Dear Maintainer,

For several months I have had the following option set:
APT::NeverAutoRemove::KernelCount "3";

However, I still find its behavior unclear.

I've just upgraded a bunch of packages on my Debian testing system,
including a new kernel, using:
# apt -U -V --autoremove --purge full-upgrade

After rebooting, here is my current set of installed kernel packages:
# apt list --installed 'linux-image*'
linux-image-7.0.13+deb14-amd64/now 7.0.13-1 amd64 [installed,local]
linux-image-7.1.3+deb14-amd64/now 7.1.3-1 amd64 [installed,local]
linux-image-7.1.6+deb14-amd64/now 7.1.6-1 amd64 [installed,local]
linux-image-7.1.7+deb14-amd64/now 7.1.7-1 amd64 [installed,local]
linux-image-7.1.8+deb14-amd64/now 7.1.8-1 amd64 [installed,local]
linux-image-7.1.8+deb14.1-amd64/testing,now 7.1.8-2 amd64 [installed,automatic]
linux-image-amd64/testing,now 7.1.8-2 amd64 [installed]

And now apt autoremove proposes:
=====
# apt -U -V autoremove
Hit:1 https://deb.debian.org/debian testing InRelease
All packages are up to date.
REMOVING:
   linux-base-7.1.6+deb14-amd64 (7.1.6-1)
   linux-binary-7.1.6+deb14-amd64 (7.1.6-1)
   linux-image-7.1.6+deb14-amd64 (7.1.6-1)
   linux-modules-7.1.6+deb14-amd64 (7.1.6-1)

Summary:
  Upgrading: 0, Installing: 0, Removing: 4, Not Upgrading: 0
  Freed space: 126 MB
=====

Why does apt propose removing 7.1.6-1 rather than 7.0.13-1 or 7.1.3-1?
Furthermore, after apt removes the proposed version, five kernel
versions will still be installed, even though I configured it to keep
three.

Is this a bug, or is apt working as intended?

In the latter case, I would suggest adding an explanation to apt.conf(5),
because I believe that the current text does not explain this behavior.
=====
NeverAutoRemove::KernelCount
    Keep a custom amount of kernels when autoremoving and defaults to 2, meaning
    two kernels are kept. Apt will always keep the running kernel and the latest
    one. If the latest kernel is the same as the running kernel, the second lat‐
    est kernel is kept. Because of this, any value lower than 2 will be ignored.
    If  you  want only the latest kernel, you should set APT::Protect-Kernels to
    false.
=====

Regards,

Cesare Leonardi