Re: old tickets, first-week notes
From: intake-newhire · To: ingest team · Sent: 2026-09-11 17:42 Subject: week-one wrap-up — legacy archive pass (INC-33871): one process question
Hi all —
Week one done. Onboarding had me on the legacy ticket archive (fen cluster), read-only, "get a feel for the shape of things." Mostly I did. One thread I want to raise while I still remember where the seams are, and I'd like it read as a process question and nothing else.
The thread is INC-33871, the single line from kestrel-04. For anyone who hasn't seen it, the archive holds the closure-note draft, the envelope, and the findings in good order. Quoting the archive to the team so the citations are mine:
kestrel-04 decommissioned 2019-11-02. Drives shredded 2019-11-08 (vendor cert attached). Shipper certificate revoked same afternoon, 15:22:41Z.
2026-02-14 03:17:09 — Ledger ingested ONE correctly-signed boot-command-line kernel line from kestrel-04.fen.internal. source_ip 192.0.2.104. seq 1.
The team handled the ticket well: flags raised, revocation warned-not-dropped, ingest window pulled either side (nothing), rack position checked (blank panel), and the ticket left open with a reason written down. That is all in the archive exactly as it should be, and I'm not filing a complaint about any of it.
What I noticed is in the archive's own records around that ticket, so I'm reporting the archive:
- The closure-note draft attached to INC-33871 has an mtime of 2026-02-13. That is one day before the line it closes on.
- There is a duplicate thread, INC-33871-A, containing an earlier revision of that note. It is word-for-word identical except one clause: the earlier draft says "expected late ingest," the final says "unexpected ingest."
- The "last edited by" field on the closure note is a decommission workflow account. That account was disabled 2019-11-08.
I am not interpreting any of this. Drafts get moved, duplicates get forked, mtimes drift — I expect all three explanations exist and that someone on this list can produce them.
The question I'm too new to know I'm not supposed to ask: do archived hosts have a forwarding address in the Ledger, or is there a stub-ingest job I should be aware of? And if there's no job — who edited the closure note on the 13th?
Thanks, intake-newhire