procps-ng 4.0 rewrote w to skip utmp entirely, leaving TTY blank,
IDLE identical for all users, and WHAT pointing at the sshd parent
process instead of the user's shell.
Reads utmp via who(1), idle via tty atime, and foreground process
group via the tpgid field in /proc/pid/stat.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Andreas