feat: complete Windows client control and recovery paths

docs/implementation-plan.v1.md

@@ -1294,7 +1294,7 @@ invariants must not.
 | --- | --- |
 | `clients` | client ID, most-recent platform/capabilities/CWD/version, durable instance ID, current generation, connection/last-seen timestamps, latest rejected live-conflict instance/time, unified charged command-storage total |
 | `sessions` | opaque session ID, client ID, durable client-instance UUID, generation, opened/fenced/closed times, close reason |
-| `commands` | UUID, client ID, indexed issue/queue-expiry/terminal times, lifecycle, revision, exit result, last event sequence, retention status, a Zstandard-compressed immutable execution-spec payload including plaintext environment values, and optional Windows selection attempts/effective identity |
+| `commands` | UUID, client ID, indexed issue/queue-expiry/terminal times, lifecycle, revision, exit result, last event sequence, retention status, a bounded structured admission-rejection payload when the client declines dispatch, a Zstandard-compressed immutable execution-spec payload including plaintext environment values, and optional Windows selection attempts/effective identity |
 | `command_payloads` | command UUID, payload kind (script or other command-owned blob), Zstandard compression, raw/stored sizes, digest, inline bytes or validated segment reference |
 | `command_events` | command UUID + event sequence unique key, observed and server receipt times, event type, payload metadata, immutable duplicate checksum |
 | `output_segments` | command UUID, segment ordinal/path, `committed_end_offset`, min/max event sequence, stream mix, compressed/raw byte totals, checksum, created time |

docs/platform-and-operations.md

@@ -79,7 +79,8 @@ history, process handles, and Job Objects. Normal service startup never shows
 UAC and is not blocked by tray or interactive-user availability.
 
 The same signed `rvbox.exe` has explicit `service`, `tray`, `install-service`,
-`uninstall-service`, `configure-service`, per-command launcher, and signal-
+`uninstall-service`, `start-service`, `stop-service`, `restart-service`,
+`configure-service`, per-command launcher, and signal-
 helper modes. Internal modes require SCM state or a service-created launch
 proof. Task Scheduler is not used. The installer registers an unelevated per-
 user tray launch through the machine-wide `Run` key. One tray may run in each

docs/testing.md

@@ -82,8 +82,11 @@ cleanup.
 test reference against source. A resettable Windows smoke VM is now available.
 The exact headless VirtualBox/Guest Control adapter is
 `scripts/windows/test-host.ps1`; it takes the VM name, baseline snapshot, and
-guest credentials only from host environment variables, acquires an exclusive
-lease, and never writes secrets to the repository. Use `Prepare`, `Run`,
+guest identity/password-file only from host environment variables, acquires an
+exclusive lease, and never writes secrets to the repository. Set
+`RVBOX_WINDOWS_GUEST_PASSWORD_FILE` to a mode-600 file outside the repository;
+the adapter passes it with VirtualBox `--passwordfile` and never accepts an
+inline password. Use `Prepare`, `Run`,
 `Collect`, `Stop`, and `Reset` in that order for a native run. The VM is the
 minimum smoke lane, so deferred native multi-session/ambiguous-session, Server
 Core, and older-build entries remain explicitly blocked until their own