Teleport interactive session termination classification for SSH, Kubernetes and Database access

Teleport supports interactive access via SSH, Kubernetes exec and port-forward, and Database proxy with server-side idle and connection timeout controls configurable per service and per role. Client-initiated cancellation of an interactive session is generally propagated as a transport close that the server interprets as session termination and records in audit logs.

Timeout and cancellation semantics differ by access protocol, with separate timeout parameters and propagation paths for SSH, Kubernetes and Database. Session recording finalization depends on the server detecting termination, and there is no single unified cancellation signal documented across access types. This can lead to inconsistent user-visible termination messages and audit classifications.

The goal is to clarify how termination is classified for audit and session recording purposes across protocols. Is client-initiated cancellation recorded with a distinct audit event type from server-enforced idle or connection timeout? Do SSH, Kubernetes exec/port-forward, and Database proxy produce consistent termination reasons in session recordings and audit logs? How is session recording completion handled when termination is detected via transport close versus timeout?