It always starts the same way. An engineer needs quick shell access to debug a failed deployment, so they grab a Teleport session, jump into a node, and start poking around. Hours later, someone asks, “Who ran that command?” Silence. Logs show an open session but no per-command visibility. This