Scrollback is a queryable surface, not a lost cause

The ticket says: it printed something red and then it was gone. Your customer runs your CLI in their own container; the something red is forty lines above what their terminal shows now.

Your support tool calls GET /api/v1/terminal/find?terminal_id=1&pattern=Traceback|ERROR&scope=scrollback against their terminal service. The first call replays the session's output buffer through a server-side VT parser, so the scrollback exists even though nobody automated this session before. Hits come back with row coordinates. GET /api/v1/terminal/snapshot?scroll_offset=40 returns that page as the customer saw it, colors optional.

No log file, because the CLI printed to a screen, not a file. No screenshare, because the customer went to lunch. The screen was the record; it just wasn't on the screen anymore.

Scrollback is a queryable surface, not a lost cause.