# The session that was already open

Transcript from `bastion-02` on 2026-04-09, pasted into the rebuild ticket
BLD-1174 by the engineer who did the rebuild. Prompt and output verbatim; the
blank lines are mine.

```
$ uptime
 09:41:12 up 40 min,  2 users,  load average: 0.02, 0.04, 0.00

$ who
mreyes   pts/0        2026-04-09 09:12 (192.0.2.19)
-        pts/2        2026-04-09 08:20

$ w
 09:41:12 up 40 min,  2 users,  load average: 0.02, 0.04, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
mreyes   pts/0    192.0.2.19       09:12    0.00s  0.05s  0.01s w
         pts/2                     08:20   1:21m  0.00s      -  -

$ last -F | head -4
mreyes   pts/0  192.0.2.19  Thu Apr  9 09:12:41 2026   still logged in
reboot   system boot 6.1.0-31  Thu Apr  9 09:01:07 2026   still running
         pts/2              Thu Apr  9 08:20:33 2026   still logged in
reboot   system boot 6.1.0-31  Thu Apr  9 09:01:07 2026   still running
```

`bastion-02` was reimaged from bare metal that morning. The disk was wiped, the
partition table recreated, the image written from the golden build at 08:47, and
the machine came up at 09:01:07. `/var/run/utmp` is created at boot; it does not
survive a reboot, and there was no filesystem before 08:47 for it to survive on.

The record on `pts/2` has a login time of 08:20:33. There is no `FROM`, so the
login was local. There is no username, which `who` renders as `-` and `w`
renders as a gap.

```
$ ls -l /dev/pts/
total 0
crw--w---- 1 mreyes tty 136, 0 Apr  9 09:41 0
crw--w---- 1 root   tty 136, 1 Apr  9 09:12 ptmx
$ fuser -v /dev/pts/2
$ ps -ef | grep -c 'pts/2'
0
```

There is no `/dev/pts/2`. There is no process attached to it. The idle counter
in `w` was 1:21m at 09:41 and 1:24m at 09:44, which is consistent with a session
that has been idle since 08:20 and is being counted from then.

The engineer's note on the ticket, in full:

> Reimaged clean, joined to the domain, ran the hardening playbook, all green.
> One thing I cannot explain, see paste. I have not killed it because there is
> nothing to kill. Leaving the box out of the pool until someone tells me what
> the right move is here. Machine is otherwise fine.

The ticket was closed eleven days later as *works as expected*, by the automation
that closes tickets with no comments for ten days.

Compare [[stories/mtime]] and [[stories/kestrel-04]].