Analyze remote Invoke-Command regions

[Aaronontheweb]

Summary

• model remote, session, SSH, VM, and container Invoke-Command execution regions
• prove synchronous versus concurrent timing and bounded target cardinality without guessing dynamic collections
• isolate arbitrary remote state and prevent child exit effects from contaminating host authorization facts
• pin named, inline, positional, quoted, escaped, nested, and malformed target boundaries
• expand the executable PowerShell corpus from 383 to 393 entries and synchronize the canonical and OpenSpec contracts

Verification

• Release build: clean, zero warnings
• Full test suite: 2,265 passed
• Slopwatch: zero findings
• Header verification: clean
• PowerShell corpus regeneration: exact
• OpenSpec strict validation: valid
• Adversarial review: GO for staged SHA-256 04c26205951867d71e03f2fe5b5c032d7e706bac3baa689e1b221f6264d125f9

The first frozen review was blocked on nested or escaped commas and positional target arrays. Both findings were corrected, revalidated, and approved under a new frozen hash.