Keep deferred configuration callbacks in script scope on PowerShell 5.1

tests/Test-ConfigurationScriptScopeWindows.ps1

@@ -0,0 +1,53 @@
+# Actual script-scope helpers and Windows registry provider. Only a unique test
+# key under HKCU and a temporary journal are written; no Windows logging changes.
+$ErrorActionPreference = 'Stop'
+if ($env:OS -ne 'Windows_NT') { throw 'Run this test on Windows.' }
+$repo = Split-Path $PSScriptRoot -Parent
+$script:ScriptRoot = $repo
+. (Join-Path $repo 'scripts/Configuration.ps1')
+# Deliberately keep all helper functions script-local, as in WELA.ps1 -File.
+# Do not promote helpers or replace their calls with global mocks.
+$token = [guid]::NewGuid().ToString('N')
+$key = "HKCU:\Software\WELA-Configuration-Scope-$token"
+$backup = Join-Path ([IO.Path]::GetTempPath()) "wela-script-scope-$token"
+$ownsTestArtifacts = $false
+function Assert-Scope($Condition, [string]$Message) {
+    if (-not $Condition) { throw "FAIL: $Message" }
+}
+function Add-ScopeControls($Context, [string]$Root) {
+    Set-WelaRegistryControl -Context $Context -Path "$Root\ParentA\Child" -Name Counter -Value 42
+    Set-WelaRegistryControl -Context $Context -Path "$Root\ParentB\Child" -Name Label -Value 'second control' -Type String
+}
+try {
+    if ((Test-Path -LiteralPath $key) -or (Test-Path -LiteralPath $backup)) { throw 'Unique test artifact unexpectedly exists; refusing to use it.' }
+    $ownsTestArtifacts = $true
+    $context = New-WelaConfigurationContext -Auto -BackupPath $backup
+    # These calls must resolve Get-WelaRegistryState and recursively resolve
+    # New-WelaRegistryKey from ordinary script scope, then use real provider APIs.
+    Add-ScopeControls -Context $context -Root $key
+    $report = Complete-WelaConfiguration -Context $context
+    Assert-Scope ($report.ExitCode -eq 0) 'Script-local registry helper chain resolves and verifies'
+    Assert-Scope (@($report.Results | Where-Object Status -eq Applied).Count -eq 2) 'Both distinct control states remain available after their calling function returns'
+    Assert-Scope ((Get-ItemProperty -LiteralPath "$key\ParentA\Child" -Name Counter).Counter -eq 42) 'Actual DWORD value was written and read back'
+    Assert-Scope ((Get-ItemProperty -LiteralPath "$key\ParentB\Child" -Name Label).Label -eq 'second control') 'Actual string value was written and read back'
+    $journal = @(Get-Content -LiteralPath (Join-Path $backup 'before.jsonl') | ConvertFrom-Json)
+    Assert-Scope ($journal.Count -eq 2 -and -not $journal[0].Before.KeyExists -and -not $journal[1].Before.KeyExists) 'Missing nested registry parents were journaled before creation'
+    Add-ScopeControls -Context $context -Root $key
+    $report = Complete-WelaConfiguration -Context $context
+    Assert-Scope ($report.ExitCode -eq 0 -and @($report.Results | Where-Object Status -eq AlreadyCompliant).Count -eq 2) 'Actual registry rerun is idempotent'
+    Assert-Scope (@(Get-Content -LiteralPath (Join-Path $backup 'before.jsonl')).Count -eq 2) 'Compliant rerun writes no additional mutation journal records'
+
+    # Exercise deferred native-policy and event-log readers in the same script
+    # scope. DryRun prevents every native configuration or service mutation.
+    $dry = New-WelaConfigurationContext -Auto -DryRun
+    Set-WelaRegistryControl -Context $dry -Path "$key\ParentA\Child" -Name Counter -Value 99
+    Set-WelaAuditPolicyControl -Context $dry -Policy @{ GUID = '0CCE922B-69AE-11D9-BED3-505054503030'; Name = 'Process Creation' }
+    Set-WelaEventLogControl -Context $dry -Log Security -Property MaximumSizeInBytes -Desired 1
+    $dryReport = Complete-WelaConfiguration -Context $dry
+    Assert-Scope ($dryReport.ExitCode -eq 0) 'Deferred native API and event-log callbacks resolve script-local helpers'
+    Assert-Scope ((Get-ItemProperty -LiteralPath "$key\ParentA\Child" -Name Counter).Counter -eq 42) 'DryRun leaves the actual registry value unchanged'
+    Write-Host 'Script-scope Windows provider checks passed. Only a disposable HKCU test key and temp journal were changed.'
+} finally {
+    if ($ownsTestArtifacts -and (Test-Path -LiteralPath $key)) { Remove-Item -LiteralPath $key -Recurse -Force -ErrorAction Stop }
+    if ($ownsTestArtifacts -and (Test-Path -LiteralPath $backup)) { Remove-Item -LiteralPath $backup -Recurse -Force -ErrorAction Stop }
+}