# Controller A USB durability diagnosis and fail-closed mitigation

Date: 2026-07-27

## Outcome (superseded)

Controller A assembly `1751136`, J-Link `69664082`, hardware variant `0`
cannot presently prove durable controller-to-USB writes. Controller-side
FileX readback, SCSI synchronize-cache, STOP, SCSI force-unit-access, and a
logical USBHS disconnect/remount all succeeded, but physical removal twice
discarded every newly published file. Independent Raspberry Pi inspection
found the FAT volume clean and unchanged.

This was the correct conclusion for the enlarged-transport candidates tested
at that point, but it is no longer current. A subsequent comparison with
`main` identified enlarged shared USB transport limits as the regression.
The main-compatible candidate physically persisted the complete IMX on the
same controller class. See
`work/evidence/controller-a-usb-main-compatible-transport-20260727.md`.

A later schematic review and guarded five-second target diagnostic directly
proved that PB00/USBHS VBUSEN through TPS2051 U10 removes connector VBUS on
this Controller A display board. The illuminated stick went dark and then
freshly remounted. Therefore, the earlier inference that physical VBUS could
not be removed is also superseded. See
`work/evidence/controller-a-usb-vbus-electrical-proof-20260728.md`.

## Identity

- Controller SD protocol state: `6`
- CID valid: `1`
- representative-sector-read status: `1`
- manufacturer: SanDisk/WD, MID `0x03`
- OEM/application ID: `SD`
- product: `SS08G`, revision `8.0`
- serial: `2540634244`
- manufacturing date: `2024-05`
- raw CID: `035344535330384780976F0084018559`
- USB: PNY `071C49DE246A1F97`, label `A-CTRL-2`, UUID `8B67-9B27`

## Diagnosis

1. The original `P4_7` power-control comment was false: generated pin data
   configures it for RIIC, not GPIO.
2. The Synergy USBHS root-port power hooks were unsupported stubs. Implemented
   hooks produced disconnect/remount events, but Controller A did not remove
   physical stick power.
3. Exact-size fresh-session readback therefore remained inside the same
   powered device lifetime and was not removal durability evidence.
4. Setting SCSI WRITE force-unit-access did not change removed-media results.
5. The same stick and prior exact firmware passed Controller B hardware
   variant `1`, isolating the unresolved boundary to Controller A hardware or
   its USB VBUS/power path.

## Removed-media evidence

After both the USBHS-remount candidate and the FUA candidate, read-only
`fsck.fat -vn /dev/sda1` reported a clean volume with only four pre-run files
and 34 allocated clusters. The new IMX, PID, and HPT files were absent.

## Deployed mitigation

- S-record SHA-256:
  `A9CAC9532E15914A24DF31E57BC0B905C390A6125F0FA5E4F87FEBC779FBCD54`
- managed e2 build: pass
- static USB workflow check: pass
- HPT invariants: `35/35`
- program/verify/reset on Controller A: pass

Fail-closed runtime proof:

| Path | Result | USB writes |
| --- | --- | --- |
| IMX backup | `FX_IO_ERROR (0x90)`, progress `902` | 0 calls / 0 bytes |
| PID capture | durability result failed, `0x90` | 0 calls / 0 bytes |
| HPT CSV | reason USB I/O, `published=0`, phase `12`, `0x90` | 0 calls / 0 bytes |

The HPT request independently scanned 2,855 healthy records with zero
snapshot or requested-range gaps before publication was rejected.

## Corrective action (historical)

This hardware-first action was superseded by the main-compatible transport
result. Preserve it only as a fallback if PID or HPT physical persistence fails
with the conservative candidate.

## Generated evidence

Detailed captures are below
`work/evidence/hpt-log-store-circular-mirror/controller-a/usb-fresh-session-durability-20260727/`.
