[JasonACT]

To make a stubborn USB stick go into RW mode:

umount -f /fs/usb0
slay devb-umass
devb-umass cam pnp blk cache=2m,auto=partition,automount=hd0@dos:/fs/usb0,rw dos exe=all

But.. Yeah, your flash chip looks cactus. The broken unit I got also doesn't keep files alive for very long (leave it on the shelf for a month and you will see corrupt files next time you boot). For that one, I deleted most of the files (but left the sym-links which are very small) and I use a mounted SD card with a sym-link in /packages pointing to /fs/sd0/factory where I've put all the files.

There are 3 copies of the first boot file-system (which is, as you say, read-only) and I can see it is loading the first ok (start of the log says a lot of 0xE8's which is, I think, it successfully correcting errors) without having to move onto the next copy or the third.

Your entire 2nd file-system (the read/write one) is gone though (won't mount, with a lot of non 0xE8 errors) and it will need to be reformatted. I don't recall if I posted about the format command here, but there is a command to do that (etfsctl) - there also appears to be a flag (-e) to do it when first mounted (looking at the usbUpdate.sh file in /proc/boot, fs-etfs-swsa_2048).

I've heard from others who have "copied" the BGA flash to a new one, but they had issues with the unit refusing to do the boot sequence once replaced. I never heard back if they worked out what went wrong though, so I would say adding a SD card is the best way forward. I posted an SD card driver here, but I think I've made some updates since - if you want to try this (it'll be a bit of work) and get to the point where your formatted & empty flash partition allows you to create some sym-links to the mounted SD card - then I'll post the latest files on github.

At the moment, I don't think you can make the unit any worse off, unless you attempt to write those 3 boot 'r/o' file-systems, which I did describe how to do here, but which you certainly do not need or want to do.