From 58c0af1b44d8cb39f9fcad559ba7d009c6645ed1 Mon Sep 17 00:00:00 2001
From: Andreas Jordan <anj@ordix.de>
Date: Sun, 27 Sep 2026 13:45:34 +0200
Subject: [PATCH 1/5] Tests - Enforce the Stop-Function flow-control invariants
 over all commands

Adds the "command structure" Describe to dbatools.Tests.ps1 (Compliance
tag, no SQL Server needed), as agreed in #10655:

- rule 1: a Stop-Function that can continue (-Continue, or
  -SilentlyContinue under EnableException) has a loop or switch in the
  same function or scriptblock, and -ContinueLabel names one of them
- rule 3: a begin block that can set the command's interrupt flag is
  followed by if (Test-FunctionInterrupt) { return } as the first
  statement of process
- every Stop-Function parameter binds (names, aliases, unique prefixes)
- every command file parses

The analyzer is tests\dbatools.CommandStructure.ps1; the "command
structure analyzer" Describe covers it with positive and negative
fixtures. The 23 intentional dynamic-continue sites are listed as
exceptions with their reason and exact site count. The invariants and
the guidance for rules 2, 4, 5 and 6 are in CLAUDE.md, linked from
tests\CLAUDE.md.

(do Stop-Function)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                           |  14 +
 tests/CLAUDE.md                     |  12 +
 tests/dbatools.CommandStructure.ps1 | 375 ++++++++++++++++++++
 tests/dbatools.Tests.ps1            | 513 ++++++++++++++++++++++++++++
 4 files changed, 914 insertions(+)
 create mode 100644 tests/dbatools.CommandStructure.ps1

diff --git a/CLAUDE.md b/CLAUDE.md
index e5f96ea3851..7d8e7cc0b31 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -105,6 +105,19 @@ $results = New-Object System.Collections.ArrayList
 $results
 ```
 
+## COMMAND INVARIANTS
+
+Structural rules for every function in `public/` and `private/functions/`. Rules 1 and 3 are enforced by the "command structure" Describe in `tests/dbatools.Tests.ps1`, which reports file, function and line; the rest is guidance a reviewer checks.
+
+**Stop-Function flow control, in short:** without EnableException, `-Continue` executes `continue` and every other call sets the caller's interrupt flag and returns. With EnableException, `-SilentlyContinue` executes `continue` and every other call sets the flag and throws. The flag is set in the scope that called Stop-Function.
+
+1. **(enforced) A Stop-Function that can continue needs a local target.** A call with `-Continue` or `-SilentlyContinue` must sit inside a loop or `switch` of the same function or scriptblock, and `-ContinueLabel` must name a label of one of them. Without a local target the `continue` leaves the command and silently skips an item of the caller's loop; with a label that matches nothing it ends the caller's whole script. A loop around a helper definition or a `ForEach-Object` callback is no target. Helpers that deliberately continue their caller's loop are listed as exceptions in the test, with the reason and the exact number of sites.
+2. **Stop, then stop working.** When a Stop-Function call abandons the current operation, prevent further work against the invalid state explicitly, usually with `return` (or `continue` in a loop). Falling through is fine when it is the design and keeps the error and output contract: a failure row emitted after the warning, cleanup followed by flow control, a `$failed` flag that gates the rest.
+3. **(enforced) A begin block that can stop guards process.** When `begin` can set the command's interrupt flag, the first statement of `process` is `if (Test-FunctionInterrupt) { return }`. A call counts when it runs in the command's own scope: directly in `begin`, or in a scriptblock that is dot-sourced or handed to `ForEach-Object`, `Where-Object`, `.ForEach()` or `.Where()`. `-SilentlyContinue` alone counts, because it sets the flag without EnableException. Calls in helper functions do not count - their flag lands in the helper.
+4. **Guard the work in `end`, never the cleanup.** An `end` block that does the command's main work starts with the guard; one that disconnects or disposes runs unguarded so it also runs after a stop.
+5. **Release the temporary connections you own, preserve the ones the caller owns or shares.** Cleanup must be reachable on error and early-exit paths, preferably in `finally` where the resource lifetime allows it. An unguarded `end` block alone is no cleanup guarantee.
+6. **No `continue` semantics in handed-off scriptblocks.** A `-Continue` inside a scriptblock passed to `ForEach-Object` or `Invoke-Command` binds to whatever loop is running when it executes. Intentional dynamic binding needs a comment at the site, an entry in the rule 1 exceptions and a behavioral test; everything else gets restructured.
+
 ## COMMENT PRESERVATION REQUIREMENT
 
 **ABSOLUTE MANDATE**: ALL COMMENTS MUST BE PRESERVED EXACTLY as they appear in the original code including:
@@ -277,6 +290,7 @@ The dbatools.library version used by CI and local development is pinned in **`.g
 **dbatools Patterns:**
 - [ ] SMO used first, T-SQL only when appropriate
 - [ ] Pipeline output emitted immediately
+- [ ] Command invariants kept (Stop-Function flow control, process guard, connection cleanup)
 - [ ] No `-Detailed`/`-Simple` output mode switches
 - [ ] Command names use singular nouns
 
diff --git a/tests/CLAUDE.md b/tests/CLAUDE.md
index 840e4ea05b4..9f4f8661762 100644
--- a/tests/CLAUDE.md
+++ b/tests/CLAUDE.md
@@ -489,6 +489,18 @@ Two things keep that skip honest, and both are worth copying:
 - **Assert the engine first.** The Azure tests begin with an `It` that fails unless `DatabaseEngineEdition` is `SqlDatabase`. Pointed at anything else the rest would pass while proving nothing, because every other engine simply takes the `USE`.
 - **Assert the message, not just the failure.** Where the command has to refuse, the test also asserts that the error is *not* the raw "USE statement is not supported" - that is what fails if the code ever reaches `ChangeDatabase` again.
 
+## STRUCTURAL CHECKS OF THE COMMANDS
+
+The "command structure" Describe in `dbatools.Tests.ps1` enforces rules 1 and 3 of the command invariants in the repository `CLAUDE.md` (COMMAND INVARIANTS), which explains why they exist. It parses `public/` and `private/functions/` without SQL Server, so it runs with the Compliance tag:
+
+```powershell
+Invoke-Pester -Path .\tests\dbatools.Tests.ps1 -TagFilter Compliance
+```
+
+- The analyzer lives in `dbatools.CommandStructure.ps1`. A change to it needs a positive or negative fixture in the "command structure analyzer" Describe.
+- A new rule 1 exception (a helper that deliberately continues its caller's loop) needs the reason in the exception list, a comment at the site and a behavioral test of the calling command. Prefer restructuring the helper.
+- The structural checks do not replace behavioral coverage. A fix for a flow-control defect still gets a command-level regression test that fails on the old code, such as a caller loop that counts its iterations.
+
 ## TEST MANAGEMENT GUIDELINES
 
 The dbatools test suite must remain manageable in size while ensuring adequate coverage for important functionality.
diff --git a/tests/dbatools.CommandStructure.ps1 b/tests/dbatools.CommandStructure.ps1
new file mode 100644
index 00000000000..95569631a1b
--- /dev/null
+++ b/tests/dbatools.CommandStructure.ps1
@@ -0,0 +1,375 @@
+function Get-DbaCommandStructureFinding {
+    <#
+    .SYNOPSIS
+        Static checks for the command invariants in CLAUDE.md that the AST can prove.
+
+    .DESCRIPTION
+        Used by the "command structure" Describe in dbatools.Tests.ps1, and by its fixtures, which is
+        why it lives in its own file. It needs no SQL Server and does not load the module.
+
+        Rule 1: a Stop-Function call that can execute continue needs a local target - a loop or a
+        switch in the same function or scriptblock, carrying the label when -ContinueLabel is used.
+        Stop-Function continues with -Continue (default mode) and with -SilentlyContinue (under
+        EnableException), so either switch requires the target. The search for the target stops at a
+        function or scriptblock boundary: a loop around a helper definition or a callback is not proof,
+        because the continue then binds to whatever loop is running when it executes.
+
+        Rule 3: when begin can set the command's interrupt flag, process starts with
+        if (Test-FunctionInterrupt) { return }. Stop-Function sets the flag in its caller's scope
+        whenever it does not continue, which in the default mode means every call without -Continue,
+        -SilentlyContinue alone included. A call counts when it runs in the command's own scope:
+        directly in begin, or in a scriptblock that is dot-sourced or handed to ForEach-Object,
+        Where-Object, .ForEach() or .Where(). A helper function, & { }, Invoke-Command and .Invoke()
+        run in a new scope, so the flag they set never reaches Test-FunctionInterrupt. Any other way to
+        run a scriptblock is reported for review, not assumed safe.
+
+        A switch whose value cannot be read statically (-Continue:$variable, a splat that is not a
+        hashtable literal in the same function) counts as set. Findings are objects with Rule, File,
+        Function, Line and Message.
+
+    .PARAMETER Ast
+        The parsed file.
+
+    .PARAMETER File
+        The name to report the findings under.
+
+    .PARAMETER StopFunctionParameter
+        The parameters of Stop-Function: every name and alias as a key, the parameter name as its value.
+        A call parameter is resolved the way PowerShell binds it - name, alias, then unique prefix - and
+        one that resolves to nothing, or to more than one parameter, is reported, because that call
+        fails with a parameter binding error.
+    #>
+    param(
+        [Parameter(Mandatory)]
+        [System.Management.Automation.Language.Ast]$Ast,
+        [Parameter(Mandatory)]
+        [string]$File,
+        [Parameter(Mandatory)]
+        [hashtable]$StopFunctionParameter
+    )
+
+    # A call parameter as the Stop-Function parameter it binds to, or $null.
+    $resolveParameter = {
+        param($Name)
+        if ($StopFunctionParameter.ContainsKey($Name)) { return $StopFunctionParameter[$Name] }
+        $candidates = @($StopFunctionParameter.Keys | Where-Object { $PSItem.StartsWith($Name, [System.StringComparison]::OrdinalIgnoreCase) } | ForEach-Object { $StopFunctionParameter[$PSItem] } | Select-Object -Unique)
+        if ($candidates.Count -eq 1) { return $candidates[0] }
+        return $null
+    }
+
+    $sameScopeCommands = @("ForEach-Object", "%", "foreach", "Where-Object", "?", "where")
+    $newScopeCommands = @("Invoke-Command", "icm")
+
+    # The innermost function around a node, or $null for top-level code.
+    $getFunction = {
+        param($Node)
+        $parent = $Node.Parent
+        while ($parent) {
+            if ($parent -is [System.Management.Automation.Language.FunctionDefinitionAst]) { return $parent }
+            $parent = $parent.Parent
+        }
+        return $null
+    }
+
+    $getFunctionName = {
+        param($Node)
+        $function = & $getFunction $Node
+        if ($function) { return $function.Name }
+        return "<script>"
+    }
+
+    # How a scriptblock literal is run: "same" (the enclosing scope), "new" (a scope of its own) or
+    # "unresolved" (anything the check does not know).
+    $getInvocationScope = {
+        param($ScriptBlockExpression)
+        $parent = $ScriptBlockExpression.Parent
+        if ($parent -is [System.Management.Automation.Language.CommandAst]) {
+            if ($parent.CommandElements[0] -eq $ScriptBlockExpression) {
+                if ($parent.InvocationOperator -eq "Dot") { return "same" }
+                if ($parent.InvocationOperator -eq "Ampersand") { return "new" }
+                return "unresolved"
+            }
+            $commandName = $parent.GetCommandName()
+            if ($commandName -in $sameScopeCommands) { return "same" }
+            if ($commandName -in $newScopeCommands) { return "new" }
+            return "unresolved"
+        }
+        if ($parent -is [System.Management.Automation.Language.CommandParameterAst]) {
+            $command = $parent.Parent
+            if ($command.GetCommandName() -in $sameScopeCommands) { return "same" }
+            if ($command.GetCommandName() -in $newScopeCommands) { return "new" }
+            return "unresolved"
+        }
+        if ($parent -is [System.Management.Automation.Language.InvokeMemberExpressionAst]) {
+            $memberName = $parent.Member.Value
+            if ($parent.Expression -eq $ScriptBlockExpression -and $memberName -in "Invoke", "InvokeReturnAsIs") { return "new" }
+            if ($parent.Arguments -contains $ScriptBlockExpression -and $memberName -in "ForEach", "Where") { return "same" }
+        }
+        return "unresolved"
+    }
+
+    # The value of a hashtable entry or a switch argument: "true", "false" or "unknown".
+    $getBooleanState = {
+        param($ValueAst)
+        $expression = $ValueAst
+        if ($expression -is [System.Management.Automation.Language.PipelineAst] -and $expression.PipelineElements.Count -eq 1) {
+            $expression = $expression.PipelineElements[0]
+        }
+        if ($expression -is [System.Management.Automation.Language.CommandExpressionAst]) {
+            $expression = $expression.Expression
+        }
+        if ($expression -is [System.Management.Automation.Language.VariableExpressionAst]) {
+            if ($expression.VariablePath.UserPath -eq "true") { return "true" }
+            if ($expression.VariablePath.UserPath -eq "false") { return "false" }
+        }
+        return "unknown"
+    }
+
+    # The label text of a -ContinueLabel value, or "unknown".
+    $getLabel = {
+        param($ValueAst)
+        $expression = $ValueAst
+        if ($expression -is [System.Management.Automation.Language.PipelineAst] -and $expression.PipelineElements.Count -eq 1) {
+            $expression = $expression.PipelineElements[0]
+        }
+        if ($expression -is [System.Management.Automation.Language.CommandExpressionAst]) {
+            $expression = $expression.Expression
+        }
+        if ($expression -is [System.Management.Automation.Language.StringConstantExpressionAst]) { return $expression.Value }
+        return "unknown"
+    }
+
+    # The arguments of a Stop-Function call as a hashtable of parameter name to "true", "false",
+    # "unknown" or, for -ContinueLabel, the label text. Missing keys are parameters not passed.
+    $getStopFunctionArguments = {
+        param($CommandAst)
+        $arguments = New-Object -TypeName System.Collections.Hashtable
+        $problems = @()
+        $elements = $CommandAst.CommandElements
+        for ($i = 1; $i -lt $elements.Count; $i++) {
+            $element = $elements[$i]
+            if ($element -is [System.Management.Automation.Language.VariableExpressionAst] -and $element.Splatted) {
+                $splatName = $element.VariablePath.UserPath
+                $scopeNode = & $getFunction $CommandAst
+                if (-not $scopeNode) { $scopeNode = $Ast }
+                $assignments = @($scopeNode.FindAll({
+                            param($Node)
+                            $Node -is [System.Management.Automation.Language.AssignmentStatementAst] -and
+                            $Node.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
+                            $Node.Left.VariablePath.UserPath -eq $splatName -and
+                            $Node.Extent.StartOffset -lt $CommandAst.Extent.StartOffset
+                        }, $true))
+                $hashtable = $null
+                if ($assignments) {
+                    $right = $assignments[-1].Right
+                    if ($right -is [System.Management.Automation.Language.CommandExpressionAst] -and $right.Expression -is [System.Management.Automation.Language.HashtableAst]) {
+                        $hashtable = $right.Expression
+                    }
+                }
+                if (-not $hashtable) {
+                    $problems += "splat @$splatName is not a hashtable literal assigned earlier in the same function"
+                    foreach ($name in "Continue", "SilentlyContinue", "ContinueLabel") { $arguments[$name] = "unknown" }
+                    continue
+                }
+                foreach ($pair in $hashtable.KeyValuePairs) {
+                    $key = & $resolveParameter $pair.Item1.Value
+                    if (-not $key) {
+                        $problems += "splat @$splatName has the key $($pair.Item1.Extent.Text), which binds to no Stop-Function parameter"
+                        continue
+                    }
+                    if ($key -eq "ContinueLabel") {
+                        $arguments[$key] = & $getLabel $pair.Item2
+                    } else {
+                        $arguments[$key] = & $getBooleanState $pair.Item2
+                    }
+                }
+                continue
+            }
+            if ($element -isnot [System.Management.Automation.Language.CommandParameterAst]) { continue }
+            $name = & $resolveParameter $element.ParameterName
+            if (-not $name) {
+                $problems += "parameter -$($element.ParameterName) binds to no Stop-Function parameter, so the call fails"
+                foreach ($switchName in "Continue", "SilentlyContinue") { $arguments[$switchName] = "unknown" }
+                continue
+            }
+            if ($name -in "Continue", "SilentlyContinue") {
+                if ($element.Argument) {
+                    $arguments[$name] = & $getBooleanState $element.Argument
+                } else {
+                    $arguments[$name] = "true"
+                }
+            } elseif ($name -eq "ContinueLabel") {
+                $labelValue = $element.Argument
+                if (-not $labelValue -and $i -lt $elements.Count - 1) {
+                    $i++
+                    $labelValue = $elements[$i]
+                }
+                $arguments[$name] = & $getLabel $labelValue
+            } elseif (-not $element.Argument -and $name -ne "OverrideExceptionMessage" -and $i -lt $elements.Count - 1 -and $elements[$i + 1] -isnot [System.Management.Automation.Language.CommandParameterAst]) {
+                # Every other parameter takes the next element as its value.
+                $i++
+            }
+        }
+        [PSCustomObject]@{
+            Arguments = $arguments
+            Problems  = $problems
+        }
+    }
+
+    $newFinding = {
+        param($Rule, $Node, $Message)
+        [PSCustomObject]@{
+            Rule     = $Rule
+            File     = $File
+            Function = & $getFunctionName $Node
+            Line     = $Node.Extent.StartLineNumber
+            Message  = $Message
+        }
+    }
+
+    $stopCalls = @($Ast.FindAll({
+                param($Node)
+                $Node -is [System.Management.Automation.Language.CommandAst] -and $Node.GetCommandName() -eq "Stop-Function"
+            }, $true))
+
+    $callInfo = New-Object -TypeName System.Collections.Hashtable
+    foreach ($call in $stopCalls) {
+        $parsed = & $getStopFunctionArguments $call
+        $callInfo[$call] = $parsed.Arguments
+        foreach ($problem in $parsed.Problems) {
+            & $newFinding "Arguments" $call "Stop-Function cannot be checked: $problem"
+        }
+    }
+
+    #region Rule 1
+    foreach ($call in $stopCalls) {
+        $arguments = $callInfo[$call]
+        $mayContinue = $arguments["Continue"] -in "true", "unknown" -or $arguments["SilentlyContinue"] -in "true", "unknown"
+        if (-not $mayContinue) { continue }
+
+        $label = $arguments["ContinueLabel"]
+        if ($label -eq "unknown") {
+            & $newFinding "1" $call "Stop-Function can continue, and its -ContinueLabel target cannot be read statically"
+            continue
+        }
+
+        $hasTarget = $false
+        $parent = $call.Parent
+        while ($parent) {
+            if ($parent -is [System.Management.Automation.Language.FunctionDefinitionAst] -or $parent -is [System.Management.Automation.Language.ScriptBlockExpressionAst]) { break }
+            if ($parent -is [System.Management.Automation.Language.LoopStatementAst] -or $parent -is [System.Management.Automation.Language.SwitchStatementAst]) {
+                if (-not $label -or $parent.Label -eq $label) {
+                    $hasTarget = $true
+                    break
+                }
+            }
+            $parent = $parent.Parent
+        }
+        if ($hasTarget) { continue }
+
+        if ($label) {
+            $message = "Stop-Function can continue, and no loop or switch labeled :$label encloses it in the same function or scriptblock"
+        } else {
+            $message = "Stop-Function can continue, and no loop or switch encloses it in the same function or scriptblock"
+        }
+        & $newFinding "1" $call $message
+    }
+    #endregion Rule 1
+
+    #region Rule 3
+    $isGuard = {
+        param($Statement)
+        if ($Statement -isnot [System.Management.Automation.Language.IfStatementAst]) { return $false }
+        if ($Statement.Clauses.Count -ne 1 -or $Statement.ElseClause) { return $false }
+        $condition = $Statement.Clauses[0].Item1
+        $body = $Statement.Clauses[0].Item2
+        if ($condition -isnot [System.Management.Automation.Language.PipelineAst] -or $condition.PipelineElements.Count -ne 1) { return $false }
+        $conditionCommand = $condition.PipelineElements[0]
+        if ($conditionCommand -isnot [System.Management.Automation.Language.CommandAst] -or $conditionCommand.GetCommandName() -ne "Test-FunctionInterrupt") { return $false }
+        if ($body.Statements.Count -ne 1) { return $false }
+        $returnStatement = $body.Statements[0]
+        return ($returnStatement -is [System.Management.Automation.Language.ReturnStatementAst] -and -not $returnStatement.Pipeline)
+    }
+
+    $functions = @($Ast.FindAll({ param($Node) $Node -is [System.Management.Automation.Language.FunctionDefinitionAst] }, $true))
+    foreach ($function in $functions) {
+        $beginBlock = $function.Body.BeginBlock
+        if (-not $beginBlock) { continue }
+
+        $flagCalls = @()
+        foreach ($call in $stopCalls) {
+            if ($callInfo[$call]["Continue"] -eq "true") { continue }
+
+            # Walk up to the begin block and decide in which scope the call runs. A nested function
+            # on the way means a scope of its own; a scriptblock depends on how it is run.
+            $scope = "same"
+            $insideBegin = $false
+            $parent = $call.Parent
+            while ($parent) {
+                if ($parent -eq $beginBlock) {
+                    $insideBegin = $true
+                    break
+                }
+                if ($parent -is [System.Management.Automation.Language.FunctionDefinitionAst]) { break }
+                if ($parent -is [System.Management.Automation.Language.ScriptBlockExpressionAst] -and $scope -eq "same") {
+                    $scope = & $getInvocationScope $parent
+                }
+                $parent = $parent.Parent
+            }
+            if (-not $insideBegin -or $scope -eq "new") { continue }
+
+            if ($scope -eq "unresolved") {
+                & $newFinding "3" $call "Stop-Function in begin runs in a scriptblock whose scope the check cannot determine; review whether it can set the interrupt flag of $($function.Name)"
+                continue
+            }
+            $flagCalls += $call
+        }
+        if (-not $flagCalls) { continue }
+
+        $flagLine = $flagCalls[0].Extent.StartLineNumber
+        $processBlock = $function.Body.ProcessBlock
+        if (-not $processBlock) {
+            & $newFinding "3" $flagCalls[0] "begin of $($function.Name) can set the interrupt flag (line $flagLine), and there is no process block to guard"
+            continue
+        }
+
+        $statements = $processBlock.Statements
+        if ($statements.Count -gt 0 -and (& $isGuard $statements[0])) { continue }
+
+        $laterGuard = @($statements | Where-Object { & $isGuard $PSItem })
+        if ($laterGuard) {
+            $message = "begin of $($function.Name) can set the interrupt flag (line $flagLine), and the process guard is not the first statement (line $($laterGuard[0].Extent.StartLineNumber))"
+        } else {
+            $message = "begin of $($function.Name) can set the interrupt flag (line $flagLine), and process does not start with if (Test-FunctionInterrupt) { return }"
+        }
+        & $newFinding "3" $processBlock $message
+    }
+    #endregion Rule 3
+}
+
+function Get-DbaStopFunctionParameterMap {
+    <#
+    .SYNOPSIS
+        Every parameter name and alias of Stop-Function, mapped to the parameter name, read from its
+        source so the checks follow the function when it changes.
+    #>
+    param(
+        [Parameter(Mandatory)]
+        [string]$Path
+    )
+
+    $stopFunctionAst = [System.Management.Automation.Language.Parser]::ParseFile($Path, [ref]$null, [ref]$null)
+    $definition = $stopFunctionAst.Find({ param($Node) $Node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $Node.Name -eq "Stop-Function" }, $true)
+    # Parameter names are case-insensitive; a Hashtable from New-Object is not, unlike @{ }.
+    $map = New-Object -TypeName System.Collections.Hashtable -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($parameter in $definition.Body.ParamBlock.Parameters) {
+        $parameterName = $parameter.Name.VariablePath.UserPath
+        $map[$parameterName] = $parameterName
+        foreach ($attribute in ($parameter.Attributes | Where-Object { $PSItem.TypeName.Name -eq "Alias" })) {
+            foreach ($alias in $attribute.PositionalArguments) {
+                $map[$alias.Value] = $parameterName
+            }
+        }
+    }
+    $map
+}
diff --git a/tests/dbatools.Tests.ps1 b/tests/dbatools.Tests.ps1
index bd7ac2be97a..6267fca3e16 100644
--- a/tests/dbatools.Tests.ps1
+++ b/tests/dbatools.Tests.ps1
@@ -751,6 +751,519 @@ Describe "$ModuleName test file structure" -Tag Compliance {
     }
 }
 
+Describe "$ModuleName command structure" -Tag Compliance {
+    <#
+    The command invariants in CLAUDE.md that the AST can prove, checked over public\ and
+    private\functions\. Rule 1: a Stop-Function that can continue has a loop or switch to continue in
+    the same function or scriptblock. Rule 3: a begin block that can set the interrupt flag is followed
+    by if (Test-FunctionInterrupt) { return } as the first statement of process. The analyzer is in
+    dbatools.CommandStructure.ps1, its own fixtures are in the next Describe.
+    #>
+    BeforeAll {
+        $ModulePath = Split-Path $PSScriptRoot -Parent
+        . "$PSScriptRoot\dbatools.CommandStructure.ps1"
+        $stopFunctionParameter = Get-DbaStopFunctionParameterMap -Path "$ModulePath\private\functions\flowcontrol\Stop-Function.ps1"
+
+        # Helpers whose continue is meant to bind at run time to a loop of the command that calls them.
+        # Every call site sits inside a loop of that command, so the continue skips one item and does
+        # not escape the command (triaged in #10638). Each entry names the exact number of sites: a new
+        # site in the same helper, or one that is gone, fails the check until the entry is updated.
+        $dynamicContinueExceptions = @(
+            [PSCustomObject]@{
+                File     = "Backup-DbaDbCertificate.ps1"
+                Function = "export-cert"
+                Sites    = 3
+                Reason   = "called only inside the foreach over the certificates"
+            },
+            [PSCustomObject]@{
+                File     = "Copy-DbaSsisCatalog.ps1"
+                Function = "Invoke-ProjectDeployment"
+                Sites    = 2
+                Reason   = "called only inside the loops over the projects"
+            },
+            [PSCustomObject]@{
+                File     = "Get-DbaAgentJobHistory.ps1"
+                Function = "Get-JobHistory"
+                Sites    = 1
+                Reason   = "all three call sites sit inside loops of the command"
+            },
+            [PSCustomObject]@{
+                File     = "Get-DbaHelp.ps1"
+                Function = "Get-DbaHelp"
+                Sites    = 1
+                Reason   = "private; its only caller, Find-DbaCommand, runs it inside the foreach over all commands"
+            },
+            [PSCustomObject]@{
+                File     = "Import-DbaCsv.ps1"
+                Function = "New-SqlTable"
+                Sites    = 1
+                Reason   = "called only inside the loop over the files"
+            },
+            [PSCustomObject]@{
+                File     = "Import-DbaCsv.ps1"
+                Function = "New-SqlTableWithInferredSchema"
+                Sites    = 1
+                Reason   = "called only inside the loop over the files"
+            },
+            [PSCustomObject]@{
+                File     = "Import-DbaParquet.ps1"
+                Function = "New-SqlTable"
+                Sites    = 1
+                Reason   = "called only inside the loop over the files"
+            },
+            [PSCustomObject]@{
+                File     = "Import-DbaPfDataCollectorSetTemplate.ps1"
+                Function = "Import-DbaPfDataCollectorSetTemplate"
+                Sites    = 1
+                Reason   = "in the scriptblock that is invoked inside the loops over the computers and the files"
+            },
+            [PSCustomObject]@{
+                File     = "Invoke-DbaPfRelog.ps1"
+                Function = "Invoke-DbaPfRelog"
+                Sites    = 9
+                Reason   = "in the relog scriptblock that is invoked once per file inside the foreach; documented at the sites (#10643)"
+            },
+            [PSCustomObject]@{
+                File     = "Measure-DbaDiskSpaceRequirement.ps1"
+                Function = "Get-MountPointFromPath"
+                Sites    = 1
+                Reason   = "called only inside the loop over the rows"
+            },
+            [PSCustomObject]@{
+                File     = "Measure-DbaDiskSpaceRequirement.ps1"
+                Function = "Get-MountPointFromDefaultPath"
+                Sites    = 2
+                Reason   = "called only inside the loop over the rows"
+            }
+        )
+
+        $parseErrorFiles = @()
+        $functionFiles = Get-ChildItem -Path "$ModulePath\public", "$ModulePath\private\functions" -Filter "*.ps1" -Recurse | Sort-Object -Property Name
+        $allFindings = foreach ($functionFile in $functionFiles) {
+            $parseErrors = $null
+            $functionAst = [System.Management.Automation.Language.Parser]::ParseFile($functionFile.FullName, [ref]$null, [ref]$parseErrors)
+            if ($parseErrors) {
+                $parseErrorFiles += "$($functionFile.Name): $($parseErrors.Count) parse errors, first at line $($parseErrors[0].Extent.StartLineNumber)"
+                continue
+            }
+            Get-DbaCommandStructureFinding -Ast $functionAst -File $functionFile.Name -StopFunctionParameter $stopFunctionParameter
+        }
+
+        $formatFinding = {
+            param($Finding)
+            "$($Finding.File):$($Finding.Line) $($Finding.Function) - $($Finding.Message)"
+        }
+
+        $argumentFindings = @($allFindings | Where-Object Rule -eq "Arguments" | ForEach-Object { & $formatFinding $PSItem })
+        $guardFindings = @($allFindings | Where-Object Rule -eq "3" | ForEach-Object { & $formatFinding $PSItem })
+
+        $continueFindings = @()
+        $ruleOneFindings = @($allFindings | Where-Object Rule -eq "1")
+        foreach ($helperGroup in ($ruleOneFindings | Group-Object -Property File, Function)) {
+            $firstFinding = $helperGroup.Group[0]
+            $exception = $dynamicContinueExceptions | Where-Object { $PSItem.File -eq $firstFinding.File -and $PSItem.Function -eq $firstFinding.Function }
+            if (-not $exception) {
+                $continueFindings += $helperGroup.Group | ForEach-Object { & $formatFinding $PSItem }
+            } elseif ($exception.Sites -ne $helperGroup.Count) {
+                $continueFindings += "$($firstFinding.File) $($firstFinding.Function) - $($helperGroup.Count) dynamic continue sites, the exception list expects $($exception.Sites) (lines $($helperGroup.Group.Line -join ", "))"
+            }
+        }
+        foreach ($exception in $dynamicContinueExceptions) {
+            $matchingFindings = @($ruleOneFindings | Where-Object { $PSItem.File -eq $exception.File -and $PSItem.Function -eq $exception.Function })
+            if (-not $matchingFindings) {
+                $continueFindings += "$($exception.File) $($exception.Function) - the exception list expects $($exception.Sites) dynamic continue sites and there are none, remove the entry"
+            }
+        }
+    }
+
+    It "every command file can be parsed" {
+        $parseErrorFiles | Should -BeNullOrEmpty
+    }
+
+    It "every Stop-Function call binds its parameters" {
+        $argumentFindings | Should -BeNullOrEmpty -Because "a parameter that binds to nothing fails the call, and a switch the check cannot read cannot be checked"
+    }
+
+    It "every Stop-Function that can continue has a loop or switch to continue in the same function" {
+        $continueFindings | Should -BeNullOrEmpty -Because "without a local target the continue leaves the command and skips an item of the loop of the caller, or ends the whole calling script when a label matches nothing (CLAUDE.md, rule 1)"
+    }
+
+    It "every begin block that can set the interrupt flag is followed by the process guard" {
+        $guardFindings | Should -BeNullOrEmpty -Because "without the guard process runs on after begin stopped (CLAUDE.md, rule 3)"
+    }
+}
+
+Describe "$ModuleName command structure analyzer" -Tag Compliance {
+    <#
+    Fixtures for Get-DbaCommandStructureFinding: each case is a small function, parsed and checked the
+    same way as the commands, so a change to the analyzer that stops catching a case, or starts
+    reporting a correct one, fails here rather than silently in the command structure Describe.
+    #>
+    BeforeAll {
+        $ModulePath = Split-Path $PSScriptRoot -Parent
+        . "$PSScriptRoot\dbatools.CommandStructure.ps1"
+        $stopFunctionParameter = Get-DbaStopFunctionParameterMap -Path "$ModulePath\private\functions\flowcontrol\Stop-Function.ps1"
+
+        $findingsOf = {
+            param($Code, $Rule)
+            $fixtureAst = [System.Management.Automation.Language.Parser]::ParseInput($Code, [ref]$null, [ref]$null)
+            @(Get-DbaCommandStructureFinding -Ast $fixtureAst -File "fixture.ps1" -StopFunctionParameter $stopFunctionParameter | Where-Object Rule -eq $Rule)
+        }
+    }
+
+    Context "Rule 1, a local target for continue" {
+        It "reports -Continue without a loop, with the line and function" {
+            $code = @'
+function Get-Fixture {
+    process {
+        Stop-Function -Message "x" -Continue
+    }
+}
+'@
+            $findings = & $findingsOf $code "1"
+            $findings | Should -HaveCount 1
+            $findings[0].Line | Should -Be 3
+            $findings[0].Function | Should -Be "Get-Fixture"
+        }
+
+        It "accepts -Continue inside a foreach, a while and a switch" {
+            $code = @'
+function Get-Fixture {
+    process {
+        foreach ($item in $InputObject) { Stop-Function -Message "x" -Continue }
+        while ($true) { Stop-Function -Message "x" -Continue }
+        switch ($InputObject) { default { Stop-Function -Message "x" -Continue } }
+    }
+}
+'@
+            & $findingsOf $code "1" | Should -BeNullOrEmpty
+        }
+
+        It "reports -SilentlyContinue alone, which continues under EnableException" {
+            $code = @'
+function Get-Fixture {
+    process {
+        Stop-Function -Message "x" -SilentlyContinue
+    }
+}
+'@
+            & $findingsOf $code "1" | Should -HaveCount 1
+        }
+
+        It "accepts -Continue:`$false and reports -Continue:`$variable" {
+            $code = @'
+function Get-Fixture {
+    process {
+        Stop-Function -Message "x" -Continue:$false
+        Stop-Function -Message "x" -Continue:$shouldContinue
+    }
+}
+'@
+            $findings = & $findingsOf $code "1"
+            $findings | Should -HaveCount 1
+            $findings[0].Line | Should -Be 4
+        }
+
+        It "reads the switches from a splat assigned in the same function" {
+            $code = @'
+function Get-Fixture {
+    process {
+        $splatStop = @{
+            Message  = "x"
+            Continue = $true
+        }
+        Stop-Function @splatStop
+        $splatQuiet = @{
+            Message  = "x"
+            Continue = $false
+        }
+        Stop-Function @splatQuiet
+    }
+}
+'@
+            $findings = & $findingsOf $code "1"
+            $findings | Should -HaveCount 1
+            $findings[0].Line | Should -Be 7
+        }
+
+        It "reports a splat it cannot resolve, both as unresolved and as a possible continue" {
+            $code = @'
+function Get-Fixture {
+    param($SplatFromCaller)
+    process {
+        Stop-Function @SplatFromCaller
+    }
+}
+'@
+            & $findingsOf $code "Arguments" | Should -HaveCount 1
+            & $findingsOf $code "1" | Should -HaveCount 1
+        }
+
+        It "accepts a label that names an enclosing loop and reports one that does not" {
+            $code = @'
+function Get-Fixture {
+    process {
+        :main foreach ($instance in $SqlInstance) {
+            foreach ($database in $Database) {
+                Stop-Function -Message "x" -Continue -ContinueLabel main
+                Stop-Function -Message "x" -Continue -ContinueLabel other
+            }
+        }
+    }
+}
+'@
+            $findings = & $findingsOf $code "1"
+            $findings | Should -HaveCount 1
+            $findings[0].Line | Should -Be 6
+        }
+
+        It "reports a label that cannot be read statically" {
+            $code = @'
+function Get-Fixture {
+    process {
+        :main foreach ($instance in $SqlInstance) {
+            Stop-Function -Message "x" -Continue -ContinueLabel $labelName
+        }
+    }
+}
+'@
+            & $findingsOf $code "1" | Should -HaveCount 1
+        }
+
+        It "reports a nested helper even when a loop surrounds its definition or its call" {
+            $code = @'
+function Get-Fixture {
+    process {
+        foreach ($item in $InputObject) {
+            function Invoke-Helper {
+                Stop-Function -Message "x" -Continue
+            }
+            Invoke-Helper
+        }
+    }
+}
+'@
+            $findings = & $findingsOf $code "1"
+            $findings | Should -HaveCount 1
+            $findings[0].Function | Should -Be "Invoke-Helper"
+        }
+
+        It "reports a callback that relies on a loop outside it, and accepts one with its own loop" {
+            $code = @'
+function Get-Fixture {
+    process {
+        foreach ($item in $InputObject) {
+            $item | ForEach-Object { Stop-Function -Message "x" -Continue }
+            $item | ForEach-Object { foreach ($part in $PSItem) { Stop-Function -Message "x" -Continue } }
+        }
+    }
+}
+'@
+            $findings = & $findingsOf $code "1"
+            $findings | Should -HaveCount 1
+            $findings[0].Line | Should -Be 4
+        }
+
+        It "resolves aliases and unique prefixes and reports a parameter that binds to nothing" {
+            $code = @'
+function Get-Fixture {
+    process {
+        foreach ($item in $InputObject) {
+            Stop-Function -Message "x" -InnerErrorRecord $PSItem -Continue
+            Stop-Function -Message "x" -Error $PSItem -Continue
+            Stop-Function -Message "x" -ErroRecord $PSItem -Continue
+        }
+        Stop-Function -Message "x" -Silent
+    }
+}
+'@
+            $argumentFindings = & $findingsOf $code "Arguments"
+            $argumentFindings | Should -HaveCount 1
+            $argumentFindings[0].Line | Should -Be 6
+            $continueFindings = & $findingsOf $code "1"
+            $continueFindings | Should -HaveCount 1
+            $continueFindings[0].Line | Should -Be 8
+        }
+
+        It "reads -EnableException as a value, so the next argument is not taken for a switch" {
+            $code = @'
+function Get-Fixture {
+    process {
+        Stop-Function -Message "x" -EnableException $true
+        return
+    }
+}
+'@
+            & $findingsOf $code "1" | Should -BeNullOrEmpty
+            & $findingsOf $code "Arguments" | Should -BeNullOrEmpty
+        }
+
+        It "matches parameter names without regard to case" {
+            $code = @'
+function Get-Fixture {
+    process {
+        stop-function -message "x" -continue
+    }
+}
+'@
+            & $findingsOf $code "Arguments" | Should -BeNullOrEmpty
+            & $findingsOf $code "1" | Should -HaveCount 1
+        }
+    }
+
+    Context "Rule 3, the process guard after a begin block that can stop" {
+        It "accepts a begin stop followed by the guard as the first statement of process" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+        return
+    }
+    process {
+        if (Test-FunctionInterrupt) { return }
+        "work"
+    }
+}
+'@
+            & $findingsOf $code "3" | Should -BeNullOrEmpty
+        }
+
+        It "reports a missing guard" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+        return
+    }
+    process {
+        "work"
+    }
+}
+'@
+            $findings = & $findingsOf $code "3"
+            $findings | Should -HaveCount 1
+            $findings[0].Line | Should -Be 6
+            $findings[0].Message | Should -BeLike "*does not start with*"
+        }
+
+        It "reports a guard that is not the first statement" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+    }
+    process {
+        "work"
+        if (Test-FunctionInterrupt) { return }
+    }
+}
+'@
+            $findings = & $findingsOf $code "3"
+            $findings | Should -HaveCount 1
+            $findings[0].Message | Should -BeLike "*not the first statement*"
+        }
+
+        It "requires the guard for -SilentlyContinue alone, which sets the flag in the default mode" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x" -SilentlyContinue
+    }
+    process {
+        "work"
+    }
+}
+'@
+            & $findingsOf $code "3" | Should -HaveCount 1
+        }
+
+        It "does not require the guard for -Continue, which never sets the flag without throwing" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        foreach ($item in $Path) { Stop-Function -Message "x" -Continue }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            & $findingsOf $code "3" | Should -BeNullOrEmpty
+        }
+
+        It "does not count a helper function or a scriptblock run in a new scope" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        function Invoke-Helper { Stop-Function -Message "x" }
+        & { Stop-Function -Message "x" }
+        Invoke-Command -ScriptBlock { Stop-Function -Message "x" }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            & $findingsOf $code "3" | Should -BeNullOrEmpty
+        }
+
+        It "counts a dot-sourced scriptblock and a ForEach-Object callback, which run in the command scope" {
+            $dotSourced = @'
+function Get-Fixture {
+    begin {
+        . { Stop-Function -Message "x" }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            $callback = @'
+function Get-Fixture {
+    begin {
+        $Path | ForEach-Object { Stop-Function -Message "x" }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            & $findingsOf $dotSourced "3" | Should -HaveCount 1
+            & $findingsOf $callback "3" | Should -HaveCount 1
+        }
+
+        It "reports a scriptblock it cannot place for review instead of treating it as safe" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        $null = Register-EngineEvent -SourceIdentifier Fixture -Action { Stop-Function -Message "x" }
+    }
+    process {
+        if (Test-FunctionInterrupt) { return }
+    }
+}
+'@
+            $findings = & $findingsOf $code "3"
+            $findings | Should -HaveCount 1
+            $findings[0].Message | Should -BeLike "*cannot determine*"
+        }
+
+        It "reports a begin block that can stop when there is no process block to guard" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+    }
+    end {
+        "work"
+    }
+}
+'@
+            & $findingsOf $code "3" | Should -HaveCount 1
+        }
+    }
+}
+
 # test the module manifest - exports the right functions, processes the right formats, and is generally correct
 <#
 Describe "Manifest" {

From 483f2960d8bda92d2109e571e21c5927f02222b5 Mon Sep 17 00:00:00 2001
From: Andreas Jordan <anj@ordix.de>
Date: Sun, 27 Sep 2026 14:26:01 +0200
Subject: [PATCH 2/5] Tests - Drop the Measure-DbaDiskSpaceRequirement continue
 exceptions

#10756 replaces the Stop-Function -Continue in the two mount point
helpers with a warning, so their three sites are no longer dynamic
continue exceptions.

(do Stop-Function)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/dbatools.Tests.ps1 | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/tests/dbatools.Tests.ps1 b/tests/dbatools.Tests.ps1
index 6267fca3e16..5415e66ba49 100644
--- a/tests/dbatools.Tests.ps1
+++ b/tests/dbatools.Tests.ps1
@@ -822,18 +822,6 @@ Describe "$ModuleName command structure" -Tag Compliance {
                 Function = "Invoke-DbaPfRelog"
                 Sites    = 9
                 Reason   = "in the relog scriptblock that is invoked once per file inside the foreach; documented at the sites (#10643)"
-            },
-            [PSCustomObject]@{
-                File     = "Measure-DbaDiskSpaceRequirement.ps1"
-                Function = "Get-MountPointFromPath"
-                Sites    = 1
-                Reason   = "called only inside the loop over the rows"
-            },
-            [PSCustomObject]@{
-                File     = "Measure-DbaDiskSpaceRequirement.ps1"
-                Function = "Get-MountPointFromDefaultPath"
-                Sites    = 2
-                Reason   = "called only inside the loop over the rows"
             }
         )
 

From c0c0616509a0805030476dfc60c14025cde276df Mon Sep 17 00:00:00 2001
From: Andreas Jordan <anj@ordix.de>
Date: Sun, 27 Sep 2026 14:30:30 +0200
Subject: [PATCH 3/5] Tests - Drop the Backup-DbaDbCertificate continue
 exception

#10757 makes every stop in the export-cert helper return from the helper,
so it no longer relies on a dynamic continue.

(do Stop-Function)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/dbatools.Tests.ps1 | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tests/dbatools.Tests.ps1 b/tests/dbatools.Tests.ps1
index 5415e66ba49..4b1d337f07f 100644
--- a/tests/dbatools.Tests.ps1
+++ b/tests/dbatools.Tests.ps1
@@ -769,12 +769,6 @@ Describe "$ModuleName command structure" -Tag Compliance {
         # not escape the command (triaged in #10638). Each entry names the exact number of sites: a new
         # site in the same helper, or one that is gone, fails the check until the entry is updated.
         $dynamicContinueExceptions = @(
-            [PSCustomObject]@{
-                File     = "Backup-DbaDbCertificate.ps1"
-                Function = "export-cert"
-                Sites    = 3
-                Reason   = "called only inside the foreach over the certificates"
-            },
             [PSCustomObject]@{
                 File     = "Copy-DbaSsisCatalog.ps1"
                 Function = "Invoke-ProjectDeployment"

From f1e5d0f08065b2b74159748a38dc9268278d63c7 Mon Sep 17 00:00:00 2001
From: Andreas Jordan <anj@ordix.de>
Date: Wed, 30 Sep 2026 21:45:19 +0200
Subject: [PATCH 4/5] Tests - Close three false negatives of the command
 structure analyzer

(do dbatools)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                           |   2 +-
 tests/dbatools.CommandStructure.ps1 | 243 +++++++++++++++++++++++++---
 tests/dbatools.Tests.ps1            | 230 ++++++++++++++++++++++++++
 3 files changed, 448 insertions(+), 27 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 47f53bea9e3..c3bf5742e62 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -113,7 +113,7 @@ Structural rules for every function in `public/` and `private/functions/`. Rules
 
 1. **(enforced) A Stop-Function that can continue needs a local target.** A call with `-Continue` or `-SilentlyContinue` must sit inside a loop or `switch` of the same function or scriptblock, and `-ContinueLabel` must name a label of one of them. Without a local target the `continue` leaves the command and silently skips an item of the caller's loop; with a label that matches nothing it ends the caller's whole script. A loop around a helper definition or a `ForEach-Object` callback is no target. Helpers that deliberately continue their caller's loop are listed as exceptions in the test, with the reason and the exact number of sites.
 2. **Stop, then stop working.** When a Stop-Function call abandons the current operation, prevent further work against the invalid state explicitly, usually with `return` (or `continue` in a loop). Falling through is fine when it is the design and keeps the error and output contract: a failure row emitted after the warning, cleanup followed by flow control, a `$failed` flag that gates the rest.
-3. **(enforced) A begin block that can stop guards process.** When `begin` can set the command's interrupt flag, the first statement of `process` is `if (Test-FunctionInterrupt) { return }`. A call counts when it runs in the command's own scope: directly in `begin`, or in a scriptblock that is dot-sourced or handed to `ForEach-Object`, `Where-Object`, `.ForEach()` or `.Where()`. `-SilentlyContinue` alone counts, because it sets the flag without EnableException. Calls in helper functions do not count - their flag lands in the helper.
+3. **(enforced) A begin block that can stop guards process.** When `begin` can set the command's interrupt flag, the first statement of `process` is `if (Test-FunctionInterrupt) { return }`. A call counts when it runs in the command's own scope: directly in `begin`, or in a scriptblock that is dot-sourced or handed to `ForEach-Object`, `Where-Object`, `.ForEach()` or `.Where()`. `-SilentlyContinue` alone counts, because it sets the flag without EnableException. `-Continue` counts inside a `try` with a `catch` (or under a `trap`) in `begin`, because under EnableException it sets the flag and throws, and the catch lets `begin` go on. Calls in helper functions do not count - their flag lands in the helper.
 4. **Guard the work in `end`, never the cleanup.** An `end` block that does the command's main work starts with the guard; one that disconnects or disposes runs unguarded so it also runs after a stop.
 5. **Release the temporary connections you own, preserve the ones the caller owns or shares.** Cleanup must be reachable on error and early-exit paths, preferably in `finally` where the resource lifetime allows it. An unguarded `end` block alone is no cleanup guarantee.
 6. **No `continue` semantics in handed-off scriptblocks.** A `-Continue` inside a scriptblock passed to `ForEach-Object` or `Invoke-Command` binds to whatever loop is running when it executes. Intentional dynamic binding needs a comment at the site, an entry in the rule 1 exceptions and a behavioral test; everything else gets restructured.
diff --git a/tests/dbatools.CommandStructure.ps1 b/tests/dbatools.CommandStructure.ps1
index 95569631a1b..57910348714 100644
--- a/tests/dbatools.CommandStructure.ps1
+++ b/tests/dbatools.CommandStructure.ps1
@@ -21,11 +21,16 @@ function Get-DbaCommandStructureFinding {
         directly in begin, or in a scriptblock that is dot-sourced or handed to ForEach-Object,
         Where-Object, .ForEach() or .Where(). A helper function, & { }, Invoke-Command and .Invoke()
         run in a new scope, so the flag they set never reaches Test-FunctionInterrupt. Any other way to
-        run a scriptblock is reported for review, not assumed safe.
+        run a scriptblock is reported for review, not assumed safe. A call with -Continue counts too
+        when a try with a catch, or a trap, in begin encloses it and EnableException is not $false:
+        Stop-Function then sets the flag and throws, and begin goes on after the catch. The guard counts
+        only in the exact shape if (Test-FunctionInterrupt) { return }, without arguments or
+        redirections.
 
-        A switch whose value cannot be read statically (-Continue:$variable, a splat that is not a
-        hashtable literal in the same function) counts as set. Findings are objects with Rule, File,
-        Function, Line and Message.
+        A switch whose value cannot be read statically (-Continue:$variable, a splat whose value at the
+        call is not certain) counts as set. A splat is resolved only from a single hashtable literal that
+        certainly reaches the call and is never changed; see $resolveSplat. Findings are objects with
+        Rule, File, Function, Line and Message.
 
     .PARAMETER Ast
         The parsed file.
@@ -139,6 +144,177 @@ function Get-DbaCommandStructureFinding {
         return "unknown"
     }
 
+    # A variable name without its scope qualifier, so $script:splat and $splat count as one name.
+    $getVariableName = {
+        param($VariableAst)
+        $VariableAst.VariablePath.UserPath -replace "^(global|local|private|script|using|variable):", ""
+    }
+
+    $variableCommands = @("Set-Variable", "sv", "set", "New-Variable", "nv", "Remove-Variable", "rv", "Clear-Variable", "clv", "Get-Variable", "gv", "Invoke-Expression", "iex")
+
+    # Whether Inner lies within the source text of Outer.
+    $isWithin = {
+        param($Inner, $Outer)
+        $Inner.Extent.StartOffset -ge $Outer.Extent.StartOffset -and $Inner.Extent.EndOffset -le $Outer.Extent.EndOffset
+    }
+
+    # The hashtable literal a splat of a Stop-Function call is built from, as an object with Hashtable
+    # (the HashtableAst, or $null) and Reason (why it cannot be resolved). An unresolved splat counts
+    # as setting every switch. The splat is resolved only from the assignment that certainly reaches
+    # the call with nothing able to change the value in between:
+    # - The definition is the last assignment of the variable before the call in the function, a plain
+    #   $name = @{ } at statement level of a block that encloses the call. A scriptblock between the
+    #   block and the call must be one whose invocation the check knows.
+    # - Every other use of the variable that can change it (an assignment, a key assignment, a method
+    #   call, [ref], ++, handing the hashtable to a command or another variable) is a write. Only
+    #   splatting it, reading a key and expanding it in a string are reads. No write may lie between
+    #   the definition and the end of the call, none in a loop or scriptblock between the block and the
+    #   call (the next iteration runs it before the call), and none in a nested function or scriptblock
+    #   that does not enclose the definition (it can run between the two).
+    # - No variable cmdlet names the variable or a name the check cannot read, no Invoke-Expression,
+    #   and the name is no command argument (such as -OutVariable).
+    $resolveSplat = {
+        param($CommandAst, $SplatName)
+        $unresolved = {
+            param($Reason)
+            [PSCustomObject]@{
+                Hashtable = $null
+                Reason    = $Reason
+            }
+        }
+
+        $scopeNode = & $getFunction $CommandAst
+        if (-not $scopeNode) { $scopeNode = $Ast }
+
+        $uses = @($scopeNode.FindAll({
+                    param($Node)
+                    $Node -is [System.Management.Automation.Language.VariableExpressionAst] -and (& $getVariableName $Node) -eq $SplatName
+                }, $true))
+        $writes = @(foreach ($use in $uses) {
+                if ($use.Splatted) { continue }
+                $useParent = $use.Parent
+                if ($useParent -is [System.Management.Automation.Language.ExpandableStringExpressionAst]) { continue }
+                $isRead = $false
+                if ($useParent -is [System.Management.Automation.Language.MemberExpressionAst] -and $useParent -isnot [System.Management.Automation.Language.InvokeMemberExpressionAst] -and $useParent.Expression -eq $use) { $isRead = $true }
+                if ($useParent -is [System.Management.Automation.Language.IndexExpressionAst] -and $useParent.Target -eq $use) { $isRead = $true }
+                if ($isRead -and $useParent.Parent -is [System.Management.Automation.Language.UnaryExpressionAst] -and $useParent.Parent.TokenKind -in "PlusPlus", "MinusMinus", "PostfixPlusPlus", "PostfixMinusMinus") { $isRead = $false }
+                if ($isRead) {
+                    # A key read on the left of an assignment is a key assignment.
+                    $assignment = $useParent.Parent
+                    while ($assignment -and $assignment -isnot [System.Management.Automation.Language.AssignmentStatementAst]) { $assignment = $assignment.Parent }
+                    if ($assignment -and (& $isWithin $use $assignment.Left)) { $isRead = $false }
+                }
+                if (-not $isRead) { $use }
+            })
+
+        $assignments = @($scopeNode.FindAll({
+                    param($Node)
+                    if ($Node -isnot [System.Management.Automation.Language.AssignmentStatementAst] -or $Node.Extent.StartOffset -ge $CommandAst.Extent.StartOffset) { return $false }
+                    foreach ($write in $writes) {
+                        if (& $isWithin $write $Node.Left) { return $true }
+                    }
+                    return $false
+                }, $true) | Sort-Object -Property { $PSItem.Extent.StartOffset })
+        if (-not $assignments) {
+            return (& $unresolved "splat @$SplatName is not assigned before the call in the same function")
+        }
+
+        $definition = $assignments[-1]
+        $right = $definition.Right
+        $isPlain = $definition.Operator -eq "Equals" -and
+        $definition.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
+        $definition.Left.VariablePath.UserPath -eq $SplatName
+        if (-not $isPlain) {
+            return (& $unresolved "splat @$SplatName is changed at line $($definition.Extent.StartLineNumber) before the call")
+        }
+        if ($right -isnot [System.Management.Automation.Language.CommandExpressionAst] -or $right.Expression -isnot [System.Management.Automation.Language.HashtableAst]) {
+            return (& $unresolved "splat @$SplatName is not assigned a hashtable literal at line $($definition.Extent.StartLineNumber), its last assignment before the call")
+        }
+
+        # The assignment reaches the call only when it is a statement of a block that encloses the call
+        # and comes first. Loops and scriptblocks between the block and the call are collected, because
+        # they can run a write after the call and then the call again.
+        $definitionBlock = $definition.Parent
+        $reaches = $false
+        $repeated = @()
+        if ($definition.Extent.EndOffset -le $CommandAst.Extent.StartOffset -and ($definitionBlock -is [System.Management.Automation.Language.StatementBlockAst] -or $definitionBlock -is [System.Management.Automation.Language.NamedBlockAst])) {
+            $parent = $CommandAst.Parent
+            while ($parent) {
+                if ($parent -eq $definitionBlock) {
+                    $reaches = $true
+                    break
+                }
+                if ($parent -is [System.Management.Automation.Language.ScriptBlockExpressionAst]) {
+                    if ((& $getInvocationScope $parent) -eq "unresolved") { break }
+                    $repeated += $parent
+                }
+                if ($parent -is [System.Management.Automation.Language.LoopStatementAst]) { $repeated += $parent }
+                $parent = $parent.Parent
+            }
+        }
+        if (-not $reaches) {
+            return (& $unresolved "splat @$SplatName is last assigned at line $($definition.Extent.StartLineNumber) in a branch, loop, try or scriptblock the call is not part of, so the assignment is not certain to reach the call")
+        }
+
+        $nestedBodies = @($scopeNode.FindAll({
+                    param($Node)
+                    ($Node -is [System.Management.Automation.Language.FunctionDefinitionAst] -or $Node -is [System.Management.Automation.Language.ScriptBlockExpressionAst]) -and $Node -ne $scopeNode -and -not (& $isWithin $definition $Node)
+                }, $true))
+        foreach ($write in $writes) {
+            if ($write -eq $definition.Left) { continue }
+            $between = $write.Extent.StartOffset -ge $definition.Extent.EndOffset -and $write.Extent.StartOffset -lt $CommandAst.Extent.EndOffset
+            $inRepeated = @($repeated | Where-Object { & $isWithin $write $PSItem }).Count -gt 0
+            $inNested = @($nestedBodies | Where-Object { & $isWithin $write $PSItem }).Count -gt 0
+            if ($between -or $inRepeated -or $inNested) {
+                return (& $unresolved "splat @$SplatName can be changed at line $($write.Extent.StartLineNumber) after its assignment at line $($definition.Extent.StartLineNumber) and before the call")
+            }
+        }
+
+        $variableCommandCalls = @($scopeNode.FindAll({
+                    param($Node)
+                    if ($Node -isnot [System.Management.Automation.Language.CommandAst]) { return $false }
+                    $commandName = $Node.GetCommandName()
+                    if ($commandName -in "Invoke-Expression", "iex") { return $true }
+                    if ($commandName -notin $variableCommands) { return $false }
+                    # The name is the argument of -Name, or else the first positional argument.
+                    $elements = $Node.CommandElements
+                    $nameValue = $null
+                    for ($i = 1; $i -lt $elements.Count; $i++) {
+                        $element = $elements[$i]
+                        if ($element -is [System.Management.Automation.Language.CommandParameterAst]) {
+                            if ("Name".StartsWith($element.ParameterName, [System.StringComparison]::OrdinalIgnoreCase)) {
+                                $nameValue = $element.Argument
+                                if (-not $nameValue -and $i -lt $elements.Count - 1) { $nameValue = $elements[$i + 1] }
+                                break
+                            }
+                            if (-not $element.Argument) { $i++ }
+                            continue
+                        }
+                        $nameValue = $element
+                        break
+                    }
+                    if ($nameValue -isnot [System.Management.Automation.Language.StringConstantExpressionAst]) { return $true }
+                    return ($nameValue.Value -eq $SplatName)
+                }, $true))
+        if ($variableCommandCalls) {
+            return (& $unresolved "splat @$SplatName can be changed by $($variableCommandCalls[0].GetCommandName()) at line $($variableCommandCalls[0].Extent.StartLineNumber)")
+        }
+
+        # The name as a command argument, such as -OutVariable splatStop, can write the variable too.
+        $nameArguments = @($scopeNode.FindAll({
+                    param($Node)
+                    $Node -is [System.Management.Automation.Language.StringConstantExpressionAst] -and $Node.Value -eq $SplatName -and ($Node.Parent -is [System.Management.Automation.Language.CommandAst] -or $Node.Parent -is [System.Management.Automation.Language.CommandParameterAst])
+                }, $true))
+        if ($nameArguments) {
+            return (& $unresolved "splat @$SplatName is named as a command argument at line $($nameArguments[0].Extent.StartLineNumber), which can write it")
+        }
+
+        [PSCustomObject]@{
+            Hashtable = $right.Expression
+            Reason    = $null
+        }
+    }
+
     # The arguments of a Stop-Function call as a hashtable of parameter name to "true", "false",
     # "unknown" or, for -ContinueLabel, the label text. Missing keys are parameters not passed.
     $getStopFunctionArguments = {
@@ -149,29 +325,14 @@ function Get-DbaCommandStructureFinding {
         for ($i = 1; $i -lt $elements.Count; $i++) {
             $element = $elements[$i]
             if ($element -is [System.Management.Automation.Language.VariableExpressionAst] -and $element.Splatted) {
-                $splatName = $element.VariablePath.UserPath
-                $scopeNode = & $getFunction $CommandAst
-                if (-not $scopeNode) { $scopeNode = $Ast }
-                $assignments = @($scopeNode.FindAll({
-                            param($Node)
-                            $Node -is [System.Management.Automation.Language.AssignmentStatementAst] -and
-                            $Node.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
-                            $Node.Left.VariablePath.UserPath -eq $splatName -and
-                            $Node.Extent.StartOffset -lt $CommandAst.Extent.StartOffset
-                        }, $true))
-                $hashtable = $null
-                if ($assignments) {
-                    $right = $assignments[-1].Right
-                    if ($right -is [System.Management.Automation.Language.CommandExpressionAst] -and $right.Expression -is [System.Management.Automation.Language.HashtableAst]) {
-                        $hashtable = $right.Expression
-                    }
-                }
-                if (-not $hashtable) {
-                    $problems += "splat @$splatName is not a hashtable literal assigned earlier in the same function"
-                    foreach ($name in "Continue", "SilentlyContinue", "ContinueLabel") { $arguments[$name] = "unknown" }
+                $splatName = & $getVariableName $element
+                $resolvedSplat = & $resolveSplat $CommandAst $splatName
+                if (-not $resolvedSplat.Hashtable) {
+                    $problems += $resolvedSplat.Reason
+                    foreach ($name in "Continue", "SilentlyContinue", "ContinueLabel", "EnableException") { $arguments[$name] = "unknown" }
                     continue
                 }
-                foreach ($pair in $hashtable.KeyValuePairs) {
+                foreach ($pair in $resolvedSplat.Hashtable.KeyValuePairs) {
                     $key = & $resolveParameter $pair.Item1.Value
                     if (-not $key) {
                         $problems += "splat @$splatName has the key $($pair.Item1.Extent.Text), which binds to no Stop-Function parameter"
@@ -205,6 +366,18 @@ function Get-DbaCommandStructureFinding {
                     $labelValue = $elements[$i]
                 }
                 $arguments[$name] = & $getLabel $labelValue
+            } elseif ($name -eq "EnableException") {
+                # A [bool], so the value is the colon argument or the next element.
+                $enableValue = $element.Argument
+                if (-not $enableValue -and $i -lt $elements.Count - 1 -and $elements[$i + 1] -isnot [System.Management.Automation.Language.CommandParameterAst]) {
+                    $i++
+                    $enableValue = $elements[$i]
+                }
+                if ($enableValue) {
+                    $arguments[$name] = & $getBooleanState $enableValue
+                } else {
+                    $arguments[$name] = "unknown"
+                }
             } elseif (-not $element.Argument -and $name -ne "OverrideExceptionMessage" -and $i -lt $elements.Count - 1 -and $elements[$i + 1] -isnot [System.Management.Automation.Language.CommandParameterAst]) {
                 # Every other parameter takes the next element as its value.
                 $i++
@@ -286,6 +459,10 @@ function Get-DbaCommandStructureFinding {
         if ($condition -isnot [System.Management.Automation.Language.PipelineAst] -or $condition.PipelineElements.Count -ne 1) { return $false }
         $conditionCommand = $condition.PipelineElements[0]
         if ($conditionCommand -isnot [System.Management.Automation.Language.CommandAst] -or $conditionCommand.GetCommandName() -ne "Test-FunctionInterrupt") { return $false }
+        # Only the bare call returns its result to the condition: a redirection such as > $null discards
+        # the $true, and an argument fails the call, so both leave the condition false.
+        if ($conditionCommand.CommandElements.Count -ne 1 -or $conditionCommand.Redirections.Count -ne 0 -or $conditionCommand.InvocationOperator -ne "Unknown") { return $false }
+        if ($condition.PSObject.Properties["Background"] -and $condition.Background) { return $false }
         if ($body.Statements.Count -ne 1) { return $false }
         $returnStatement = $body.Statements[0]
         return ($returnStatement -is [System.Management.Automation.Language.ReturnStatementAst] -and -not $returnStatement.Pipeline)
@@ -298,18 +475,31 @@ function Get-DbaCommandStructureFinding {
 
         $flagCalls = @()
         foreach ($call in $stopCalls) {
-            if ($callInfo[$call]["Continue"] -eq "true") { continue }
+            # -Continue sets the flag only on its throwing path: under EnableException, without
+            # -SilentlyContinue, Stop-Function sets the flag and throws. That matters only when begin
+            # can catch the exception and go on, so such a call counts when a try with a catch, or a
+            # trap, in begin encloses it. EnableException counts as possible unless it is $false,
+            # because Stop-Function takes the value of the caller when it is not passed.
+            $arguments = $callInfo[$call]
+            $continueOnly = $arguments["Continue"] -eq "true"
+            if ($continueOnly -and ($arguments["SilentlyContinue"] -eq "true" -or $arguments["EnableException"] -eq "false")) { continue }
 
             # Walk up to the begin block and decide in which scope the call runs. A nested function
             # on the way means a scope of its own; a scriptblock depends on how it is run.
             $scope = "same"
             $insideBegin = $false
+            $canResume = $false
             $parent = $call.Parent
             while ($parent) {
                 if ($parent -eq $beginBlock) {
                     $insideBegin = $true
+                    if ($parent.Traps) { $canResume = $true }
                     break
                 }
+                if ($parent -is [System.Management.Automation.Language.TryStatementAst] -and $parent.CatchClauses.Count -gt 0 -and $call.Extent.StartOffset -ge $parent.Body.Extent.StartOffset -and $call.Extent.EndOffset -le $parent.Body.Extent.EndOffset) {
+                    $canResume = $true
+                }
+                if ($parent -is [System.Management.Automation.Language.StatementBlockAst] -and $parent.Traps) { $canResume = $true }
                 if ($parent -is [System.Management.Automation.Language.FunctionDefinitionAst]) { break }
                 if ($parent -is [System.Management.Automation.Language.ScriptBlockExpressionAst] -and $scope -eq "same") {
                     $scope = & $getInvocationScope $parent
@@ -317,6 +507,7 @@ function Get-DbaCommandStructureFinding {
                 $parent = $parent.Parent
             }
             if (-not $insideBegin -or $scope -eq "new") { continue }
+            if ($continueOnly -and -not $canResume) { continue }
 
             if ($scope -eq "unresolved") {
                 & $newFinding "3" $call "Stop-Function in begin runs in a scriptblock whose scope the check cannot determine; review whether it can set the interrupt flag of $($function.Name)"
diff --git a/tests/dbatools.Tests.ps1 b/tests/dbatools.Tests.ps1
index 80954656695..1f1d824f5c4 100644
--- a/tests/dbatools.Tests.ps1
+++ b/tests/dbatools.Tests.ps1
@@ -1052,6 +1052,134 @@ function Get-Fixture {
             & $findingsOf $code "1" | Should -HaveCount 1
         }
 
+        It "reports a splat whose key is changed after the literal, and does not read the literal" {
+            $code = @'
+function Get-Fixture {
+    process {
+        $splatStop = @{ Message = "x"; Continue = $false }
+        $splatStop.Continue = $true
+        Stop-Function @splatStop
+    }
+}
+'@
+            $argumentFindings = & $findingsOf $code "Arguments"
+            $argumentFindings | Should -HaveCount 1
+            $argumentFindings[0].Line | Should -Be 5
+            & $findingsOf $code "1" | Should -HaveCount 1
+        }
+
+        It "reports a splat changed by an index, a method, [ref], ++ or a variable cmdlet" {
+            $code = @'
+function Get-Fixture1 {
+    $splatStop = @{ Message = "x" }
+    $splatStop["Continue"] = $true
+    Stop-Function @splatStop
+}
+function Get-Fixture2 {
+    $splatStop = @{ Message = "x" }
+    $splatStop.Add("Continue", $true)
+    Stop-Function @splatStop
+}
+function Get-Fixture3 {
+    $splatStop = @{ Message = "x" }
+    Update-Splat -Reference ([ref]$splatStop)
+    Stop-Function @splatStop
+}
+function Get-Fixture4 {
+    $splatStop = @{ Message = "x"; Continue = 0 }
+    $splatStop.Continue++
+    Stop-Function @splatStop
+}
+function Get-Fixture5 {
+    $splatStop = @{ Message = "x" }
+    Set-Variable -Name splatStop -Value @{ Message = "x"; Continue = $true }
+    Stop-Function @splatStop
+}
+function Get-Fixture6 {
+    $splatStop = @{ Message = "x" }
+    $alias = $splatStop
+    $alias.Continue = $true
+    Stop-Function @splatStop
+}
+'@
+            $argumentFindings = & $findingsOf $code "Arguments"
+            $argumentFindings | Should -HaveCount 6
+            $argumentFindings.Function | Should -Be @("Get-Fixture1", "Get-Fixture2", "Get-Fixture3", "Get-Fixture4", "Get-Fixture5", "Get-Fixture6")
+        }
+
+        It "reports a splat assigned only under a condition or in an uncalled nested helper" {
+            $conditional = @'
+function Get-Fixture {
+    process {
+        $splatStop = @{ Message = "x"; Continue = $false }
+        if ($Force) {
+            $splatStop = @{ Message = "x"; Continue = $true }
+        }
+        Stop-Function @splatStop
+    }
+}
+'@
+            $helperAssignment = @'
+function Get-Fixture {
+    process {
+        function Set-Splat {
+            $splatStop = @{ Message = "x"; Continue = $false }
+        }
+        Stop-Function @splatStop
+    }
+}
+'@
+            $helperMutation = @'
+function Get-Fixture {
+    process {
+        function Update-Splat {
+            $splatStop.Continue = $true
+        }
+        $splatStop = @{ Message = "x"; Continue = $false }
+        Update-Splat
+        Stop-Function @splatStop
+    }
+}
+'@
+            & $findingsOf $conditional "Arguments" | Should -HaveCount 1
+            & $findingsOf $helperAssignment "Arguments" | Should -HaveCount 1
+            & $findingsOf $helperMutation "Arguments" | Should -HaveCount 1
+        }
+
+        It "reports a splat changed later in the loop around the call" {
+            $code = @'
+function Get-Fixture {
+    process {
+        $splatStop = @{ Message = "x"; Continue = $false }
+        foreach ($item in $InputObject) {
+            Stop-Function @splatStop
+            $splatStop.Continue = $true
+        }
+    }
+}
+'@
+            & $findingsOf $code "Arguments" | Should -HaveCount 1
+        }
+
+        It "resolves a splat name reused for several literals, each directly before its call" {
+            $code = @'
+function Get-Fixture {
+    process {
+        foreach ($item in $InputObject) {
+            $splatStop = @{ Message = "x"; Continue = $true }
+            Write-Message -Level Verbose -Message "$splatStop $($splatStop.Message)"
+            Stop-Function @splatStop
+        }
+        $splatStop = @{ Message = "x"; Continue = $false }
+        Stop-Function @splatStop
+        return
+    }
+}
+'@
+            & $findingsOf $code "Arguments" | Should -BeNullOrEmpty
+            & $findingsOf $code "1" | Should -BeNullOrEmpty
+        }
+
         It "accepts a label that names an enclosing loop and reports one that does not" {
             $code = @'
 function Get-Fixture {
@@ -1244,6 +1372,108 @@ function Get-Fixture {
             & $findingsOf $code "3" | Should -BeNullOrEmpty
         }
 
+        It "requires the guard for -Continue whose exception a catch in begin swallows" {
+            $caughtThrow = @'
+function Get-Fixture {
+    begin {
+        foreach ($item in $Path) {
+            try { Stop-Function -Message "x" -Continue -EnableException $true } catch { }
+        }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            $callerMode = @'
+function Get-Fixture {
+    begin {
+        foreach ($item in $Path) {
+            try { Stop-Function -Message "x" -Continue -EnableException:$EnableException } catch { }
+        }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            $trap = @'
+function Get-Fixture {
+    begin {
+        trap { continue }
+        foreach ($item in $Path) { Stop-Function -Message "x" -Continue }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            $findings = & $findingsOf $caughtThrow "3"
+            $findings | Should -HaveCount 1
+            $findings[0].Message | Should -BeLike "*(line 4)*"
+            & $findingsOf $callerMode "3" | Should -HaveCount 1
+            & $findingsOf $trap "3" | Should -HaveCount 1
+        }
+
+        It "does not require the guard for a caught -Continue that cannot throw" {
+            $code = @'
+function Get-Fixture {
+    begin {
+        foreach ($item in $Path) {
+            try { Stop-Function -Message "x" -Continue -EnableException $false } catch { }
+            try { Stop-Function -Message "x" -Continue -SilentlyContinue } catch { }
+        }
+    }
+    process {
+        "work"
+    }
+}
+'@
+            & $findingsOf $code "3" | Should -BeNullOrEmpty
+        }
+
+        It "rejects a guard whose result is redirected, or that passes arguments" {
+            $redirected = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+        return
+    }
+    process {
+        if (Test-FunctionInterrupt > $null) { return }
+        "work"
+    }
+}
+'@
+            $withArgument = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+        return
+    }
+    process {
+        if (Test-FunctionInterrupt -Force) { return }
+        "work"
+    }
+}
+'@
+            $allStreams = @'
+function Get-Fixture {
+    begin {
+        Stop-Function -Message "x"
+        return
+    }
+    process {
+        if (Test-FunctionInterrupt *> $null) { return }
+        "work"
+    }
+}
+'@
+            & $findingsOf $redirected "3" | Should -HaveCount 1
+            & $findingsOf $withArgument "3" | Should -HaveCount 1
+            & $findingsOf $allStreams "3" | Should -HaveCount 1
+        }
+
         It "does not count a helper function or a scriptblock run in a new scope" {
             $code = @'
 function Get-Fixture {

From 599a71025635b98d76266177b407dcc6ed21c0f2 Mon Sep 17 00:00:00 2001
From: Andreas Jordan <anj@ordix.de>
Date: Wed, 30 Sep 2026 22:02:42 +0200
Subject: [PATCH 5/5] Tests - Build the Test-ElevationRequirement splat as one
 literal and allowlist its forwarded -Continue

(do dbatools)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../flowcontrol/Test-ElevationRequirement.ps1        | 12 +++++++-----
 tests/dbatools.Tests.ps1                             |  6 ++++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/private/functions/flowcontrol/Test-ElevationRequirement.ps1 b/private/functions/flowcontrol/Test-ElevationRequirement.ps1
index 1c29aa924c3..4f427c2a899 100644
--- a/private/functions/flowcontrol/Test-ElevationRequirement.ps1
+++ b/private/functions/flowcontrol/Test-ElevationRequirement.ps1
@@ -72,14 +72,16 @@ function Test-ElevationRequirement {
     } elseif ($PSCmdlet.ParameterSetName -like "Stop") {
         if ($testResult) { return $testResult }
 
+        # Forwards the switches of the caller. Stop-Function only tests them for truth, so an unbound
+        # switch or an empty label behaves as if it was not passed. The continue deliberately binds to
+        # the loop of the command that calls this helper (allowlisted in the command structure test).
         $splatStopFunction = @{
-            Message = "Console not elevated, but elevation is required to perform some actions on localhost for this command."
+            Message          = "Console not elevated, but elevation is required to perform some actions on localhost for this command."
+            Continue         = $Continue
+            ContinueLabel    = $ContinueLabel
+            SilentlyContinue = $SilentlyContinue
         }
 
-        if (Test-Bound "Continue") { $splatStopFunction["Continue"] = $Continue }
-        if (Test-Bound "ContinueLabel") { $splatStopFunction["ContinueLabel"] = $ContinueLabel }
-        if (Test-Bound "SilentlyContinue") { $splatStopFunction["SilentlyContinue"] = $SilentlyContinue }
-
         . Stop-Function @splatStopFunction -FunctionName (Get-PSCallStack)[1].Command
         return $testResult
     }
diff --git a/tests/dbatools.Tests.ps1 b/tests/dbatools.Tests.ps1
index 1f1d824f5c4..8e258b5cab5 100644
--- a/tests/dbatools.Tests.ps1
+++ b/tests/dbatools.Tests.ps1
@@ -887,6 +887,12 @@ Describe "$ModuleName command structure" -Tag Compliance {
                 Function = "Invoke-DbaPfRelog"
                 Sites    = 9
                 Reason   = "in the relog scriptblock that is invoked once per file inside the foreach; documented at the sites (#10643)"
+            },
+            [PSCustomObject]@{
+                File     = "Test-ElevationRequirement.ps1"
+                Function = "Test-ElevationRequirement"
+                Sites    = 1
+                Reason   = "private; forwards -Continue, -ContinueLabel and -SilentlyContinue of its caller, and the callers that pass them call it inside their loops, except Install-DbaSqlPackage (open defect, fixed separately)"
             }
         )