The customer's Diagnostics tab is a terminal into their own container

Every customer of your SaaS runs in their own container. In their portal, next to Billing and Settings, there's a Diagnostics tab. It's an iframe: terminal-2 on their container, ?readonly=true&cwd=/var/log&hide-toolbar=true with a cmd= that tails their app log. That container's proxy permissions grant the customer's group terminal: 2 and nothing else.

The customer opens it from a phone during an outage and reads their own logs. Your support engineer opens the same terminal_id from a laptop, without readonly, and runs the fix while the customer watches the same screen. No screen-share, no "send me the logs," no ticket with a zip attached.

When the customer closes the tab the session persists; tomorrow it's the same shell, scrolled to where they left it.

The support channel is a terminal the customer already had open.