[Ramses Sanchez-Hernandez (ramsessanchez)]

N/A (no linked issue).

Changes proposed in this pull request

• User-directed operation semantics: remove every automatic GET after successful PATCH. A PATCH 204 succeeds without output; a PATCH response model is returned when present. Retrieval is a separate explicit Get-Mg... command, not a new ReadBack/PassThru/Refetch switch or hidden network action. The original implicit-GET header-retention objective is superseded.
• Remove dead read-back flags, ReFetchBlock, GET-only required-query extraction/union and the mutation-group GET-query guard. Mutation commands require and bind only their own native queries; a sibling GET retains its own requirements when called explicitly. Preserve typed builders, complete composite path dictionaries, body/path parameter separation, generic/typed headers, profiles/cache, ShouldProcess, output metadata, error/cancellation and normal transport retry semantics.
• Update positive source/offline regressions and directly coupled Authentication/query harness expectations for the new one-operation contract. Document explicit retrieval and the independent failure boundary. No module configurations/specs/consumer generation, Authentication/runtime/templates, optional-query feature or other prerequisite source changes.

User direction and same-PR history

The user's exact direction was: "retrieving the updated object should be optional, the powershell sdk should not add this behavior. This should not cause a gate failure". The confirmed interpretation is removal of implicit GET; callers choose a separate explicit GET.

This is the same existing PR/branch, revised from header replay to removal of automatic read-back. Current head: a5729b86cdb9f6b8fe28cce0f22d4fc88a59b3d2. Normal base remains powershell-v3 at 4eb3ca3e1e21ca163337f59ebbcfb9d1820a920d (#3882). Previous merge 7a6db8d1edc88a96c0b1907b2b79403acdd7b29a and head f8d18c1c9ceaa7e93ad34a02587485e515de21f8 are preserved. User-directed behavior commit d3d05b4aa6f40ad490ab77ba74cb07951d012e1b is followed by the transport rename 806ed7bc263e47c0d7d8142774c0ec587f0b00e6 and the agreed test/script/document naming cleanup. All are additive coauthored commits; no rebase/amend/force push, closing or replacing this PR.

Intentional behavior change: an Update command no longer reads a resource to manufacture output after 204. It does not declare GET-only QueryView; PATCH-required QueryTenantId remains mandatory and correctly encoded. Get-Mg... -QueryView ... still validates and binds that GET requirement independently. Incompatible PATCH/GET query types no longer create a mutation/refetch conflict. An unselected GET with unsupported query metadata does not constrain PATCH generation; a selected unsupported GET still fails its own existing validation.

Ordinary, grouped root/alternate and composite workers each perform only their selected mutation. No-GET and PUT neighbors remain unchanged. Query-on-mutation restrictions for natural-ID groups, required QueryId, typed false/zero/array inputs and optional OData behavior are preserved. Existing unsupported PATCH-void emitter shapes are not expanded. GET availability or authorization cannot turn an already successful PATCH into an SDK retrieval failure.

Current naming cleanup and limited validation

At the user's request, current names now match the one-operation contract:

• tools/Test-WrapperPatchOperations.ps1 (formerly Test-WrapperPatchRefetch.ps1).
• tools/WrapperGenerator.Tests/PatchOperationTests.cs, test class PatchOperationTests, shared fixture PatchOperationFixture.
• tools/WrapperGenerator/docs/patch-results.md, with updated README link and regression examples/filters.

Only those three moves, symbol references, current documentation/examples and the direct temporary test-directory prefix change: four files, 13 insertions/13 deletions. PatchOperationTransport.cs, its namespace/exclusion, fixture client name, production semantics and historical artifacts are unchanged. The obsolete retained-filename continuity paragraph is removed.

Forced project build succeeds; the renamed script parses, new document link resolves, and tracked current source/docs contain no old filename/class/fixture references. 2/2 tests execute and pass using the new filter:

dotnet build tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-restore --no-incremental --nologo -v quiet
dotnet test tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-build --no-restore `
  --filter 'FullyQualifiedName~PatchOperationTests' --nologo -v normal `
  --logger 'trx;LogFileName=names.trx' --results-directory "$NamingEvidence\test-results"

One fresh v1.0 Global real Kiota/compiled/NuGet-packed offline gate invokes Test-WrapperPatchOperations.ps1 and PatchOperationFixture through a new evidence-only queue runner:

& "$NamingEvidence\Invoke-QueuedProof.ps1" -RepoRoot $PWD.Path -EvidenceRoot $NamingEvidence `
  -Gate Patch -Profile v1.0 -Environment Global -KiotaPath $Kiota -AuthenticationModulePath $AuthManifest

Exit 0: 25 checks, 12 binder checks, 20 genuine prompts, 25 captures = 19 PATCH + 3 PUT + 3 explicit GET (two successful reads, one separate 403). One-request PATCH204/200 semantics remain unchanged. Normal Authentication 64/64 hashes remain unchanged; fixture package SHA-256 is DA684C81C108984DDC3A69A963D386A8D7F0D940A406A7BD143989DBCCAD5BF3. This is one new compile/capture gate, not a rerun of the full 17-build proof.

New naming evidence lives under patch-operation-names-20261105, with exact runner/source hashes, logs/TRX/exits/captures and package artifacts. The complete implementation proof below remains head-specific to d3d05b4aa6f40ad490ab77ba74cb07951d012e1b; historical commands retain the names used at execution and are not relabelled as new-head runs.

Prior transport fixture rename (806ed7b)

At the user's request, tools/WrapperGenerator.Tests/Fixtures/PatchRefetchTransport.cs is renamed to PatchOperationTransport.cs, with namespace PatchOperationTransport. Only the owning harness's Add-Type path, CaptureHandler/ConfirmationHost type references and test project's Compile Remove path change. This is three files, five insertions/five deletions and a 99% file rename. No other PatchRefetch test/harness filenames or operation behavior change.

The rename source builds successfully, the new project exclusion and PowerShell parsing pass, and 2/2 PatchRefetchTests pass:

dotnet build tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-restore --no-incremental --nologo -v quiet
dotnet test tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-build --no-restore `
  --filter 'FullyQualifiedName~PatchRefetchTests' --nologo -v normal `
  --logger 'trx;LogFileName=rename.trx' --results-directory "$RenameEvidence\test-results"

One fresh real Kiota/compiled/NuGet-packed v1.0 Global fixture through the unchanged four-mutex queue uses the renamed Add-Type source/namespace and exits 0: 25 checks, 12 binder checks, 20 genuine prompts, 25 captures = 19 PATCH + 3 PUT + 3 explicit GET, zero live Graph. All 64 Authentication package hashes remain unchanged. NuGet fixture SHA-256: 145A8FEE97054F35386A89E87A3CB3795EEABA370887932F27C090A12D839C3F.

& "$RenameEvidence\Invoke-QueuedProof.ps1" -RepoRoot $PWD.Path -EvidenceRoot $RenameEvidence `
  -Gate Patch -Profile v1.0 -Environment Global -KiotaPath $Kiota -AuthenticationModulePath $AuthManifest

Rename logs/TRX/exits/capture/source hashes are retained under the new patch-operation-transport-rename-20261105 root. The full 306-test / 17-build operation-semantics proof below remains from d3d05b4aa6f40ad490ab77ba74cb07951d012e1b; it was not rerun or relabelled for this name-only commit.

Operation-semantics source validation (implementation head)

.NET SDK 10.0.403; PowerShell 7.6.9/Core; isolated Kiota 1.36.1+fd3bf87790149b87f40f7eae1a5feb9016625943.

dotnet build tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj `
  --no-restore --no-incremental --nologo -v quiet
dotnet test tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-build --no-restore `
  --filter 'FullyQualifiedName~PatchRefetchTests|FullyQualifiedName~EmitterTests|FullyQualifiedName~MutationRouteTests|FullyQualifiedName~CompositeKeyTests|FullyQualifiedName~RequiredQueryTests' `
  --nologo -v normal --logger 'trx;LogFileName=verified.trx' --results-directory "$Evidence\test-results"

Build passed; 306 passed, 0 failed: CompositeKeyTests 24, EmitterTests 17, MutationRouteTests 195, PatchRefetchTests 2, RequiredQueryTests 68. Tests require no emitted GET for mutation workers, preserve all composite constructor/key/PolicyId1/DeviceId1/body-path assertions, check independent PATCH/GET parameter types, preserve mandatory native query behavior, and prove grouped PATCH ignores its sibling GET's required query.

The operation tests and harness positively require no implicit retrieval. Their current names are PatchOperationTests / Test-WrapperPatchOperations.ps1; the filter above records the historical name used for the implementation-head run. No obsolete header-refetch gate is waived or relabelled as new success.

Full compiled operation-semantics proof (implementation head)

The full proof in this section ran on implementation head d3d05b4aa6f40ad490ab77ba74cb07951d012e1b, after the forced nonincremental build. The evidence-only queue runner uses the same existing four generation mutex names and process-local Kiota parallelism 1; one profile at a time per gate. Its exact invocation shape is:

$cases = @(
  @{ Profile = 'v1.0'; Environment = 'Global' }
  @{ Profile = 'beta'; Environment = 'Global' }
  @{ Profile = 'beta'; Environment = 'USGov' }
)
foreach ($case in $cases) {
  & "$Evidence\Invoke-QueuedProof.ps1" -RepoRoot $PWD.Path -EvidenceRoot "$Evidence\verified" `
    -Gate Patch -Profile $case.Profile -Environment $case.Environment `
    -KiotaPath $Kiota -AuthenticationModulePath $AuthManifest
}
foreach ($case in $cases) {
  & "$Evidence\Invoke-QueuedProof.ps1" -RepoRoot $PWD.Path -EvidenceRoot "$Evidence\verified" `
    -Gate Family -Profile $case.Profile -Environment $case.Environment `
    -KiotaPath $Kiota -AuthenticationModulePath $AuthManifest
}
foreach ($profile in 'v1.0', 'beta') {
  & "$Evidence\Invoke-QueuedProof.ps1" -RepoRoot $PWD.Path -EvidenceRoot "$Evidence\verified" `
    -Gate Delete -Profile $profile -Environment Global `
    -KiotaPath $Kiota -AuthenticationModulePath $AuthManifest
}

The runner invokes Test-WrapperPatchRefetch.ps1, Test-WrapperRequiredQuery.ps1 and Test-WrapperRequiredDeleteQuery.ps1 with fresh roots, the exact isolated Kiota executable and the accepted normal Authentication package first on process-local PSModulePath. The actual expanded commands, exits, raw logs and absolute paths are retained in the evidence handoff.

Final current gate	Profiles/clouds	Builds	Result per invocation
Actual generated/compiled/NuGet-packed ordinary/grouped/composite PATCH and explicit GET	v1 Global, beta Global, beta USGov	3	Exit 0; 17 exports, 25 checks, 12 mutation/GET missing-empty-null binder checks, 20 genuine prompts, 25 HTTP captures
Generalized required-query families plus narrow production Bookings GET snippets	v1 Global, beta Global, beta USGov	6	Exit 0; 60 checks, 16 genuine prompts, 30 HTTP captures
Required/inherited DELETE plus item/no-query neighbors	v1 Global, beta Global	8	Exit 0; 30 checks, 8 genuine prompts, 14 HTTP captures
Total	8 fresh invocations	17	193 offline HTTP captures; 124 genuine No/Yes prompts; zero failed gates; zero live Graph/OAuth

Each main invocation captures 19 PATCHes, 3 PUTs and 3 caller-explicit GETs. Each accepted PATCH204 has exactly one PATCH, no output and no GET even while the terminal handler would reject any GET with 403. Each PATCH200 returns the actual generated Kiota response model with one request. Exact escaped paths, native tenantId query, typed body JSON, generic multiple/conditional headers, typed IfMatch, composite key dictionaries and independent body PolicyId1/DeviceId1 are asserted. WhatIf/genuine No send zero requests; Yes prompts exactly once. No retrieval switch is present.

After all mutations, two separate explicit GETs verify successful retrieval with mandatory QueryView, its own encoded view query and caller-controlled headers. A third explicit GET deliberately fails 403 and surfaces a separate GraphRequestFailed error; the preceding successful PATCH result is unaffected. QueryView is absent from PATCH, QueryTenantId absent from GET, and missing/empty/null mutation and GET requirements reject before HTTP. This is new generated output, not an old implicit-GET fixture reclassified.

The generalized family gate also now requires PATCH204 no output/one request, rejects GET-only QueryView on PATCH, and checks required QueryView on explicit GET. Required QueryId, scalar/formatted/native array/false/zero inputs, optional OData, pagination/delta isolation, reference/action/function/media and bodyless DELETE coverage still pass. The directly coupled Test-WrapperAuthentication.ps1 expectation is updated to PATCH204 no output/one request; its separate full SchemaExtensions Authentication lifecycle gate was not rerun here.

All current captures follow real Connect-MgGraph, the in-memory test store and GraphHttpClientFactory token handler with a terminal offline handler after authentication. Global/USGov profile roots and session adapter reuse are verified while the shared client keeps the factory-default https://graph.microsoft.com/v1.0/ BaseAddress unchanged.

The normally packaged adapted Authentication 2.41.2 is used, not stock Gallery or old 2.38.1. Physical nupkg SHA-256: 2FC09BFE6B70D313BC56DF8ADCCFB1976FB4E90A1898BF8A916B4B8B792898EB; all 64/64 package hashes remain unchanged. Normal wrappers have only three own DLLs and no RequiredAssemblies. Core/Kiota/RMS/UriTemplate/Multipart retain single identities in the accepted Authentication package/ALCs; no assembly injection, dependency preload, overlay or global installation/environment edit.

Evidence and integration limits

New evidence root: explicit-patch-results-20261105. Final current runs are under verified/, with nonzero test-results/verified.trx, forced-build/test logs and exits, exact source/spec/harness snapshots and hashes, normal packages/unpacked manifests, captures and assembly contexts, Authentication before/after hashes, and a complete hashed artifact manifest. Exact absolute paths are handed to the coordinator. No scratch/generated fixture output or binary is committed.

All earlier complete header-loss/refetch/query proofs, previous canonical heads and historical 2.38.1/RMS/#3878 artifact-only limitations remain preserved and explicitly historical. The user's new one-operation decision supersedes the former implicit-GET acceptance gate; no follow-up GET is now success, not failure.

No consumer/module configs/specs/generated trees or other owner branches were edited, and no full dependent-module generation/build is claimed. Consumers with old refetch-based assertions require planned reevaluation after normal integration, not speculative changes in this prerequisite. #3881 stays separate; optional-query #3897 is not implemented. No merge/approval/admin bypass, other PR closure or owner wakeup. Existing unrelated NU1903 YamlReader warning remains unchanged.

Other links

• Support mandatory Query-prefixed parameters for required queries #3882: normally merged native required-query support preserved for each independent operation.
• Sync current v2 Authentication into powershell-v3 #3891 and Support compatible natural-ID operation variants #3849: normal Authentication/profile-aware runtime and natural-ID mutation contracts preserved.
• Fix Kiota PostPath typed navigation without renaming operation types #3881 remains separate; [v3 wrappers] Support arbitrary optional query parameters #3897 is optional-query tracking only. Earlier Fix shared wrapper serialization dependency packaging #3878 proof is historical, not used here.