# Ticket: Quarantine BOT session after missing CSW

Status: complete
Type: ticket
Updated: 2026-08-01
Next Action: retain the verified source candidate; if representative target regression is separately authorized, the srv-rpi00.local qualification app coordinates it after readiness and exact-bundle import—do not change Controller B from this workspace
Parent: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Problem

After a submitted Bulk-IN CSW request times out, the blocking USBX BOT
transport aborts that host request and returns `UX_TRANSFER_TIMEOUT`, but the
same mounted application session can issue another SCSI command and therefore
another CBW. USB Mass Storage Bulk-Only Transport 1.0 section 3.4 forbids a
new CBW until the CSW for the outstanding CBW has been received. No received
CSW or Mass Storage Reset establishes that boundary after this timeout.

T00 exposed the gap but does not define the correction. Its root-cause spike
remains closed as documented/no-action, and this ticket neither explains the
missing CSW nor creates a T00-specific exception.

## Expected Behavior

The first CSW wait timeout quarantines that storage-class BOT session. Every
later transport call for the same session returns without submitting a CBW.
The application withdraws the published FileX pointers and waits for a class
detach and subsequent new attachment. The correction adds no automatic retry,
reset, delay, remount, command replay, HCD change, SSP migration, or device
identity rule.

## Acceptance Criteria

- [x] A submitted CSW request that times out marks its storage
  session quarantined before returning `UX_TRANSFER_TIMEOUT`.
- [x] A quarantined session rejects subsequent transport calls before the CBW
  transfer request and records the blocked-CBW count.
- [x] Application publication is invalidated without returning the same
  attached instance to deferred FileX handoff.
- [x] Only a storage-class detach followed by activation clears quarantine.
- [x] Source checks and the scoped diff prove no retry, reset, delay, replay, HCD patch, or
  VID/PID/device rule was introduced by this correction.
- [x] Deterministic model coverage proves missing-CSW quarantine, blocked
  follow-on READ/WRITE commands, and detach/new-attachment recovery.
- [x] Existing USB workflow and transaction-inventory checks pass.
- [x] Canonical managed Debug and Release rebuilds pass without programming or
  otherwise changing Controller B.
- [x] The project map and canonical USB lifecycle document distinguish this
  general session-safety correction from the closed T00 root-cause spike.

## Verification

Run `script/check-usb-bot-session-quarantine.ps1`,
`script/check-usb-mass-storage-workflows.ps1`, and
`script/check-usb-transaction-inventory.ps1`, then perform canonical managed
Debug and Release rebuilds. Representative target regression remains a later,
separately authorized gate: both controllers, the established cross-device
matrix, READ and WRITE shapes, normal detach/reattach, malformed-CSW recovery,
and deterministic missing-CSW injection. This ship request explicitly excludes
Controller B and does not reopen the T00 root-cause campaign.

Completed verification and exact build hashes are recorded in
`work/evidence/usb-bot-missing-csw-session-quarantine-source-build-20260801.md`.
