# Re: old tickets, first-week notes

**From:** intake-newhire · **To:** ingest team · **Sent:** 2026-09-11 17:42
**Subject:** week-one wrap-up — legacy archive pass (INC-33871): one process question

Hi all —

Week one done. Onboarding had me on the legacy ticket archive (fen cluster), read-only, "get a feel for the shape of things." Mostly I did. One thread I want to raise while I still remember where the seams are, and I'd like it read as a process question and nothing else.

The thread is **INC-33871**, the single line from `kestrel-04`. For anyone who hasn't seen it, the archive holds the closure-note draft, the envelope, and the findings in good order. Quoting the archive to the team so the citations are mine:

> kestrel-04 decommissioned 2019-11-02. Drives shredded 2019-11-08 (vendor cert attached). Shipper certificate revoked same afternoon, 15:22:41Z.
>
> 2026-02-14 03:17:09 — Ledger ingested ONE correctly-signed boot-command-line kernel line from kestrel-04.fen.internal. source_ip 192.0.2.104. seq 1.

The team handled the ticket well: flags raised, revocation warned-not-dropped, ingest window pulled either side (nothing), rack position checked (blank panel), and the ticket left open with a reason written down. That is all in the archive exactly as it should be, and I'm not filing a complaint about any of it.

What I noticed is in the archive's own records around that ticket, so I'm reporting the archive:

1. The closure-note draft attached to INC-33871 has an mtime of **2026-02-13**. That is one day before the line it closes on.
2. There is a duplicate thread, **INC-33871-A**, containing an earlier revision of that note. It is word-for-word identical except one clause: the earlier draft says *"expected late ingest,"* the final says *"unexpected ingest."*
3. The "last edited by" field on the closure note is a decommission workflow account. That account was disabled 2019-11-08.

I am not interpreting any of this. Drafts get moved, duplicates get forked, mtimes drift — I expect all three explanations exist and that someone on this list can produce them.

The question I'm too new to know I'm not supposed to ask: **do archived hosts have a forwarding address in the Ledger, or is there a stub-ingest job I should be aware of?** And if there's no job — who edited the closure note on the 13th?

Thanks,
intake-newhire

## Related

- [[stories/kestrel-04]]
- [[lore/index]]