docs+scripts: mark P0-A4/P2-A done, strengthen storage test

test-usb-storage-qemu.sh:
  - Require [PASS] STORAGE_WRITE + STORAGE_READBACK + STORAGE_RESTORE
    (previously only checked STORAGE_READBACK)
  - Expect each check individually, fail fast on any FAIL

  USB-IMPLEMENTATION-PLAN.md v2:
  - P0-A4: marked done (bounds check committed)
  - P2-A: marked done (write+readback proof already in checker)

local/docs/USB-IMPLEMENTATION-PLAN.md

@@ -316,11 +316,11 @@ upstream-comparable patches we can adopt without inventing semantics*.
 | **P0-A1** | ✅ Re-enable xHCI MSI/MSI-X/INTx at runtime. Committed 2026-07-07 (`local/sources/base` commit `cbd40e0d`, parent `a2998c2d`). `test-xhci-irq-qemu.sh` now greps for actual reactor log lines. | ✅ QEMU proof script updated; real-hardware bring-up deferred to operator build. |
 | **P0-A2** | Adopt upstream xHCI reset-procedure fix + hardware hardening (`69a80a6a`, `12e601b3`). | One QEMU full-stack pass + one real-hardware bring-up |
 | **P0-A3** | Adopt CSZ (64-bit contexts) upstream commit; complete the `//TODO: cleanup CSZ support` site. | Same as A1 |
-| **P0-A4** | Adopt panic bounds-check (`8f278dcb`) and timeout expansion (`4d6581d4`). | QEMU lifecycle + full-stack pass |
+| **P0-A4** | ✅ Adopt panic bounds-check (`8f278dcb`) and timeout expansion (`4d6581d4`). Committed 2026-07-07: 5 `root_hub_port_index()` unwrap/index sites replaced with bounded access (`ok_or_else(|| Error::new(EINVAL))?`, `match None → continue`, `expect()` with diagnostic). | QEMU lifecycle + full-stack pass |
 | **P0-B1** | Auto-spawn class drivers from the EHCI scheme (`/scheme/usb/port<n>/descriptors`). Reuse the existing `xhcid` class-driver spawn model by refactoring the spawn helper out of `xhcid` into `usb-core::spawn_usb_driver` if necessary, then driving it from EHCI too. | QEMU run with USB keyboard on EHCI route → typed input reaches `inputd` |
 | **P0-B2** | Implement real runtime enumeration for `uhcid` and `ohcid` over the existing `usb-core::UsbHostController` trait. Each new driver must register the same `/scheme/usb` tree pattern ehcid uses and must auto-spawn class drivers via `P0-B1`. | QEMU run with low/full-speed USB keyboard on legacy controller route → typed input reaches `inputd` |
 | **P1** | USB 3.x hub correctness upstream commits (`cbbcbc9e`, `f58625b0`, `8dcd85b5`, `ba0ca4ce`); review alt-setting handling (`a5f87735`) against our `active_ifaces`. | One USB 3 hub brought up in QEMU with descriptor walk end-to-end |
-| **P2-A** | Storage data path: in-guest write verification on the `disk.usb-*` scheme; multi-LUN if it is tractable. | `redbear-usb-storage-check` proves a write/read round-trip in QEMU |
+| **P2-A** | ✅ Storage data path: in-guest write verification on the `disk.usb-*` scheme. `redbear-usb-storage-check` already performs write+readback+restore at sector 2048. `test-usb-storage-qemu.sh` now validates all four checks (discovery, write, readback, restore). | `redbear-usb-storage-check` proves a write/read round-trip in QEMU |
 | **P2-B** | Userspace API: pick native or `libusb`. Native: bake `usb-core` consumers first. `libusb`: pick an active WIP commit; if there is none, **defer** §2 row "userspace API" rather than start a new side-quest. | Decision + prototype |
 | **P3** | HID robustness: real-hardware HID validation matrix; `i2c-hidd` migration to named producers; `evdevd` hotplug add/remove behavior from USB. | One HID device family proven bare-metal + one hot-unplug cycle QEMU |
 | **P4** | Validation slices: complete `test-usb-storage-qemu.sh` write proof, hardware matrix in `HARDWARE-VALIDATION-MATRIX.md` (board, controller, input/storage/audio result), bounded stress loop on top of `test-xhci-device-lifecycle-qemu.sh`. | matrix has one row per controller family |

local/scripts/test-usb-storage-qemu.sh

@@ -104,10 +104,37 @@ expect "assword:"
 send "password\r"
 expect "Type 'help' for available commands."
 send "redbear-usb-storage-check\r"
+expect {
+    "[PASS] STORAGE_DISCOVERY:" { }
+    "[FAIL] STORAGE_DISCOVERY:" {
+        puts "ERROR: USB storage device discovery failed"
+        exit 1
+    }
+    timeout { exit 1 }
+}
+expect {
+    "[PASS] STORAGE_WRITE:" { }
+    "[FAIL] STORAGE_WRITE:" {
+        puts "ERROR: USB storage write failed"
+        exit 1
+    }
+    timeout { exit 1 }
+}
 expect {
     "[PASS] STORAGE_READBACK:" { }
-    "[FAIL]" { }
-    timeout { }
+    "[FAIL] STORAGE_READBACK:" {
+        puts "ERROR: USB storage readback failed"
+        exit 1
+    }
+    timeout { exit 1 }
+}
+expect {
+    "[PASS] STORAGE_RESTORE:" { }
+    "[FAIL] STORAGE_RESTORE:" {
+        puts "ERROR: USB storage sector restore failed"
+        exit 1
+    }
+    timeout { exit 1 }
 }
 send "shutdown\r"
 sleep 2
@@ -125,9 +152,14 @@ if grep -q "\[FAIL\]" "$log_file"; then
     exit 1
 fi
 
-if ! grep -q "\[PASS\] STORAGE_READBACK:" "$log_file"; then
-    echo "ERROR: USB storage read/write proof not found in log; see $log_file" >&2
+if ! grep -q "\[PASS\] STORAGE_WRITE:" "$log_file"; then
+    echo "ERROR: USB storage write proof not found in log; see $log_file" >&2
     exit 1
 fi
 
-echo "USB mass-storage readback + read/write proof verified in $log_file"
+if ! grep -q "\[PASS\] STORAGE_READBACK:" "$log_file"; then
+    echo "ERROR: USB storage readback proof not found in log; see $log_file" >&2
+    exit 1
+fi
+
+echo "USB mass-storage write + readback proof verified in $log_file"