bug(cua-driver/windows): timed-out UIA Invoke can fall through to a second input delivery

[chipsfromhell]

Scope and confidence

Source-level duplicate-delivery risk, not a reproduced duplicate click. Rechecked main 7e89120c062476a97bf3403363b3087a0cf0a74c immediately before filing. Targeted issue/PR searches found no matching Invoke-timeout report.

Code path

1. try_invoke_in_window_at_point uses a deadline and maps its error to false with unwrap_or(false).
2. The worker checks cancellation then calls Invoke. Cancellation cannot revoke an already-entered provider call, and check-then-call is not an atomic timeout/action-entry boundary.
3. The click caller treats false as “UIA did not land” and proceeds to injection/message delivery.

Possible trajectory: Invoke starts and opens/awaits a modal without returning; deadline expires; caller receives false and issues fallback input while the first action may still be executing. A single external tool call can therefore attempt both paths. Provider errors after action entry can also be uncertain, rather than definite misses.

Expected behaviour

Distinguish definite pre-action miss/busy, completed action, and action may have started/outcome unknown. Do not send fallback input for the last disposition. Preserve legitimate fallback for definite pre-action misses and retain exact target/foreground/owned-modal safeguards.

Suggested deterministic regression

Use barriers around action entry, not timing guesses:

• Deadline before entry prevents a late Invoke.
• Deadline after entry returns unknown and sends zero fallback inputs.
• A genuine no-match still permits the intended fallback.
• Apply equivalent disposition handling to action-bearing Expand paths.

Runtime context, not causal proof

Disposable Windows WinForms/OpenFileDialog testing showed UIA timeouts and a late-observed chooser after an unverifiable click result. No duplicate was observed, no action latency was measured, and these observations do not prove this static path caused the symptom. Installed driver reports 0.23.2; running elevated daemon identity was not established. No patched binary was built or tested.

Related but distinct: #3033 and #3345 address screenshot survival when UIA observation times out, not action-delivery uncertainty. No request to weaken input safety or increase privileges.