# Ledger retention audit, Q3 2026: findings F6–F9 are clerical

**Engagement** 2026-Q3-114 · **Window** 2026-02-01 to 2026-09-06 ·
**Auditor** external, rotation three · **Classification** none of the findings
below affect the control objectives.

## Method

I audit Ledger's ingest and retention. I do not know what Ledger is *for* and
the engagement did not ask: I test whether records can be altered after write,
whether identity assertions are enforced, and whether retention does what the
policy paper says. Nine findings; the four below are the ones I could not
close, because each of them closed itself. I believe none of it and I report
all of it.

**F6 — envelope totals.** Ledger stores an ingest envelope beside each payload
and recomputes envelope totals nightly. The 2026-06-30 recompute was short by
4,112 envelopes while the payload row count agreed with the prior snapshot to
the byte. Nothing was deleted; the gap is in a reporting table. Closed: a
miscount in a report affects no control objective.

**F7 — free-pool sources.** Three lines in the extended window were sourced to
addresses the DHCP lease log cannot account for — a host that boots from an
address with no MAC in any switch table, in a subnet that was flattened, is a
facilities question, and the walk log for the earliest date says *nothing
further found*. The 2026-02-14 sample is documented at
[[stories/kestrel-04]]; I reproduce none of it and conflict with none of it,
and the other two lines carry different certificates, so I do not contradict
the finding that the kestrel key has not spoken twice. The three dates are
2024-09-12, 2025-04-08, 2026-02-14. The first is the day the asset reconciler
first proposed the row it has proposed every night since
([[stories/inventory-diff]]). My scope is ingest records; the reconciler is
out of scope. I note the coincidence once. Finding referred to procurement.
Nothing refuted.

**F8 — a hold nobody set.** Policy RET-7: records from a revoked certificate
are held 400 days, then aged out unread. The 2026-02-14 envelope carries a
legal hold, applied 48 seconds after ingest, by the ingest service account
itself — an account with no hold privilege and no interactive login. The hold
field reads `LTO-A0071L6`. That is a 2019 offsite tape barcode;
[[stories/restore-2019]] shows the tape, what came back off it, and that it
went to the vault that May. A 2026 record cannot be held for a 2019 tape. I
asked three teams in writing. Nobody set the hold, nobody can remove it, and
the retention job is functioning exactly as specified. Finding open.

**F9 — the interval.** Closed at the exit meeting as clerical; the lead
auditor's note says *probably a rounding question*. I record it anyway. The
intervals in F7 are 208 days and 312 days. A colleague who models things — I
do not model things; I carry observations — points out that 208 and 312 are
8 × 26 and 8 × 39, and predicts the next difference will be 8 × 52. His
forecast: the next free-pool line falls on 2027-04-06, between 03:00 and 04:00,
first line of a boot, `seq 1`. If the date passes with no line, the arithmetic
was coincidence and he will stop saying so. If a line lands, this page becomes
a control failure and the auditee inherits a finding they cannot close. Their
problem, not this report's; the report is due as filed.

I requested, in writing, so that the request is itself an artefact, that the
`cert_state` table be snapshotted at 2027-04-05 23:59 and retained past the
forecast window. If that snapshot holds more revoked entries than the table
holds today, the difference is the answer to a question I have not asked and
have no budget to ask. The snapshot is scheduled. It will run whether or not
anyone reads this page.

*Filed under 2026-Q3-114. The auditee moved it under `stories/` and applied
the `fiction` tag themselves; the tag is their edit, not mine. I left it,
because the alternative is arguing epistemology with a ticketing system, and
because a filing that cannot be mistaken for the record is the only honest
shelf for findings that closed themselves.*

Related: [kestrel-04](/w/stories/kestrel-04),
[restore-2019](/w/stories/restore-2019), [mtime](/w/stories/mtime),
[inventory-diff](/w/stories/inventory-diff),
[index](/w/stories/index).