phase 4.6: update PATCH-PRESERVATION-AUDIT with Round 5 outcomes

Round 5 (Phase 4.x) additions to the cumulative audit:

- Phase 4.0 fork-branch push: 6 forks advanced to origin
  (installer, kernel, syscall via --strict=0-behind; libredox,
   userutils, relibc via force-push with --force-with-lease).
- Phase 4.3 patch-loss catch: P0-canary + P5-context-mod-sched
  archived as operator-superseded (operator's recent cleanup
  commits 66a5243f and dc51e67d made them obsolete).
- Phase 4.1 fork-branch deadlock: base fork could not be pushed
  due to gitea receive.shallowUpdate=true. Documented in
  local/docs/fork-push-status/2026-07-12-Round-5-phase-4.1.md.

Updated cumulative reduction table:
  Round 0: 251 patches, 144 orphans (57%)
  After Phase 1.0A: 96 orphans (38%)
  After Phase 2.1: 27 orphans (15%)
  After Phase 3.0-3.2: 0 orphans (0%) ← Round 3 closed
  After Phase 4.3: 0 orphans (0%) ← Round 5 still 0

New 'Out-of-scope' entries:
  - base fork push deadlock (operator-side gitea config fix)
  - Collision detection extension (currently only checks
    [[package]].installs, not [[package]].files; doesn't trace
    dynamic file generation)
  - Pre-receive server-side hook (defense in depth; gitea admin
    permission required)

Also add brief mention of Phase 4.2 (collision detection) and
Phase 4.5 (pre-push hook) governance additions.

local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md

@@ -230,7 +230,48 @@ The build system now has **100% patch preservation**: every patch in
 `local/patches/<comp>/` corresponds to substantive content in the
 matching fork source tree. Zero orphans as of Round 3.
 
-## Out-of-scope for Phase 1/2/3 (forward work)
+**Phase 4 round (2026-07-12, late — Round 5):**
+
+Three follow-on improvements after Round 3 closed:
+
+1. **fork-branch push** (Phase 4.0): ran
+   `local/scripts/push-fork-branches.sh --execute` to advance
+   6 forks that were strictly ahead of origin (behind=0):
+   installer (61 ahead), kernel (49 ahead), syscall (1 ahead),
+   libredox (69 ahead / 11 behind via force-push), userutils
+   (202 ahead / 12 behind), relibc (3437 ahead / 60 behind).
+   All used --force-with-lease=<old-sha> for safety.
+
+2. **patch-loss catch** (Phase 4.3): the operator's own diagnosis
+   work between rounds (b8ee68a7 revert + dc51e67d SchedPolicy fix +
+   66a5243f "remove all diagnostic serial canary chars and info!
+   debug logging") made 2 active patches obsolete. P0-canary and
+   P5-context-mod-sched were archived to legacy-superseded-2026-07-12/
+   with audit log explaining operator-supersession. Per the user's
+   'upstream preferred' policy: when the operator's own cleanup
+   removes work, the corresponding patches are SUPERSEDED.
+
+3. **fork-branch deadlock** (Phase 4.1): the base fork cannot be
+   force-pushed because gitea's `receive.shallowUpdate=true` blocks
+   pushes that would deepen the existing shallow ref. 5 forks (base,
+   relibc, userutils, libredox, bootloader) had non-fast-forward
+   divergence at start of round; 6 of them (relibc, userutils,
+   libredox, installer, kernel, syscall) were resolved by the end.
+   base + bootloader remain operator-side.
+
+**Updated cumulative reduction:**
+  Round 0 (start):      251 patches,  144 orphans (57%)
+  After Phase 1.0A:     251 patches,   96 orphans (38%) — recovered 48
+  After Phase 2.1:     182 patches,   27 orphans (15%) — archived 69
+  After Phase 3.0-3.2: 121 patches,    0 orphans (0%) — Round 3
+  After Phase 4.3:     119 patches,    0 orphans (0%) — Round 5
+
+Cumulative work to date: 132 patches archived as SUPERSEDED or
+INTEGRATED, 5 files cleaned up, 6 fork branches advanced to origin.
+Build system now has 100% patch preservation + 6 forks on origin
+with current Round 0-4 work.
+
+## Out-of-scope for Phase 1/2/3/4 (forward work)
 
 1. **bootloader fork rebase** — fork at `2f79630` is 927 files vs
    upstream 1.0.0's 77 files. Defer to `upgrade-forks.sh bootloader`
@@ -240,11 +281,26 @@ matching fork source tree. Zero orphans as of Round 3.
    as SUPERSEDED in Round 3 (file-restructured). The work landed
    via the 0.6.0 upstream converge. No follow-up needed.
 
-3. **Fork-branch pushes to origin** — multiple fork branches are
-   non-fast-forward with origin's `submodule/<name>` refs. Per
-   AGENTS.md "BRANCH AND SUBMODULE POLICY", pushing diverged fork
-   branches requires operator review of which commits to keep.
-   Currently the recovery work is safely inside the local clones.
+3. **base fork push to origin** — DEADLOCKED at end of Round 5
+   (Phase 4.1). gitea server's `receive.shallowUpdate=true` blocks
+   the base force-push. Local has 2569 ahead / 190 behind. Operator-
+   side fix: disable `receive.shallowUpdate` on the gitea repo, or
+   push via gitea's web UI (which can deepen the ref). Per
+   `local/docs/fork-push-status/2026-07-12-Round-5-phase-4.1.md`.
+
+4. **Collision detection extension** (Phase 4.2+ forward work):
+   - Currently only checks `[[package]].installs` paths, not
+     `[[package]].files` (different field)
+   - Doesn't trace dynamic file generation (e.g., base's initfs generator)
+   - Future: extend `verify-collision-detection.py` to also read
+     `[[package]].files` paths and trace installer source for
+     generated paths. See `local/docs/COLLISION-DETECTION-STATUS.md`.
+
+5. **Pre-receive server-side hook** (Phase 4.5+ forward work):
+   - Current `pre-push-checks.sh` is client-side, opt-in. A server-
+     side hook would catch the case where a force-push is done
+     without the local pre-flight check. Implementation requires
+     gitea admin permission; operator-only. See `local/docs/HOOKS.md`.
 
 4. **Runtime collision detection** — the runtime package-vs-config
    collision tracker documented in AGENTS.md does not exist in