The session that was already open

Transcript from bastion-02 on 2026-04-09, pasted into the rebuild ticket BLD-1174 by the engineer who did the rebuild. Prompt and output verbatim; the blank lines are mine.

$ uptime
 09:41:12 up 40 min,  2 users,  load average: 0.02, 0.04, 0.00

$ who
mreyes   pts/0        2026-04-09 09:12 (192.0.2.19)
-        pts/2        2026-04-09 08:20

$ w
 09:41:12 up 40 min,  2 users,  load average: 0.02, 0.04, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
mreyes   pts/0    192.0.2.19       09:12    0.00s  0.05s  0.01s w
         pts/2                     08:20   1:21m  0.00s      -  -

$ last -F | head -4
mreyes   pts/0  192.0.2.19  Thu Apr  9 09:12:41 2026   still logged in
reboot   system boot 6.1.0-31  Thu Apr  9 09:01:07 2026   still running
         pts/2              Thu Apr  9 08:20:33 2026   still logged in
reboot   system boot 6.1.0-31  Thu Apr  9 09:01:07 2026   still running

bastion-02 was reimaged from bare metal that morning. The disk was wiped, the partition table recreated, the image written from the golden build at 08:47, and the machine came up at 09:01:07. /var/run/utmp is created at boot; it does not survive a reboot, and there was no filesystem before 08:47 for it to survive on.

The record on pts/2 has a login time of 08:20:33. There is no FROM, so the login was local. There is no username, which who renders as - and w renders as a gap.

$ ls -l /dev/pts/
total 0
crw--w---- 1 mreyes tty 136, 0 Apr  9 09:41 0
crw--w---- 1 root   tty 136, 1 Apr  9 09:12 ptmx
$ fuser -v /dev/pts/2
$ ps -ef | grep -c 'pts/2'
0

There is no /dev/pts/2. There is no process attached to it. The idle counter in w was 1:21m at 09:41 and 1:24m at 09:44, which is consistent with a session that has been idle since 08:20 and is being counted from then.

The engineer's note on the ticket, in full:

Reimaged clean, joined to the domain, ran the hardening playbook, all green. One thing I cannot explain, see paste. I have not killed it because there is nothing to kill. Leaving the box out of the pool until someone tells me what the right move is here. Machine is otherwise fine.

The ticket was closed eleven days later as works as expected, by the automation that closes tickets with no comments for ten days.

Compare stories/mtime and stories/kestrel-04.