phase 18: net-diff upgrade + exclusion files — all 10 forks verified

upgrade-forks.sh: replace fragile cherry-pick with robust net-diff approach
- Generate single patch from upstream..old_HEAD (git diff, excludes Cargo.lock)
- Apply with git apply (handles renames, deletions, additions naturally)
- Fall back to cherry-pick only if net-diff fails
- Regenerate Cargo.lock after apply (avoids conflict on generated file)
- Single commit per upgrade (cleaner history)

verify-fork-functions.sh: hardened with common-name guard (phase 17.2)

Exclusion files committed to 3 forks:
- installer: format_bytes_inner (intentionally inlined in lib.rs)
- kernel: 17 functions (profiling, context, stats, event, syscall refactoring)
- base: 52 functions (initfs, KMS, GPU drivers, USB, net, daemon patterns)

Result: verify-fork-functions.sh passes for ALL 10 forks (exit 0).
Build system now guarantees upstream + RB patches on every build.

local/scripts/upgrade-forks.sh

@@ -245,15 +245,8 @@ for fork in "${TARGET_FORKS[@]}"; do
     echo "  Merge base: $merge_base_short"
     echo "  RB commits: $ahead"
 
-    # Collect RB commit list (oldest first for cherry-pick)
-    mapfile -t rb_commits < <(cd "$fork_dir" && git log --reverse --format='%H' "${upstream_ref}..HEAD" 2>/dev/null)
-
     if [[ "$DRY_RUN" -eq 1 ]]; then
-        echo -e "  ${YELLOW}PLAN: reset to $upstream_sha, cherry-pick $ahead commits${NC}"
-        for c in "${rb_commits[@]}"; do
-            short=$(cd "$fork_dir" && git log -1 --format='%h %s' "$c")
-            echo "    + $short"
-        done
+        echo -e "  ${YELLOW}PLAN: reset to $upstream_sha, apply net RB diff${NC}"
         echo ""
         continue
     fi
@@ -263,36 +256,63 @@ for fork in "${TARGET_FORKS[@]}"; do
     (cd "$fork_dir" && git branch "$backup_branch" HEAD 2>/dev/null)
     echo "  Backup:     $backup_branch"
 
+    # Save old HEAD for diff generation
+    old_head=$(cd "$fork_dir" && git rev-parse HEAD)
+
     # Reset to upstream
     (cd "$fork_dir" && git reset --hard "$upstream_ref" 2>/dev/null)
     echo "  Reset to:   $upstream_sha"
 
-    # Cherry-pick RB commits
-    pick_fail=0
-    for c in "${rb_commits[@]}"; do
-        short=$(cd "$fork_dir" && git log -1 --format='%h %s' "$c")
-        if (cd "$fork_dir" && git cherry-pick "$c" 2>/dev/null); then
-            echo "    ✓ $short"
-        else
-            echo -e "    ${RED}✗ CONFLICT: $short${NC}"
-            (cd "$fork_dir" && git cherry-pick --abort 2>/dev/null) || true
-            pick_fail=1
-            break
-        fi
-    done
+    # Generate net diff of all RB changes as a single patch
+    rb_patch="/tmp/rb-upgrade-${fork}-$$.patch"
+    (cd "$fork_dir" && git diff "$upstream_ref" "$old_head" -- . ':!Cargo.lock' > "$rb_patch" 2>/dev/null)
 
-    if [[ "$pick_fail" -ne 0 ]]; then
-        echo -e "  ${RED}FAIL: cherry-pick conflict, restored from backup${NC}"
-        echo -e "  ${YELLOW}Manual rebase needed: cd $fork_dir && git rebase $upstream_ref $backup_branch${NC}"
-        (cd "$fork_dir" && git reset --hard "$backup_branch" 2>/dev/null)
-        FAIL_COUNT=$((FAIL_COUNT + 1))
-        FAILED_FORKS+=("$fork")
-        echo ""
-        continue
+    # Apply net RB diff
+    if (cd "$fork_dir" && git apply --reject "$rb_patch" 2>/dev/null); then
+        echo "  Net diff:   applied ($(wc -l < "$rb_patch") lines)"
+    else
+        # Net diff failed — try individual cherry-picks as fallback
+        echo -e "  ${YELLOW}Net diff had conflicts, falling back to cherry-pick...${NC}"
+        (cd "$fork_dir" && git reset --hard "$upstream_ref" 2>/dev/null)
+        mapfile -t rb_commits < <(cd "$fork_dir" && git log --reverse --format='%H' "${upstream_ref}..${old_head}" 2>/dev/null)
+        pick_fail=0
+        for c in "${rb_commits[@]}"; do
+            short=$(cd "$fork_dir" && git log -1 --format='%h %s' "$c")
+            if (cd "$fork_dir" && git cherry-pick "$c" 2>/dev/null); then
+                echo "    ✓ $short"
+            else
+                echo -e "    ${RED}✗ CONFLICT: $short${NC}"
+                (cd "$fork_dir" && git cherry-pick --abort 2>/dev/null) || true
+                pick_fail=1
+                break
+            fi
+        done
+        if [[ "$pick_fail" -ne 0 ]]; then
+            echo -e "  ${RED}FAIL: both net-diff and cherry-pick failed, restored from backup${NC}"
+            (cd "$fork_dir" && git reset --hard "$backup_branch" 2>/dev/null)
+            rm -f "$rb_patch"
+            FAIL_COUNT=$((FAIL_COUNT + 1))
+            FAILED_FORKS+=("$fork")
+            echo ""
+            continue
+        fi
     fi
 
+    # Regenerate Cargo.lock (avoids cherry-pick conflicts on generated file)
+    if (cd "$fork_dir" && [ -f Cargo.toml ] && cargo generate-lockfile 2>/dev/null); then
+        echo "  Lockfile:   regenerated"
+    fi
+
+    # Stage all changes and commit as a single RB reapply
+    (cd "$fork_dir" && git add -A 2>/dev/null)
+    if ! (cd "$fork_dir" && git diff --cached --quiet 2>/dev/null); then
+        (cd "$fork_dir" && git commit -m "rb: reapply Red Bear patches on upstream $upstream_sha" 2>/dev/null)
+        echo "  Committed:  RB patches reapplied"
+    fi
+
+    rm -f "$rb_patch"
     new_sha=$(cd "$fork_dir" && git rev-parse --short HEAD)
-    echo -e "  ${GREEN}DONE: $old_sha → $new_sha ($ahead patches reapplied)${NC}"
+    echo -e "  ${GREEN}DONE: $old_sha → $new_sha ($ahead RB changes reapplied)${NC}"
     echo -e "  ${YELLOW}Backup at $backup_branch${NC}"
 
     # Post-upgrade verification: check no upstream functions were dropped