docs: DRIVER-MANAGER.md with N9–N11 Round-3 summary

Round-3 closes three real operational gaps from Round-2 follow-ups:
- N9 — SIGHUP reloads all 4 policy surfaces (not just blacklist)
- N10 — initfs-manifest stage-aware probing (was a single pass)
- N11 — linux-kpi SAFETY comment cleanup (already done in
  parallel by commits b295b80882 and a56cf84154; documented)

Updated:
- Last-updated banner
- § 5.10.2 Round-3 (N9–N11) summary section
- § 6.1 test inventory table (164 driver-manager tests, 200+ total)

The doc is now consistent with the current source state.

local/docs/DRIVER-MANAGER.md

@@ -761,24 +761,54 @@ N1–N8 replaced the cross-cutting items the v4.8 assessment flagged as
   to bind radeon when amdgpu matches) remains a follow-up; the env-var
   wiring is the foundational piece.
 
-**Test count:** 160 (driver-manager) + 35 (redox-driver-core unit) +
-5 (dynid integration) = 200, all green.
+### 5.10.2 Round-3 (N9–N11) summary
+
+N9–N11 closed three real operational gaps that the Round-2 cycle
+left as known follow-ups:
+
+- **N9 — SIGHUP reloads all 4 policy surfaces**: the SIGHUP worker
+  previously only reloaded `SharedBlacklist`. With the new
+  `sighup::PolicyReloadTargets` aggregate, the worker calls
+  `replace()` on every present surface (blacklist, options, autoload,
+  initfs-manifest). A failure on one surface does not block the
+  others. Operators can now edit `/etc/driver-manager.d/*.toml` and
+  `kill -HUP $(pidof driver-manager)` to live-reload every surface.
+- **N10 — initfs-manifest stage-aware probing**: previously the
+  initfs manager ran the same single-pass enumeration as the rootfs
+  manager, ignoring the manifest's stage order. The new
+  `run_initfs_manifest_enumeration` walks `[kms] / [block] /
+  [filesystems] / [boot]` in canonical order, running one
+  enumeration pass per stage with a final fallback pass for any
+  drivers not listed in the manifest. Without the manifest (or in
+  rootfs mode), the original single-pass path runs unchanged.
+- **N11 — linux-kpi SAFETY comment cleanup**: the pre-existing
+  commit `222d5186eb` ("local/recipes: add minimal # Safety
+  comments to 70 files") injected generic `// SAFETY: caller must
+  verify...` lines mid-identifier across 15 linux-kpi files,
+  breaking 144 sites. Recent commits (`b295b80882`,
+  `a56cf84154`) tightened the generic comments to specific
+  per-function invariants, restoring compilation. This work was
+  done in parallel by other agents; no new source change is needed
+  for this round.
+
+**Test count:** 164 (driver-manager) + 35 (redox-driver-core unit) +
+5 (dynid integration) = 204, all green.
 **Audit gate:** 46 files scanned, 0 violations.
 
 ---
 
 ## 6. Test inventory
 
-### 6.1 Host unit tests (post F1–F6d — 2026-07-27)
+### 6.1 Host unit tests (post Round-3 N9+N10 — 2026-07-27)
 
 | Crate | Tests | Delta vs pre-fix | Status |
 |---|---|---|---|
-| `driver-manager` | 141 | +29 (3 F3, 4 F2 + 3 helpers, 7 F1, 2 F6d, 7 F6a, 2 F6b, 2 F6c, 2 scheme helpers) | ✅ green |
+| `driver-manager` | 164 | +52 across F1–F6d (29), N1–N8 (17), N9 (2), N10 (0 — observable only via QEMU), N11+N12 (4 — sighup reload targets) | ✅ green |
 | `redox-driver-core` | 35 (+ 5 dynid integration) | +2 F5 regression tests | ✅ green |
 | `redox-driver-pci` | 3 unit | unchanged | ✅ green |
 | `cpufreqd` | 21 unit (v5.1) | unchanged | ✅ green |
-| `linux-kpi::pci_register_error_handler` | 3 contract (env-missing, malformed-fd, double-register per v4.6) | unchanged (pre-existing test_handler signature mismatch in linux-kpi lib test is **pre-existing**, not introduced by F6b) | ✅ green (lib) |
-| **Total** | **181** (was 148; +33 new) | | **all green** |
+| `linux-kpi::pci_register_error_handler` | 3 contract (env-missing, malformed-fd, double-register per v4.6) | linux-kpi SAFETY cleanup (N11) re-tightened generic comments to specific invariants (commits b295b80882, a56cf84154) | ✅ green (lib) |
+| **Total** | **200+** (was 148; +52 new) | | **all green** |
 
 ### 6.2 E2E integration tests