Analyze local Invoke-Command regions

[Aaronontheweb]

Summary

• promote proved in-process Invoke-Command script blocks to synchronous, once execution regions
• distinguish default child variable and command scope from NoNewScope shared state while preserving failure-aware shared location
• evaluate literal NoNewScope switch truth and keep remote, job, dynamic, and ambiguous forms unknown or incomplete
• withhold stale region-body facts when downstream pipeline setup or per-object execution can mutate supported state

Security model

The analyzer joins restored body success and failure exits before projecting local Invoke-Command host flow, because inner nonterminating failures can leave the host successful. Pipeline-sensitive bodies for callbacks, local Invoke, Measure, Trace, dot-source, and direct-call start from unknown state when another stateful stage can affect them. Unsupported parameter sets remain fail closed.

Validation

• dotnet build -c Release: 0 warnings
• dotnet test -c Release --no-build: 2,129 passed
• file-header verification passed
• strict OpenSpec validation passed
• Slopwatch strict scan passed with zero findings
• adversarial review GO on frozen staged SHA-256 d1906990618c4383d926222116c3d38487813b09894350a9710ae3289a2a3b62