# USB BOT missing-CSW session quarantine source/build evidence

Date: 2026-08-01
Result: PASS for source implementation, deterministic checks, and canonical
managed Debug/Release builds; target deployment and regression not performed

## Scope and disposition

This evidence records the general BOT session-safety correction accepted after
the T00 review. It does not reopen the T00 root-cause spike, explain the absent
CSW, acquire analyzer evidence, introduce a device exception, or change
Controller B. The frozen Controller B Release baseline remains `ca6f573a`.

USB Mass Storage Bulk-Only Transport 1.0 section 3.4 forbids transferring a new
CBW until the CSW for the outstanding CBW has been received. After a submitted
CSW Bulk-IN request times out, the implementation now:

1. records and quarantines the current storage-class BOT session before
   returning `UX_TRANSFER_TIMEOUT`;
2. rejects every later transport call for that session before CBW preparation
   or submission;
3. withdraws the application FileX publication without remounting the same
   attached instance; and
4. clears the quarantine only after a storage-class detach followed by a new
   activation.

No automatic retry, reset, delay, command replay, SSP migration, HCD patch,
VID/PID rule, specimen rule, or Controller-driven VBUS action was added.

## Deterministic verification

The following commands passed:

```text
script/check-usb-bot-session-quarantine.ps1
python script/test_usb_bot_session_quarantine.py
script/check-usb-mass-storage-workflows.ps1
script/check-usb-transaction-inventory.ps1
```

The model executed three cases: follow-on READ/WRITE commands remain blocked
without replay, activation without detach does not clear quarantine, and
detach/new activation begins a fresh session.

## Canonical managed builds

Both repository-managed clean rebuilds passed on 2026-08-01:

```text
script/vscode-e2-build.ps1 -Action Rebuild -Configuration Debug -Jobs 8
script/vscode-e2-build.ps1 -Action Rebuild -Configuration Release -Jobs 8
```

Artifact SHA-256 values:

| Configuration | Artifact | SHA-256 |
| --- | --- | --- |
| Debug | `Debug/7520553_SMI_FW.elf` | `888AA9A9A444FBF09BDC3AB0368FC9D99D0512CBC14F7EA296538AE38BCDEAE6` |
| Debug | `Debug/7520553_SMI_FW.srec` | `52A479F9C216C9E23ACA8D3264AA965FD1631FA0AF4E1194200E288E404FF353` |
| Release | `Release/7520553_SMI_FW.elf` | `8B1E627BEDFA8B8D9A7BAD696C3F92CDBE1E93377B5E16EF68588B24F81AC2EF` |
| Release | `Release/7520553_SMI_FW.srec` | `5BE1C0919BD08B1F812F4E25618D543A097BE2FB3FE4E69A4A3A8DA2F4B161CA` |

## Remaining representative gate

No target was programmed or contacted. A later, separately authorized
representative regression must cover both controllers, the established
cross-device matrix, READ and WRITE command shapes, ordinary detach/reattach,
malformed-CSW reset recovery, and deterministic missing-CSW injection. This
gate is intentionally not converted into a T00 campaign and must preserve the
rule against specimen-specific behavior.
