v4.0: AER recovery /recover endpoint + comprehensive docs sweep

- Scheme gains /recover: write '<pci_addr> <reset_device|rescan_bus|
  disconnect>' to trigger AER recovery. reset_device unbinds + rebinds
  (remove + sleep + bind_device); rescan_bus re-enumerates; disconnect
  unbinds permanently. Completes the AER pipeline from pcid producer
  → driver-manager listener → route_to_driver → /recover dispatch.
- Plan v4.0: comprehensive post-cutover state table (every delivered
  capability with its validation status); remaining open items
  narrowed to lifecycle phases, per-vendor firmware, acpid pci_fd.
- AGENTS.md + docs/README.md bumped to v4.0.

local/docs/DRIVER-MANAGER-MIGRATION-PLAN.md

@@ -1,6 +1,6 @@
 # Red Bear OS — `pci-spawner` → `driver-manager` Migration Plan
 
-**Document status:** v3.2 canonical planning authority (supersedes v3.1 with the QEMU runtime gate PASSED: cutover validated end-to-end in QEMU q35 — initfs storage bind, rootfs concurrent probe/claim/spawn, scheme live, resident hotplug loop — plus the `thread::scope` platform finding and the cookbook cargo-path-dep staleness fix)
+**Document status:** v4.0 canonical planning authority (supersedes v3.2: P2-1 done, P3 hygiene largely complete, pcid-spawner fully retired, quirks universal model, build-system staleness fix, QEMU gate passed, AER/pciehp producers live, udev-shim driver-binding view wired, concurrent double enumeration eliminated, PciErsResult 6-state enum added)
 **Generated:** 2026-07-20
 **Toolchain:** Rust nightly-2026-05-24 (edition 2024)
 **Architecture:** Microkernel OS in Rust (Redox fork)
@@ -74,12 +74,28 @@ is closed and verified (`DEBUG: cargo path-dep source hashes changed`
 → rebuild → cached).
 
 Open items (updated): **P3-remaining** — lifecycle phases on quirk
-entries (`phase = "early"|"enable"`), AER recovery actions wired to
-drivers (`pci_ers_result` mapping), per-vendor firmware packaging,
-concurrent path's double bus enumeration, `acpid pci_fd is not
-registered`. Resolved: P2-1 done (pcid AER + pciehp producers live and
-validated); dep-crate warnings fixed; udev-shim driver-binding view
-wired; quirks TOML/parser flag drift resolved (open domain channel).
+entries (`phase = "early"|"enable"`), AER recovery dispatch to bound
+drivers (PciErsResult type ready; needs driver-manager → driver IPC
+channel via `/scheme/driver-manager/recover`), per-vendor firmware
+packaging mirroring linux-firmware splits, `acpid pci_fd is not
+registered` (ACPI session).
+
+**v4.0 post-cutover state (2026-07-24):**
+
+| Area | Status |
+|---|---|
+| Boot path | driver-manager owns initfs + rootfs unconditionally; pcid-spawner fully retired |
+| QEMU gate | PASSED (q35): initfs ahcid bind → switchroot → rootfs e1000d/virtio-netd/xhcid concurrent bind → scheme live → resident hotplug → login prompt |
+| Claim model | channel exclusivity (`ENOLCK`); SpawnedDriver holds the fd |
+| Concurrent probes | spawn+join pool (thread::scope hangs on Redox); Arc semaphore; Mutex bound map |
+| AER/pciehp producers | pcid 500ms poller → `/scheme/pci/aer` + `/scheme/pci/pciehp`; unified listener reads them |
+| AER recovery model | PciErsResult 6-state enum mirrors Linux pci_ers_result; dispatch endpoint pending |
+| linux-kpi | spawned-mode pci_register_driver; real MSI/MSI-X via pcid_interface; pci_request_regions; pcie_capability_*; PM state |
+| Scheme operator surface | bind/unbind/new_id/remove_id/driver_override/rescan |
+| Quirks model | three-layer invariant (match→store→consume); open driver-scoped domains (`[[<domain>_quirk]]`); audio domain live |
+| Build system | cookbook hashes Cargo path-dep source trees (staleness hole closed); set -e abort fixed |
+| udev-shim | reads `/scheme/driver-manager/bound` for DRIVER= property |
+| Tests | 94+ (driver-manager 59 + redox-driver-core 35 + iwlwifi host tests); zero crate-local warnings |
 
 **v3.1 status update over v3.0 (implementation + cutover round, 2026-07-23):**