Remediate the 2026-09-03 feature-test findings

plugins/usb/api/routes.py

@@ -993,16 +993,30 @@ def kiosk_checkout():
                     'Badge not recognized - see IT to check this device out',
                     http_code=422)
 
+            # Claim the device FIRST, and let the status transition be the
+            # guard: the read-then-write above cannot stop two scans of the
+            # same drive that interleave, because both read 'available'. With
+            # the status in the WHERE clause the second UPDATE matches no row
+            # and there is no log entry to undo.
+            cur.execute(
+                'UPDATE devices SET status = %s '
+                'WHERE device_id = %s AND status <> %s',
+                (_STATUS_CHECKED_OUT, device_id, _STATUS_CHECKED_OUT),
+            )
+            if not cur.rowcount:
+                holder = _kiosk_holder_name(cur, device_id)
+                conn.rollback()
+                return error_response(
+                    ErrorCodes.CONFLICT,
+                    'That device is already checked out{}'.format(
+                        ' to {}'.format(holder) if holder else ''),
+                    http_code=409)
             cur.execute(
                 'INSERT INTO checkinoutlog '
                 '(badge_number, device_id, action, timestamp, locker_location) '
                 "VALUES (%s, %s, 'check-out', %s, %s)",
                 (badge, device_id, _now(), device.get('locker_location')),
             )
-            cur.execute(
-                'UPDATE devices SET status = %s WHERE device_id = %s',
-                (_STATUS_CHECKED_OUT, device_id),
-            )
         conn.commit()
     finally:
         conn.close()