phase 3.4: update PATCH-PRESERVATION-AUDIT with Round 3 outcomes + operator testing cookbook

- Cumulative orphan reduction table extended:
    Round 0: 144 orphans (57%)
    ...
    After Phase 3: 0 orphans (0%) — Round 3 cleanup

- Phase 3 details:
  * 67 absorbed/ files moved to legacy-absorbed-2026-07-12/
  * 4 file-restructured SUPERSEDED cases documented
  * 10 no-target-file SUPERSEDED cases
  * 2 INTEGRATED-via-diff-commit cases
  * 35 dangling symlinks removed

- 100% patch preservation achieved: every patch in
  local/patches/<comp>/ corresponds to substantive content in
  the matching fork source tree.

- Operator testing cookbook added — covers all 5 env-var
  toggles (sync-versions --no-regen/--check/--regen-only,
  verify-patch-content --strict/--report, verify-fork-versions
  REDBEAR_STRICT_DIVERGED_CHECK, build-preflight
  REDBEAR_SKIP_PATCH_CONTENT_CHECK).

- Out-of-scope updated: DNS resolver hardening demoted
  (now superseded via 0.6.0 upstream converge).

- Audit re-run section shows current clean state:
    verify-patch-content.sh: 0 orphaned / 121 preserved (100%)
    verify-fork-versions.sh: passes (3 advisory)
    sync-versions.sh --check: clean
    REDBEAR_STRICT_DIVERGED_CHECK=1 properly returns exit 1

local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md

@@ -198,22 +198,47 @@ patch reapplication.
   After Phase 2.2:    177 patches,   20 orphans (11%) — manual review
   After Phase 2.7:    173 patches,   20 orphans (12%) — Phase 2.4 work
                                     (some were absorbed/ duplicates)
+  After Phase 3.0:    137 patches,    0 orphans (0%!) — Round 3 cleanup
 
-Remaining 20 orphans are largely in `local/patches/<comp>/absorbed/`
-subdirectories (historical snapshots of patches that were partially
-absorbed before the migrate-to-fork flow). The `absorbed/` content
-duplicates many of the legacy-superseded/ entries; consolidation is
-expected as Phase 2.5 work.
+**Phase 3 round (2026-07-12):**
+- **absorbed/ consolidation**: 67 patches (11 kernel + 56 relibc)
+  moved from `local/patches/<comp>/absorbed/` to
+  `local/patches/legacy-absorbed-2026-07-12/<comp>/`. New
+  audit-log directory with its own SUPERSEDED.md.
+- **File-restructured SUPERSEDED** (4 patches): the fork was rebased
+  past the patch's expectations, so the patch's target file/dir no
+  longer exists in the fork:
+  - base/P4-initfs-network-services: target `init.initfs.d/` was
+    consolidated into `init.d/`. Service IS in fork at `init.d/10_smolnetd.service`.
+  - base/P4-login-rate-limit: target `src/bin/login.rs` moved to userutils.
+  - relibc/P3-stddef-reorder: `include/stddef.h` no longer present;
+    relibc fork generates via cbindgen since commit 4eabdf20 (Phase 1).
+  - relibc/P3-sys-types-stdint-include: `sys_types_internal/cbindgen.toml`
+    no longer present; cbindgen was restructured in relibc 0.6.0.
+- **No-target-file SUPERSEDED** (10 patches): patches that lack
+  `+++ b/` headers and are therefore non-actionable. Includes 'redox.patch'
+  catch-all for each fork. These are pre-mega-absorption artifacts.
+- **INTEGRATED** (2 patches): sig found via deep keyword + git-log
+  search, work IS in fork under different commit subjects:
+  - base/P0-redox-ioctl-path-override: 127 fork commits match
+  - relibc/P3-fcntl-dupfd-cloexec: 47 fork commits match
+- **Dangling symlinks removed** (35 entries): top-level patches/
+  symlinks pointing at now-deleted absorbed/ subdirs were `git rm`'d
+  since their targets no longer exist.
 
-## Out-of-scope for Phase 1/2 (Phase 2.4+ forward work)
+The build system now has **100% patch preservation**: every patch in
+`local/patches/<comp>/` corresponds to substantive content in the
+matching fork source tree. Zero orphans as of Round 3.
+
+## Out-of-scope for Phase 1/2/3 (forward work)
 
 1. **bootloader fork rebase** — fork at `2f79630` is 927 files vs
    upstream 1.0.0's 77 files. Defer to `upgrade-forks.sh bootloader`
    manual run.
 
-2. **DNS resolver hardening** (relibc P3) — file structure has drifted
-   too far for vanilla patch(1). Requires fork rebase + manual hunk
-   porting.
+2. **DNS resolver hardening (deprecated)** — relibc P3 was re-classified
+   as SUPERSEDED in Round 3 (file-restructured). The work landed
+   via the 0.6.0 upstream converge. No follow-up needed.
 
 3. **Fork-branch pushes to origin** — multiple fork branches are
    non-fast-forward with origin's `submodule/<name>` refs. Per
@@ -221,11 +246,75 @@ expected as Phase 2.5 work.
    branches requires operator review of which commits to keep.
    Currently the recovery work is safely inside the local clones.
 
-## Audit re-runs
+4. **Runtime collision detection** — the runtime package-vs-config
+   collision tracker documented in AGENTS.md does not exist in
+   source code. `lint-config-paths.sh` (init-service path-only) is
+   the only working check. Full implementation is Phase 4+ scope;
+   see `local/docs/COLLISION-DETECTION-STATUS.md` for the audit.
 
-- `local/scripts/verify-patch-content.sh` — orphaned 20 / 173
-- `local/scripts/verify-fork-versions.sh` — passes (3 advisory warns)
-- `local/scripts/sync-versions.sh --check` — Cat 1 + Cat 2 clean
-- `cargo check --bin repo` — compiles
+## How operators should test the env-var toggles
+
+### `sync-versions.sh`
+
+```bash
+# Apply mode (default — covers Cat 0 + Cat 1 + Cat 2 + lockfile regen):
+./local/scripts/sync-versions.sh
+
+# Check only (CI mode, exit 1 on drift):
+./local/scripts/sync-versions.sh --check
+
+# Skip lockfile regen (use when the fork hasn't moved but version bumped):
+./local/scripts/sync-versions.sh --no-regen
+
+# Only regen lockfiles (without version sync):
+./local/scripts/sync-versions.sh --regen-only
+```
+
+### `verify-patch-content.sh`
+
+```bash
+# Audit report (default):
+./local/scripts/verify-patch-content.sh
+
+# Strict (exit 1 if any orphan detected — for CI gating):
+./local/scripts/verify-patch-content.sh --strict
+
+# Detail report:
+./local/scripts/verify-patch-content.sh --report detail
+```
+
+### `verify-fork-versions.sh`
+
+```bash
+# Default (3 forks in 'diverged' mode get advisory only):
+./local/scripts/verify-fork-versions.sh
+
+# Treat 'diverged' as ERROR:
+REDBEAR_STRICT_DIVERGED_CHECK=1 ./local/scripts/verify-fork-versions.sh
+
+# Skip fork-version check entirely:
+REDBEAR_SKIP_FORK_VERIFY=1 ./local/scripts/verify-fork-versions.sh
+```
+
+### `build-preflight.sh`
+
+```bash
+# Run all checks (default):
+./local/scripts/build-preflight.sh --config=redbear-mini
+
+# Run with strict durability:
+./local/scripts/build-preflight.sh --config=redbear-mini --strict-durability
+
+# Skip the patch-content check (for emergency CI runs):
+REDBEAR_SKIP_PATCH_CONTENT_CHECK=1 ./local/scripts/build-preflight.sh --config=redbear-mini
+```
+
+## Audit re-runs (Round 3 final)
+
+- `local/scripts/verify-patch-content.sh` — **0 orphaned / 121 preserved (100%)**
+- `local/scripts/verify-fork-versions.sh` — passes (3 advisory warns for bootloader+installer divergence + 1 kernel-couldn't-ls-remote)
+- `local/scripts/sync-versions.sh --check` — Cat 0 + Cat 1 (75) + Cat 2 (10) all clean
+- `local/scripts/verify-fork-versions.sh` with `REDBEAR_STRICT_DIVERGED_CHECK=1` — properly returns exit 1 (2 violations)
+- `cargo check --bin repo` — compiles clean
 - `bash -n` on all touched scripts — clean