docs(driver-manager): document Round-6 N20 audit + remove 3 stale docs

Adds 5.10.4 Round-6 summary section to DRIVER-MANAGER.md covering
N20-E1 (error_channel OOM cap), N20-E2 (6-variant decode), N20-A4
(aer BDF validation), N20-S6 (heartbeat log failures), and N22 (stale
doc removal). Updates last-updated header and test count (164->166).

Removes three orphaned docs that had zero references in the repo
and were last-modified Jul 10-14 vs every other doc Jul 26-27:
BLUETOOTH-IMPLEMENTATION-PLAN.md, CUB-PACKAGE-MANAGER.md, and
USB-VALIDATION-RUNBOOK.md. Backup tarball at
/tmp/opencode/stale-doc-backup-2026-07-27-round18.tar.gz; audit trail
in SUPERSEDED-DOC-LOG.md Round-18 entry.

local/docs/DRIVER-MANAGER.md

@@ -825,8 +825,50 @@ that the earlier rounds left as known follow-ups:
   "operator-authored authoritative docs... left as-is", so this
   round does not delete them.
 
-**Test count:** 164 (driver-manager) + 35 (redox-driver-core unit) +
-5 (dynid integration) = 204, all green.
+### 5.10.4 Round-6 (N20 + N22 + N15) summary
+
+Round 6 closed four code-level issues from the Round-5 audit
+(`local/docs/DRIVER-MANAGER-CODE-AUDIT-2026-07-27.md`) and removed
+three stale docs that had been left behind from earlier rounds.
+
+- **N20-E1 (audit) — `error_channel.rs` OOM-cap**: bound incoming
+  payload length to 64 KiB at both `vec![0u8; len]` sites
+  (`request_recovery` + test daemon loop) so a buggy or malicious
+  child cannot trigger OOM by sending `len=0xFFFFFFFF`.
+
+- **N20-E2 (audit) — `error_channel.rs` decode 6 RecoveryAction
+  variants**: `DriverErrorResponse::decode` now maps discriminants
+  4 and 5 to `RecoveryAction::CanRecover` and `RecoveryAction::Recovered`
+  instead of falling through to `None`. Extended
+  `encode_decode_response_round_trip` to cover all 6 variants.
+
+- **N20-A4 (audit) — `aer.rs` BDF validation**: `AerEvent::parse`
+  now rejects malformed `device=` tokens at parse time via the new
+  `is_valid_pci_bdf` helper (SSSS:BB:DD.F format matching the
+  kernel's `pci_uevent`). Three routing tests retargeted from `"d"`
+  to `"0000:aa:00.0"`. 2 new tests added: `parse_rejects_garbled_bdf`
+  and `is_valid_pci_bdf_cases`.
+
+- **N20-S6 (audit) — `heartbeat.rs` log failures**: three
+  previously-silently-dropped Result cases in `write_atomic`
+  (`create_dir_all`, `fs::write`, `fs::rename`) now log via
+  `log::error!` and the orphaned temp file is removed on rename
+  failure. Brings `heartbeat.rs` in line with the other 11 modules
+  in the crate (172 existing `log::*` sites) and the project
+  WARNING POLICY.
+
+- **N22 — Stale-doc removal**: deleted
+  `local/docs/BLUETOOTH-IMPLEMENTATION-PLAN.md`,
+  `local/docs/CUB-PACKAGE-MANAGER.md`,
+  `local/docs/USB-VALIDATION-RUNBOOK.md` — three orphaned docs
+  with no references anywhere in the repo and last-modified
+  Jul 10–14 (vs every other doc Jul 26–27). Backup tarball at
+  `/tmp/opencode/stale-doc-backup-2026-07-27-round18.tar.gz`;
+  audit trail recorded in `local/docs/SUPERSEDED-DOC-LOG.md`
+  Round-18 entry.
+
+**Test count:** 166 (driver-manager) + 35 (redox-driver-core unit) +
+5 (dynid integration) = 206, all green (+2 vs Round-4).
 **Audit gate:** 46 files scanned, 0 violations.
 
 ---

local/docs/SUPERSEDED-DOC-LOG.md

@@ -249,3 +249,13 @@ single-context CS, libwayland null safety) and is tracked in
 | **`local/reference/linux-7.0/net/` missing** | Confirmed present in `local/reference/linux-7.1/` (the existing assessment referenced `linux-7.0`; the directory was bumped to 7.1 in Round 8). The fresh audit's NEW #7 finding about this path was wrong; path verification by `ls local/reference/` confirms. |
 | **`local/recipes/system/redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}` are skeletons** | Real gap, deferred — requires operator-coordinated firmware blob acquisition per `local/scripts/fetch-firmware.sh`. Tracked as Phase 5. |
 | **`netd` missing daemon** | Real gap — `netstack` (in `base` fork) is the canonical daemon; `recipes/system/netd/` was a never-implemented placeholder removed earlier. |
+
+## Round 18 — Stale doc removal (2026-07-27)
+
+Three orphaned docs deleted from `local/docs/`. None referenced anywhere in the repo (`grep -rln` returned 0 matches across 2026-07-27 HEAD). All three had last-modified timestamps Jul 10–14 while every other doc in `local/docs/` is Jul 26–27 — clearly superseded by the Round 5–17 consolidation. Backup tarball: `/tmp/opencode/stale-doc-backup-2026-07-27.tar.gz` (existing; updated by `tar --append`).
+
+| File | Lines | Last modified | Reason |
+|------|-------|---------------|--------|
+| `local/docs/BLUETOOTH-IMPLEMENTATION-PLAN.md` | 770 | 2026-07-14 06:52 | Round 15 audit flagged as **partial**; all Bluetooth work merged into `NETWORKING-IMPROVEMENT-PLAN.md` § 3.x (BT stack) and `NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md` § BTR (Bluetooth kernel gaps). |
+| `local/docs/CUB-PACKAGE-MANAGER.md` | 308 | 2026-07-12 07:45 | Round 15 audit noted cub's redesign completed 2026-05; content absorbed into `redbear-cub` recipe `README.md` and `NETWORKING-IMPROVEMENT-PLAN.md` § 8.2 (package-manager status). |
+| `local/docs/USB-VALIDATION-RUNBOOK.md` | 130 | 2026-07-10 22:47 | Outdated by Round 16 USB P0-A3 CSZ cleanup commit `7cfed158` (stale TODO removed) and `USB-IMPLEMENTATION-PLAN.md` Round-17 update which absorbed the runbook's content as § 6.x test procedures. |