Correct PowerShell authored command completeness

IMPLEMENTATION_PLAN.md

@@ -21,10 +21,11 @@ priorities.
       approval completeness consistently: prove every authored executable
       region, but do not require proof of ambient aliases, functions, modules,
       profiles, executable lookup, or inherited environment state. Preserve the
-      existing `PwshInitialStateMode` API. Next update default-mode PowerShell
-      occurrence completeness while keeping loop-dependent effective values
-      Unknown unless fresh-process state is proved, expand the executable
-      corpus, and prove the Netclaw approval matrix. Explicit
+      existing `PwshInitialStateMode` API. Default-mode PowerShell occurrence
+      completeness now follows that authored boundary while loop-dependent
+      effective values remain Unknown unless fresh-process state is proved.
+      Next expand the executable corpus and prove the Netclaw approval matrix.
+      Explicit
       source mutation, computed identity, hidden execution, unknown receiver
       semantics, unsupported constructs, and policy-sensitive unknown values,
       paths, cwd, or redirects remain strict.
@@ -297,8 +298,8 @@ priorities.
       local state; and invalidate home, cwd, environment, and command-binding
       facts after uninspected `.ps1` execution. Decoded wrappers rebuild value
       provenance from preserved inner raw spelling, reset child-process state,
-      retain explicit native/script binding candidates only when the alpha.3
-      constrained command-resolution state proves them unshadowed, clear
+      retain explicit native/script binding semantics from authored path
+      spellings without inspecting ambient child state, clear
       profile-mutable automatic HOME and environment facts, and carry a bounded
       invocation-owner depth for current, intermediate, and root-owned
       redirects. Parser-owned binding provenance now distinguishes path-shaped
@@ -310,7 +311,7 @@ priorities.
       pipelines fail atomically. Alpha.3 authorization completeness requires
       the explicit constrained command-resolution baseline, including after
       decoded-host boundaries. The v0.3 authored-command approval correction
-      above supersedes that behavior and is pending implementation.
+      above supersedes that behavior and is implemented in this slice.
       Execution-region and loop/state design promotions remain, so OpenSpec
       task 1.10 stays open.
 - [x] Deliver the first Bash `$()` substitution slice for supported
@@ -416,11 +417,10 @@ priorities.
       projects iterator and loop-body ancestry, survives decoded wrappers, and
       fails closed on dynamic iterables, iterator/body state or
       command-resolution mutation, malformed boundaries, and depth overflow.
-      Alpha.3 leaves default-mode loop-body and current-scope post-loop
-      occurrences incomplete; the authored-command correction will make static
-      occurrences complete without weakening explicit mutation or dynamic
-      execution checks. Isolated child-host loops do not taint their outer
-      continuation.
+      The authored-command correction makes default-mode loop-body and
+      current-scope post-loop static occurrences complete without weakening
+      explicit mutation or dynamic execution checks. Isolated child-host loops
+      do not taint their outer continuation.
       Alpha.3 added an explicit PowerShell initial-runspace contract and
       wrapper-state metadata. The additive `PwshInitialStateMode` API remains
       locked. The v0.3 authored-command correction no longer requires isolated

openspec/changes/v0-3-structured-shell-analysis/specs/bounded-shell-analysis/spec.md

@@ -398,9 +398,12 @@ binding facts.
 
 #### Scenario: Unknown ambient PowerShell state keeps effective values unknown
 - **WHEN** default-mode PowerShell parses `foreach ($f in @('a','b')) { Remove-Item -LiteralPath $f }`
-- **THEN** the loop structure and body command remain visible and complete
+- **THEN** the loop structure and body command remain visible
 - **THEN** the body occurrence's effective `$f` value is Unknown
 - **THEN** the parser does not mistake authored iterable text for a runtime value when an ambient binding can coerce or reject it
+- **THEN** the occurrence remains incomplete because the unknown provider target can mutate command resolution before a later visit
+- **WHEN** the same loop body uses a non-state-mutating receiver such as `Write-Output $f`
+- **THEN** its static authored occurrence remains complete while its effective `$f` value remains Unknown
 
 #### Scenario: Isolated no-profile runspace permits an ordinary binding proof
 - **WHEN** the caller selects `IsolatedNonInteractiveNoProfile` for a newly spawned noninteractive no-profile host and parses `foreach ($f in @('a','b')) { Write-Output $f }`
@@ -629,7 +632,7 @@ partition merely to publish exact continuation facts.
 
 #### Scenario: Unreachable relative redirect has no parse-time cwd proof
 - **WHEN** isolated-mode PowerShell parses `foreach ($x in @()) { Write-Output x > relative.txt }`
-- **THEN** the body occurrence and its working directory remain incomplete or Unknown
+- **THEN** the static authored body occurrence remains complete while its working directory is Unknown
 - **THEN** the explicit redirect target is Unknown rather than the parse-time absolute path
 - **THEN** an authored absolute redirect target may remain exact because it is cwd-independent
 

src/ShellSyntaxTree/Internal/Pwsh/Parsing/PwshCommandParser.cs

@@ -651,6 +651,13 @@ private static ArgumentBindingSemantics ClassifyArgumentBindingSemantics(
             return new ArgumentBindingSemantics(usesNative);
         }
 
+        // A suffix alone does not prove script binding: an unqualified name
+        // can resolve to an authored alias or function with the same spelling.
+        if (command.EndsWith(".ps1", StringComparison.OrdinalIgnoreCase))
+        {
+            return ArgumentBindingSemantics.Unknown;
+        }
+
         // An unqualified hyphenated name can resolve to either a PowerShell
         // command or a native executable. Preserve that ambiguity instead of
         // reconstructing command kind from its spelling during value analysis.