P0: prevent consecutive BCUGE command stalls with single-flight and uncertain-timeout quarantine

MainWindow.xaml.cs

@@ -1492,6 +1492,28 @@ await Task.WhenAll(candidates.Select(async signal =>
         SetStatus($"{device.Name}: refreshed {candidates.Length} control value(s).");
     }
 
+    private bool RejectCommandWhenIedFlightUnavailable(
+        Iec61850MonitorDevice? device, SignalDefinition signal)
+    {
+        // The UI is advisory. The runtime's atomic association-wide gate is
+        // authoritative, including sticky uncertain-outcome quarantine.
+        // Reuse existing CommandSignals state instead of mirroring a new
+        // runtime busy flag into the WPF view model.
+        if (device is null ||
+            !device.CommandSignals.Any(active => active.ControlCommandBusy))
+            return false;
+        const string reason =
+            "another IED command is still active or its wire outcome is unresolved";
+        signal.ControlLastResult = "Command not sent: " + reason +
+            ". Verify process status before recovery.";
+        AddLog("WARN", device.Name,
+            $"CONTROL_UI_SINGLE_FLIGHT: rejected {signal.ObjectReference}; " +
+            "same-IED control flight already active or quarantined; no Operate requested.");
+        SetStatus($"{device.Name}: {signal.Name} — command not sent; {reason}.");
+        ShowControlShout(Iec61850ControlShout.FromLocalRejection(reason));
+        return true;
+    }
+
     private async void ControlStageAction_Click(object sender, RoutedEventArgs e)
     {
         if (sender is not Button button || button.Tag is not SignalDefinition signal ||
@@ -1502,6 +1524,8 @@ private async void ControlStageAction_Click(object sender, RoutedEventArgs e)
         var device = _signalOwners.TryGetValue(signal, out var owner) ? owner : SelectedDevice;
         if (device is null || !device.IsConnected || signal.ControlInspectionBusy || signal.ControlCommandBusy)
             return;
+        if (RejectCommandWhenIedFlightUnavailable(device, signal))
+            return;
         DismissControlShout();
 
         // A live Direct/SBO model permits a preflight inspection, not an
@@ -1568,6 +1592,8 @@ private async void ControlConfirmAction_Click(object sender, RoutedEventArgs e)
             return;
 
         var device = _signalOwners.TryGetValue(signal, out var owner) ? owner : SelectedDevice;
+        if (RejectCommandWhenIedFlightUnavailable(device, signal))
+            return;
         AddLog("INFO", device?.Name ?? "IED",
             $"Confirm click received: {signal.ObjectReference}; pending={signal.ControlConfirmationPending}; action={signal.ControlPendingAction}; value={signal.ControlPendingValue}; commandBusy={signal.ControlCommandBusy}; inspectionBusy={signal.ControlInspectionBusy}.");
 
@@ -1615,6 +1641,8 @@ private async void ControlQuickAction_Click(object sender, RoutedEventArgs e)
         }
 
         var device = _signalOwners.TryGetValue(signal, out var owner) ? owner : SelectedDevice;
+        if (RejectCommandWhenIedFlightUnavailable(device, signal))
+            return;
         if (!signal.TryBeginDirectControlCommand(
                 requestedValue,
                 button.Content?.ToString()?.Trim() ?? requestedValue,
@@ -1710,8 +1738,33 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
         }
         catch (OperationCanceledException)
         {
-            signal.ControlLastResult = "Command cancelled.";
-            SetStatus($"{device.Name}: {signal.Name} command cancelled.");
+            signal.ControlLastResult = "Command cancelled; if Operate was already dispatched, verify actual IED position.";
+            SetStatus($"{device.Name}: {signal.Name} command cancelled; verify the final process state.");
+        }
+        catch (InvalidOperationException ex) when (
+            ex.Message.Contains("control", StringComparison.OrdinalIgnoreCase) &&
+            (ex.Message.Contains("in progress", StringComparison.OrdinalIgnoreCase) ||
+             ex.Message.Contains("unresolved", StringComparison.OrdinalIgnoreCase)))
+        {
+            signal.ControlLastResult = "Command NOT SENT: " + ex.Message;
+            AddLog("WARN", device.Name,
+                $"CONTROL_UI_LOCAL_GATE: {signal.ObjectReference}; {ex.Message}");
+            SetStatus($"{device.Name}: {signal.Name} — command not sent; prior flight active or unresolved.");
+            MarkDiagnosticAlert();
+            ShowControlShout(Iec61850ControlShout.FromLocalRejection(
+                "another control flight is active or unresolved. Verify actual IED status before retrying"));
+        }
+        catch (TimeoutException ex)
+        {
+            signal.ControlLastResult =
+                "Control outcome UNKNOWN — MMS flight exceeded deadline. " +
+                "Verify IED process state and reconnect before another command.";
+            AddLog("ERROR", device.Name,
+                $"CONTROL_UI_TIMEOUT: {signal.ObjectReference}; {ex.Message}");
+            SetStatus($"{device.Name}: {signal.Name} control outcome UNKNOWN; check Diagnostics.");
+            MarkDiagnosticAlert();
+            ShowControlShout(Iec61850ControlShout.FromLocalRejection(
+                "Control timed out with UNKNOWN wire outcome. Verify the IED position and reconnect; do not blindly retry"));
         }
         catch (Exception ex)
         {

Services/Iec61850ControlFlightAdmission.cs

@@ -0,0 +1,62 @@
+using System.Threading;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Atomic association-wide admission for one IEC 61850 control flight.
+/// Quarantine is sticky for this session after an uncertain wire outcome.
+/// This is ownership only: no value ledger, MMS protocol or second transport.
+/// </summary>
+public static class Iec61850ControlFlightAdmission
+{
+    public static bool IsUnavailable(ref int active, ref int quarantine)
+        => Volatile.Read(ref active) != 0 || Volatile.Read(ref quarantine) != 0;
+
+    public static bool TryEnter(ref int active, ref int quarantine)
+    {
+        if (Volatile.Read(ref quarantine) != 0 ||
+            Interlocked.CompareExchange(ref active, 1, 0) != 0)
+            return false;
+        if (Volatile.Read(ref quarantine) == 0) return true;
+        Interlocked.Exchange(ref active, 0);
+        return false;
+    }
+
+    /// <summary>
+    /// Bounds only the caller's wait, never the actual native lifetime.
+    /// An unresolved native operation remains owned by its session until its
+    /// own Task finishes; the caller must retain admission until then.
+    /// </summary>
+    public static async Task<T> WaitForNativeAsync<T>(
+        Task<T> nativeFlight, TimeSpan deadline, CancellationToken waitCancellation,
+        Action quarantine, Action cancelNative)
+    {
+        ArgumentNullException.ThrowIfNull(nativeFlight);
+        ArgumentNullException.ThrowIfNull(quarantine);
+        ArgumentNullException.ThrowIfNull(cancelNative);
+        try
+        {
+            return await nativeFlight.WaitAsync(deadline, waitCancellation).ConfigureAwait(false);
+        }
+        catch (TimeoutException)
+        {
+            quarantine();
+            cancelNative();
+            throw;
+        }
+        catch (OperationCanceledException)
+        {
+            // Native cancellation may occur *after* a Write/Operate reached
+            // the wire. A completed canceled Task is not proof of NotSent.
+            quarantine();
+            cancelNative();
+            throw;
+        }
+    }
+
+    public static void Quarantine(ref int quarantine)
+        => Interlocked.Exchange(ref quarantine, 1);
+
+    public static void Release(ref int active)
+        => Interlocked.Exchange(ref active, 0);
+}