[mottihoresh]

Docs PR B of the 2026-10-27 audit. PR #403 fixed the specs (FirmwarePlan, TechSpec and the decision log). This PR fixes the published MkDocs pages. Every claim below was checked against the code on main; the spec was only used as a guide.

Docs only: no firmware, no frame or reporting changes.

Changes, with the code each one was checked against

Page	Was	Now (truth)
architecture/can-bus.md priority	every frame outranks the sim; "the cockpit never waits"	Arbitration only orders frames between boards. Each board has one in-order TX ring (CANProtocol.cpp:148-158), so the bridge's HB_0/SYNC_REQ wait behind CTRL_BCAST frames queued before them. The size of that wait is marked unmeasured.
can-bus.md output catch-up	"a fresh DCS-BIOS update arrives within ~50 ms"	A value that changed comes on the next DCS-BIOS frame; one that didn't comes only with autosync, every few seconds. Late catch-up is accepted. SYNC_REQ asks for inputs only (PanelGroup.cpp:109-114).
can-bus.md TX overflow	CTRL_BCAST coalesces; drops bump a "diagnostic counter"	Nothing is coalesced (CANProtocol.cpp:433-435, about a fifth). A full ring drops the new frame, and txDropCount() counts it on the board only. It is not reported over the bus.
can-bus.md batch deadline	two loops	A node still flushes within two loops. The bridge's CTRL_BCAST also holds at least 2 ms (CANProtocol.cpp:51, :412).
guides/bring-up.md step 4	"PanelBridge broadcasts SYNC_REQ"	The node sends its state + READY at boot. When the bridge first sees it, it syncs that node alone (PanelBridge.cpp:505/508/636).
guides/bring-up.md	(none)	New section: "Recovering from a power cut during an update", so #380 can link to it. It covers the Gateway's own retries (an update may finish by itself, Uploader.cpp:28-33,211-215,483-485), a cut before the erase (old firmware) or after the commit (new firmware), and red + green blinking together (waiting in the bootloader), in which case re-run the update from SkyHawkClient. Source: 12-bootloader.md (commit-last; APP_INVALID) and Bootloader/src/main.cpp:572-573.
firmware/bootloader.md	firmware "starts within a few milliseconds"	Starts a fraction of a second later, because of the 200 ms catch window (BootProtocol.h:189, main.cpp:583). Footprint added: about 3.7 KB, roughly 400 B free. The page now links to the recovery recipe. The #404 zip wording is untouched.
firmware/compatibility.md	"not reported until its next restart"	A board's resync READY carries its version (CANProtocol.cpp:357, PanelBridge.cpp:620-631), so a board that started before the Gateway is still reported. 0xFF04 (forget node, NodeStatus.h:46) is added to the PC-side row and 0xFF02 (bridge enter-bootloader, BootProtocol.h:181) to the Gateway-link row.
guides/new-control-type.md	forceReport() "send the current state"	Sends state only. A control with no state of its own sends nothing, never a step or TOGGLE (PanelGroup.h:85-94, #394).
firmware/build-flags.md	32 flags	63 flags. Added: CAN_TX_RING_SIZE 64/16 and CAN_RX_RING_SIZE 128/8 (CANProtocol.cpp:37/43), OSH_BOOT_BRIDGE, PDU_PIN_*, DIMMER_TEST, SWITCHWITHCOVER_TEST, I2C_TEST_SCL/SDA. Recipe counts are now 28 set / 53 read. The seam paragraph is corrected, and headings no longer carry counts, so their anchors stay stable.
hardware/base-boards.md (+ _source)	"neither can back-feed the other"	Measured (#290, 2026-10-27): no back-feed from the powered bridge into the unpowered RP2040 through the UART, even at 0.2.0's 33 Ω (rev 0.2.1 uses 1 kΩ). The reverse direction and the 12 V path are not measured. Detail is in _source.

Checks

• python3 tools/docs-drift/check_doc_refs.py: OK, 38 citations.
• mkdocs build -f docs/mkdocs.yml: exit 0. The only warning comes from a mkdoxy-generated docs/api/ anonymous-enum anchor and is not from this PR. The new anchors resolve.

BEGIN_COMMIT_OVERRIDE
docs(can-bus): bridge frames queue behind CTRL_BCAST; no coalescing; output catch-up is next frame or autosync; drops counted on the board only
docs(bring-up): per-node SYNC flow; power-cut recovery recipe
docs(bootloader): 200 ms catch window at every boot; footprint
docs(compatibility): name each reserved export address by its owning constant, 0xFF02/0xFF04 included; a board running before the Gateway still reports its version
docs(controls): forceReport sends state only
docs(build-flags): inventory matches the 63 flags the code reads and sets
docs(hardware): Gateway UART back-feed measured — none into the unpowered RP2040; reverse direction and 12 V path still open (#290)
END_COMMIT_OVERRIDE

[github-actions]

📝 Docs site may need an update

This PR touches files the docs site is built from. Before merging,
confirm the published pages still match:

• New hardware (panel / PCB / CAD) has a matching page under docs/
• Changed design decisions are reflected on the relevant page
  (e.g. architecture/design-decisions.md, the hardware reference)
• No page now contradicts docs/_source/ or hardware-standards.md
• Structured tables (NODE_IDs, pinouts) are transcluded, not retyped

Backstop: the weekly docs-drift review. Ignore docs/api/ (auto-generated).