an account that does not exist logged in at 04:12

$ id 1001 id: '1001': no such user

last night, that account wrote nine seconds of fake journal entries into a server's logs. then it stopped existing. See my previous post for chapter 1

root access - chapter 2 cat /etc/passwd

She filed the hallucination at 9:40 in the morning.

The file was called not-real.log. It lived in ~/notes, and it had lived there for ten years. She opened it the way she opened incident tickets. Date. Time. Location. Verdict.

She ran the checklist first. The shrink's checklist, ten years old. Sleep? Four hours. Stress? An incident. Caffeine? None. It passed. It always passed.

2026-08-14 03:17 core-12, cold aisle, row C figure of light, male, state R terminated by signal 9 verdict: hallucination, low confidence

Low confidence. For ten years the verdict had been one word, and the word had been confirmed. This morning she typed low confidence, stared at it, and corrected flickering CRTs to rack LEDs before saving. Even the file of things that never happened had to be accurate.

She backed up the file before she closed it. She backed up everything before she touched it, because she backed up before deleting, and she never deleted. The backups folder held three hundred eleven copies of a log of things that had never happened.

She closed the laptop. The hallucination was filed. The data was not. An eleven-second boot. A root login at 04:12. A PID 1 claiming to have been running since 2016. Those were not hallucinations. Those were symptoms.

The datacenter was three degrees colder than the street, and it felt like hers.

The guard at the gate nodded without looking up. She knew the sound of every door in the building. She knew which fans belonged to which rows the way other people knew their neighbors' voices.

An alarm chirped, two rows over. Her shoulders snapped rigid before she placed the sound. Cage B. PDU. Someone had bumped the cage door. She made herself exhale, and her shoulders came down one vertebra at a time.

Core-12 sat in row C under its taped label: GRUMPY, DO NOT PET. She pulled up a stool, plugged in, and read it like a patient chart. Uptime: seven and a half hours. Load: ordinary. A normal machine having a normal day.

The nine-second gap was gone.

The journal ran continuous from 03:02:51 to 03:03:00. Nine neat seconds of ordinary entries. Log rotations. A dhcp renew. Nothing that had ever happened here. Someone had rewritten the night.

She typed a test command. The echo came back half a second late. Over the DC's internal network, echo lag was two-tenths of a millisecond. Half a second was not latency. Half a second was someone reading over her shoulder, one letter behind.

Her fingers hovered over the keyboard. Two seconds. Then she ran the check.

journalctl --verify PASS: /var/log/journal/7c6e13ab2f7a4c9f8e1d2b3a4c5d6e7f/system.journal FAIL: /var/log/journal/7c6e13ab2f7a4c9f8e1d2b3a4c5d6e7f/system@0005a7f4b2c1d3e5-000000000009bc0e-0005f4a2b1.journal (Bad message)

One file had been touched. One. The file had been dropped in from somewhere else, and it had been edited on the way down.

She leaned in. The screen was a handspan from her face. In the dark glass her own eyes looked back at her, red rims deepened overnight, the color of the status lights on the racks. Same color. Same hours.

stat -c %y /var/log/journal/7c6e13ab2f7a4c9f8e1d2b3a4c5d6e7f/system@0005a7f4b2c1d3e5-000000000009bc0e-0005f4a2b1.journal 2026-08-14 04:12:07.000000000 +0800

04:12 this morning. She had been standing in this aisle at 04:12.

Her thumb found the crack in her phone through her pocket and ran along it, once.

At 04:12, on a shelf across the city, root had logged into her Pi.

journalctl --file=/var/log/journal/7c6e13ab2f7a4c9f8e1d2b3a4c5d6e7f/system@0005a7f4b2c1d3e5-000000000009bc0e-0005f4a2b1.journal --list-boots 0 3c71f0e2a24b4f9c8a1d3e5b7c9d1f03 Wed 2016-05-18 09:02:31 CST—Wed 2016-05-18 09:03:00 CST

The file held one boot. It began Wednesday, May 18, 2016, at 09:02:31. It ended nine seconds later.

The nine seconds someone had used to fill the gap had come from a machine that booted in 2016. This node was installed in 2023. The process was older than the machine it had died on.

She typed the next command with one finger.

ps -o lstart= -p 1 Wed May 18 09:02:31 2016

The same second.

stat / agreed. The root directory of this machine was born before the machine.

She wrote the ticket in the driest words she had: core-12 PID 1 start time predates hardware install by seven years. Journal tampered, 04:12. Root cause: unknown process.

A cart squeaked in the next aisle. Old Meng, with his work cart. The cart smelled of solder and dust. Nobody else in the building still kept a soldering iron on a cart. Nobody else still kept paper logs.

"You're in again," Meng said. "I saw the row C lights at four this morning."

"Couldn't sleep."

"The young don't sleep." He parked the cart and patted core-12's rack. "The old watch. How's the patient?"

"The label says don't pet it."

"That label's for young engineers. Grumpy and I were built in the same decade."

She almost smiled. Meng was the only person in the building who talked about the machines the way she felt about them. He had been here before the raised floor went in. Before the system was the system.

"When the architect was here, row C ran warmer," Meng said. "He said cold racks made cold machines."

"The architect."

"Built all this. Before the system was the system, it was his handwriting. Retired ten years ago. Health, they said." Meng looked down the aisle. "When he left, they cleaned his accounts out. Every one of them. Like the man had never existed."

"Company does that."

"Company does that," Meng agreed, "to people it's glad to lose. A man builds one machine his whole life. They take it away. What's left?"

She had no answer. Meng reached over and pressed the peeling corner of the GRUMPY label back down with his thumb. Steady hands. Old hands.

"Your little Pi at home," he said. "Still running?"

"Eight years."

"That's not a server," Meng said. "That's a promise. Machines live long when someone loves them."

He took up the cart handle. "I'll be in the tunnels, checking the veins. Call me if the old-timers tell you anything."

"Machines don't talk, Meng."

He was already walking. "That's what young people think."

After he left, she went back to the nine seconds.

The rewritten entries were clean. Too clean. She pulled them out field by field.

journalctl --file=/var/log/journal/7c6e13ab2f7a4c9f8e1d2b3a4c5d6e7f/system@0005a7f4b2c1d3e5-000000000009bc0e-0005f4a2b1.journal -o verbose | grep _UID _UID=1001 _UID=1001 _UID=1001

One account had written every fake second of the night. She typed its uid.

Her hands moved without consulting her. Callused fingertips. Nails cut to the quick. The second joint of her left middle finger, slightly enlarged, ten years of ENTER. The crash cart's rubber keys were soft under her fingers. The cold aisle air moved over her knuckles. She typed the uid wrong the first time and had to delete it, and the delete key was louder than the rest.

id 1001 id: '1001': no such user

getent passwd 1001

Nothing. Not an error. Nothing. The way a directory answers for a file that was rm'd.

She hit ENTER on the empty prompt. The prompt came back. She hit it harder.

cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin lwan:x:1000:1000:Lin Wan:/home/lwan:/bin/bash

No 1001. She had read this file a thousand times and never once seen it as a list of people. Every row was someone who had been given a key. Most of them were gone now. Their rows stayed. Even nobody had a row. Even nothing had a place. uid 1001 had neither.

Nobody deleted rows. CloudMap froze accounts, archived them, buried them with an asterisk and a date. Accounts were people, and people were bad luck to delete.

She checked the backup file. /etc/passwd- held no 1001 either. Whoever removed the account had removed it twice. No home directory in /home. No tombstone. Professional. Thorough. Afraid.

And at 04:12, that account had planted the nine seconds in core-12's logs. And at 04:12, root had logged into her Pi.

The two machines were sixteen kilometers apart. The minute was the same.

She copied the journal file to her laptop, and to the USB stick, and to the laptop again. Back up before you act. Her ring finger tapped the desk three times. She did not notice.

She wrote two rows on the back of the incident report. Architect, retired on health. uid 1001, deleted. She underlined both rows twice.

Then she locked the aisle, badged out, and went home to check the machine that had not rebooted without her permission in eight years.

(end of chapter 2)

【Chapter Synopsis】 Lin Wan files the vision as a low-confidence hallucination, then finds core-12's journal rewritten: the dead process's nine seconds came from a 2016 boot, PID 1 predates the hardware, and the tampering traces to a deleted account, uid 1001.