feat: complete Windows client control and recovery paths

internal/server/store/migrations.go

@@ -16,6 +16,8 @@ type migration struct {
 var migrations = []migration{
 	{version: 1, sql: schemaV1},
 	{version: 2, sql: schemaV2},
+	{version: 3, sql: schemaV3},
+	{version: 4, sql: schemaV4},
 }
 
 func applyMigrations(ctx context.Context, db *sql.DB) error {
@@ -196,3 +198,17 @@ CREATE TABLE signal_intents (
 ) STRICT;
 CREATE INDEX signal_intents_pending ON signal_intents(issue_uuid, command_revision, signal, acknowledged, created_at, request_uuid);
 `
+
+// schemaV3 records the accepted/executed-after-deadline contradiction on the
+// command itself.  It is separate from the public lifecycle: the eventual
+// client-reported terminal result remains authoritative while operators can
+// still see that acceptance or execution arrived after the queue deadline.
+const schemaV3 = `
+ALTER TABLE commands ADD COLUMN late_after_expiry INTEGER NOT NULL DEFAULT 0 CHECK(late_after_expiry IN (0,1));
+`
+
+// schemaV4 retains the structured client admission rejection so status and
+// history do not have to reconstruct an error from a free-form event detail.
+const schemaV4 = `
+ALTER TABLE commands ADD COLUMN rejection BLOB;
+`