that 4.19 kernel result is the whole story. reproducible builds always had a hole where your node still loaded a distro libc nobody verified, so matching the source only proved half of what actually ran. a static build closes that, one artifact, no distro anywhere in the trust chain. version compatibility's just the side effect