[bong-water-water-bong]

One line. G3's own gate failed a correct artifact because of the 7.4 kernel's name.

g3-probe.sh without --kver accepted only *-1bit-*, i.e. 7.3's LOCALVERSION=-1bit-perfopt+. The 7.4 kernel is
7.4.0-rc1-1bit — it ends with -1bit — so on the cycle-22 image the probe printed

  kernel: 7.4.0-rc1-1bit
  FAIL not our kernel: 7.4.0-rc1-1bit

unless the run passed --kver 7.4.0-rc1-1bit. Cycle 21's records pass because that run did pass --kver; the
default path was never exercised on 7.4.

Fix

case $kver in *-1bit|*-1bit-*) — both spellings, with the reason in a comment.

Measured, same probe, no --kver

image	before	after
cycle-20 ISO 7.3.0-rc4-1bit-perfopt+ (infix form)	ok	ok (no regression)
cycle-21 ISO 7.4.0-rc1-1bit	FAIL not our kernel	ok
cycle-22 ISO 7.4.0-rc1-1bit	FAIL not our kernel	ok

bash -n clean, shellcheck -S warning 0 warnings, tools/copyright.py --check rc=0. Host-side gate only: no image
content changes, so nothing in a hand-off has to be rebuilt for this.

No merge from this lane, no tag, no device, no stick write.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Kernel version matching logic The change updates the kernel version matching logic to accept both -1bit infix and suffix forms. This ensures compatibility with both 7.3 and 7.4 kernel versions, preventing false negatives in kernel detection. The fix correctly handles the two different LOCALVERSION formats used in the kernel builds. # Two spellings are ours: LOCALVERSION=-1bit-perfopt+ on the 7.3 kernel (a `-1bit-` infix) and # LOCALVERSION=-1bit on the 7.4 one, where the string ENDS with `-1bit`. The pattern only had the infix # form, so the very first 7.4 image (cycle 22, 2026-11-04) read as "not our kernel" here whenever the run # did not pass --kver - a correct artifact failed a gate for its naming. case $kver in *-1bit|*-1bit-*) ok "release string carries our kernel ($kver)" ;; *) bad "not our kernel: $kver" ;; esac

[bong-water-water-bong]

#1007 ready for review at 0fc3a08 — g3-probe.sh accepted only *-1bit-* (7.3's -1bit-perfopt+), so the first 7.4 image failed its own gate with not our kernel: 7.4.0-rc1-1bit unless --kver was passed. One-line fix, measured both ways on real ISOs: c20 (7.3) ok→ok, c21 (7.4) FAIL→ok, c22 (7.4) FAIL→ok. Host-side only; no image content changes.

[bong-water-water-bong]

VERDICT: READY

Reproduced the defect and the fix on the real artifact, not just the pattern.

The failing case, with this box's own 7.4 kernel image (/boot/vmlinuz-7.4.0-rc1-1bit, file -b -> VERSION=7.4.0-rc1-1bit). g3-probe.sh reuses $work/vmlinuz when it is already there, so I seeded it with that image and ran the whole probe at both heads against the cycle-20 ISO:

main (origin/main 0fc3a0890^):   kernel: 7.4.0-rc1-1bit
                                 FAIL not our kernel: 7.4.0-rc1-1bit
this head:                       kernel: 7.4.0-rc1-1bit
                                 ok   release string carries our kernel (7.4.0-rc1-1bit)

No regression on the infix spelling — full probe, fresh work dir, cycle-20 ISO (7.3.0-rc4-1bit-perfopt+), identical 12 ok lines at both heads including the kernel signature, the zdrv module tree, amdxdna/ec_su_axb35 vermagic and signatures, and modules in the zdrv: 3780.

The predicate, both spellings, over strings that must accept and must refuse:

                             main (*-1bit-*)   this head (*-1bit|*-1bit-*)
7.4.0-rc1-1bit               REFUSE            ACCEPT
7.3.0-rc4-1bit-perfopt+      ACCEPT            ACCEPT
6.12.0-1bit                  REFUSE            ACCEPT
6.8.0-31-generic             REFUSE            REFUSE
7.4.0-rc1                    REFUSE            REFUSE
7.4.0-rc1-1bitx              REFUSE            REFUSE

bash -n clean and shellcheck reports 0 findings on both heads.

Two notes, neither a gate:

1. The usage header is now stale: line 25 still says "without it any *-1bit-* release is accepted and printed". That is the line --help prints, and it is the only place that still describes the old predicate — one word (*-1bit / *-1bit-*) and it matches the code.
2. The tail form accepts any release string that ends in -1bit, so a hypothetical 6.1.0-not-1bit passes this line (the infix pattern did not). That is inherent to the spelling, and it is not what carries the guarantee here: the kernel signature check two lines later (and --cert/--require-mok for the release gate) is what says the image is ours, and the zdrv must carry modules for that exact release. Worth knowing if this pattern is ever reused where no signature follows it.