflected shared datastore type is recorded as Microsoft.Graph.Authentication.Test.Mocks.MockDataStore in 14 guard checkpoints per row, including before initial Connect, mutation/confirmation work, context changes, reconnect and logout. The terminal checks and records that actual type before every one of the 13 HTTP requests. The pre-reapply DiskDataStore type is separately recorded, not asserted to prove credential I/O. No old runtime report was overwritten or relabeled.

Accepted packaging and dependency ownership

The complete 64-file accepted adapted Authentication 2.41.2 manifest and physical package SHA256 2FC09BFE6B70D313BC56DF8ADCCFB1976FB4E90A1898BF8A916B4B8B792898EB were verified. The exact normal local package root leads process-local PSModulePath:

C:\Users\ramsess\.copilot\session-state\4aa86cf9-d43c-4d2b-a4a3-aeaed01b8f29\files\authentication-v2-sync\final-source\modules

Both normal wrapper manifests require Auth 2.41.2 with no RequiredAssemblies/NestedModules preloads; each fresh bin/package has only the client/runtime/module DLLs. Authentication owns the single normal Kiota/RMS/UriTemplate closure. No old2.38, stock package, shims, manual dependency copies or global setup changes.

After the full builds, supplemental dotnet pack --no-build --no-restore used the same normal generated manifest/version and production nuspec metadata/file/dependency layout. The artifact script only packages completed outputs and verifies that bin hashes are unchanged:

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\Pack-CompletedProfile.ps1' -Profile v1.0
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\Pack-CompletedProfile.ps1' -Profile beta

Both exit 0, normal 3-DLL package/build identity checks pass. These are supplemental packaging commands, not substitutes for full Kiota builds.

Honest retained limits

pwsh -NoProfile -NonInteractive -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\ChangeNotifications\wrapper\v1.0\Cmdlets -OutLedger 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\parity-v1.0.csv'
pwsh -NoProfile -NonInteractive -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\ChangeNotifications\wrapper\Beta\Cmdlets -OutLedger 'C:\Users\ramsess\.copilot\session-state\e2aeb9b2-b451-410c-a8d2-6d243a978c2f\files\post3886-6475-final\parity-beta.csv'

Raw oracle parity remains exit 1, unnormalized: v1.0 7/8 (frozen oracle lacks VAPID), beta 0/8 (existing MgBeta prefix and reauthorize/VAPID noun differences). These naming limits were not broadened into a global fix. Existing Microsoft.OpenApi.YamlReader 3.7.0 NU1903 warning remains. Acceptance is PS7/Core only and offline, not live API/tenant certification.

Canonical current evidence is in post3886-6475-final\handoff.json, with raw full-profile logs, per-command exits, actual TRX/scalar counters, strict inventory, four compiled transport captures, post-import datastore checks, source/spec/Auth64/assembly/manifest/package/queue/tool hashes, and complete Git scope. Earlier 08/844672 target and failed probe evidence remains historical and untouched.

Other links

• Merged one-operation PATCH contract: Remove automatic GET after successful PATCH #3886; merged required native-query inputs: Support mandatory Query-prefixed parameters for required queries #3882
• Merged normal Authentication/profile ownership: Sync current v2 Authentication into powershell-v3 #3891
• Preserved directive/ID frameworks: Complete reviewed directive migration mappings #3837, Support reviewed shared-directive migration edge cases #3838, Support compatible natural-ID operation variants #3849, Align operation IDs for required shared directive paths #3847, Align Kiota-compatible OpenAPI operation IDs with PowerShell #3861, Update kiota compat openapidocs #3863