instar 1.3.254 → 1.3.255

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.254",
+  "version": "1.3.255",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-04T23:23:29.388Z",
-  "instarVersion": "1.3.254",
+  "generatedAt": "2026-06-04T23:45:49.570Z",
+  "instarVersion": "1.3.255",
   "entryCount": 198,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d62dbd5537f6bdb0fa68efe3e2192ee204af4d86a7e3eed8fe2c77ebfa635e98",
+      "contentHash": "2792a505f72ae4db22d3b17799d566973c98bb25daf9f658635a661a1913f275",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "4d50cc3ebd4b430069d5957fbed44bdadd487c17386b680f0cafe66a33c381e2",
+      "contentHash": "52d0a763d3391b37c897a5895ca73c5d03b591272cf9eb21697c1f9a4c9765aa",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.255.md

@@ -0,0 +1,38 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**Long Telegram inbound messages now land inside the agent project instead of `/tmp`.**
+When Telegram sends a message too large to inject directly, instar writes the
+full payload to a file and injects a short "read this file" reference into the
+agent session. That file used to live under `/tmp/instar-telegram`, which is
+outside Gemini CLI's workspace sandbox. Gemini agents could receive the
+reference but could not read the file. The Telegram inbound file directory is
+now shared through one helper and resolves to `.instar/telegram-inbound/` under
+the target project directory.
+
+## What to Tell Your User
+
+Nothing to configure. Long Telegram messages and Telegram auto-spawn context
+files remain transient, but sandboxed agents can now read the referenced files
+because they live under the project they are already allowed to access.
+
+## Summary of New Capabilities
+
+- `getTelegramInboundDir(projectDir)` centralizes the Telegram inbound file
+  location at `<projectDir>/.instar/telegram-inbound`.
+- Telegram injection, Telegram bootstrap context files, Secret Drop-triggered
+  Telegram session context, Telegram forward auto-spawn context, and stale-file
+  cleanup all use the same helper.
+- `.instar/telegram-inbound/` is ignored by git because inbound message payloads
+  are transient runtime data.
+
+## Evidence
+
+- Focused tests: `npm test -- --run tests/unit/session-telegram-inject.test.ts tests/e2e/input-guard-e2e.test.ts tests/unit/server-temp-cleanup.test.ts tests/unit/bootstrap-file-threshold.test.ts tests/unit/telegram-message-injection.test.ts`
+- The regression coverage verifies a long Telegram message writes under the
+  project-local inbound directory, the injected reference points there, and the
+  referenced file contains the tagged full message.

package/upgrades/side-effects/telegram-inbound-project-dir.md

@@ -0,0 +1,147 @@
+# Side-Effects Review — Telegram inbound files under project dir
+
+**Version / slug:** `telegram-inbound-project-dir`
+**Date:** `2026-06-04`
+**Author:** `instar-codey`
+**Second-pass reviewer:** `not run — sub-agent tool requires an explicit delegation request in this session`
+
+## Summary of the change
+
+Long Telegram inbound payload files and Telegram auto-spawn context files move
+from `/tmp/instar-telegram` to `<projectDir>/.instar/telegram-inbound` through a
+single helper, `getTelegramInboundDir(projectDir)`. Runtime callsites updated:
+`src/core/SessionManager.ts`, `src/commands/server.ts`, and
+`src/server/routes.ts`. The cleanup function now targets the same project-local
+directory, `.gitignore` excludes it, and focused tests assert that long-message
+files land under the configured project directory and that injected references
+point there.
+
+## Decision-point inventory
+
+- Telegram long-message file redirect in `SessionManager.injectTelegramMessage`
+  — modify — same threshold and same injected reference shape, but the backing
+  file path is project-local.
+- Telegram bootstrap/context side-file creation in `src/commands/server.ts` and
+  `src/server/routes.ts` — modify — same session spawn behavior, but side files
+  are readable from sandboxed project workspaces.
+- `cleanupTelegramTempFiles` — modify — same 7-day file-only cleanup policy, but
+  applied to the new project-local inbound directory.
+- No new block/allow authority is added.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. This change does not reject
+messages, users, topics, sessions, or actions.
+
+---
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable. Remaining failure modes:
+if the configured `projectDir` is wrong, inbound files will consistently be
+written under that wrong project. That is not newly introduced by this change;
+the same config value already controls session startup, state paths, and other
+project-local behavior. If a sandbox denies `.instar/telegram-inbound` despite
+allowing the project root, the agent would still receive an unreadable reference,
+but that would indicate a broader sandbox/config mismatch.
+
+---
+
+## 3. Level-of-abstraction fit
+
+The helper belongs in the shared messaging layer because the path is a Telegram
+messaging primitive used by both core session injection and server-side
+Telegram auto-spawn routes. It is not a policy gate and should not live in
+`SessionManager` alone, because route code also writes context side files. It is
+also not a config migration: this is transient runtime storage derived from the
+already-required project directory.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+**Does this change hold blocking authority with brittle logic?**
+
+- [ ] No — this change produces a signal consumed by an existing smart gate.
+- [x] No — this change has no block/allow surface.
+- [ ] Yes — but the logic is a smart gate with full conversational context (LLM-backed with recent history or equivalent).
+- [ ] Yes, with brittle logic — STOP. Reshape the design. Brittle detectors must not own block authority.
+
+This is a storage-location change for already accepted Telegram payloads. It
+does not inspect message meaning, classify user intent, block delivery, or
+filter content.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** no gate is shadowed. Existing InputGuard and topic/session
+  routing still run before message injection and are untouched.
+- **Double-fire:** no new writer is added; existing writers now call the shared
+  helper. The same message creates the same one payload file as before.
+- **Races:** cleanup still removes only files older than 7 days. It now shares
+  the same directory helper as the writers, reducing drift. The cleanup window
+  is far longer than any active read window, so it should not race fresh
+  inbound messages.
+- **Feedback loops:** the injected path is read by the receiving agent. Moving
+  the file under `.instar/telegram-inbound` changes the path text the agent
+  sees, but does not feed back into routing, dedup, or gate decisions.
+
+---
+
+## 6. External surfaces
+
+This is visible to agents receiving long Telegram messages: the injected file
+reference now points under `.instar/telegram-inbound` in the project instead of
+`/tmp/instar-telegram`. That is intentional so Gemini CLI can read the file
+inside its workspace sandbox. Users should not see a conversational difference
+except that long Telegram messages are readable by sandboxed agents. No
+Telegram API behavior changes, no Slack behavior changes, no database schema
+changes, and no persistent committed state is introduced. The new directory is
+ignored by git because payloads may include private user message content.
+
+---
+
+## 7. Rollback cost
+
+Pure code rollback. Reverting the helper use would put future files back under
+`/tmp/instar-telegram`; no database migration or state repair is required.
+Existing transient files under `.instar/telegram-inbound` can be left in place
+or removed by cleanup if the rollback keeps that cleaner. User-visible risk
+during rollback is limited to sandboxed agents losing readability of long
+Telegram inbound payloads again.
+
+---
+
+## Conclusion
+
+The review found the key risk is path drift across the multiple Telegram
+writers and cleanup, so the implementation uses one shared helper and updates
+tests that previously encoded `/tmp/instar-telegram`. The change is clear to
+ship with focused regression coverage on the relay-sensitive file reference
+path.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** `not run`
+**Independent read of the artifact:** `not available`
+
+Inbound messaging is relay-sensitive, but the multi-agent tool exposed in this
+session is restricted to explicit user-requested delegation. I did not spawn a
+reviewer under that constraint. The PR should receive human review on the
+runtime callsites and tests before merge.
+
+---
+
+## Evidence pointers
+
+- `npm test -- --run tests/unit/session-telegram-inject.test.ts tests/e2e/input-guard-e2e.test.ts tests/unit/server-temp-cleanup.test.ts tests/unit/bootstrap-file-threshold.test.ts tests/unit/telegram-message-injection.test.ts`
+- `rg` check found no remaining runtime `/tmp/instar-telegram` use in
+  `src/core/SessionManager.ts`, `src/commands/server.ts`, or
+  `src/server/routes.ts`.