diff --git a/apps/kubevirt-vms/ci1.yaml b/apps/kubevirt-vms/ci1.yaml
index 2a1b7e3..2575aa4 100644
--- a/apps/kubevirt-vms/ci1.yaml
+++ b/apps/kubevirt-vms/ci1.yaml
@@ -396,10 +396,15 @@ spec:
             # Confirmed via debug pod: PVC content IS a real bootable ISO9660
             # (file: "ISO 9660 CD-ROM filesystem data ... (bootable)"), so the
             # only bug was boot priority.
+            # 2026-05-08 PM: cdrom bus flipped sata→scsi for windows-iso to address
+            # the OVMF SATA-CDROM read timeout (`BdsDxe: failed to start Boot0001 ...
+            # Time out`). The SCSI CDROM uses virtio-scsi controller which has a
+            # longer read window and works cleanly on Filesystem-backed PVCs.
+            # See diagnostic chain in HANDOFF.md / CODEX-STATUS.md "OPEN — ci1".
             - name: windows-iso
               bootOrder: 1
               cdrom:
-                bus: sata
+                bus: scsi
             - name: rootdisk
               bootOrder: 2
               disk:
@@ -430,17 +435,25 @@ spec:
           persistentVolumeClaim:
             claimName: ci1-rootdisk
         - name: windows-iso
-          # Path B (2026-05-08): mount ISO from Synology NFS instead of
-          # Longhorn Filesystem PVC. The Filesystem-PVC path was confirmed to
-          # contain a valid bootable ISO9660 image but caused OVMF's
-          # SATA-CDROM read window to time out:
-          #   BdsDxe: failed to start Boot0001 ... Time out
-          # Block-mode DataVolume was attempted as Path A but blocked by CDI
-          # v1.65.0's upload pod capability drop. NFS-mounted ISO bypasses
-          # both issues. See win2025-iso-nfs-pv.yaml header for full rationale
-          # and Synology layout.
+          # 2026-05-08 PM: REVERTED from NFS Path B back to the original CDI
+          # Longhorn Filesystem PVC. NFS Path B (commit fc2aca0) failed at the
+          # storage layer because the Synology export `/volume1/ISOs` denies
+          # non-root client UIDs at the directory level (qemu uid 107 cannot
+          # `ls /iso/` even with file mode 0777). Confirmed via uid-107 +
+          # uid-0 busybox probe pods on rke2-agent2 — same export-only-root
+          # pattern as `/volume1/kubernetes` documented in
+          # `feedback_synology_nfs_kubernetes_export_root_only`. Memory:
+          # `feedback_synology_iso_export_root_only_uid_107_denied.md`.
+          #
+          # The Longhorn PVC `windows-server-2025-iso` (CDI Filesystem mode,
+          # 10Gi) was confirmed to contain valid ISO bytes that uid 107 CAN
+          # read (mode 0660 root:107). The OVMF SATA-CDROM read timeout from
+          # the original Path A is now addressed by the `bus: scsi` swap on
+          # the disks block above. The NFS PVC + PV are RETAINED on disk so
+          # the Path B state is recoverable; they can be pruned in a
+          # follow-up commit once SCSI boot is proven.
           persistentVolumeClaim:
-            claimName: windows-server-2025-iso-nfs
+            claimName: windows-server-2025-iso
         - name: virtio-drivers
           containerDisk:
             # Pinned to v1.8.2 (latest stable as of 2026-05-08).