Config

Changes to timeouts / paths require a service restart

Global
Time before auto-deny in Telegram
Files above this count are batched
CLOSE_WRITE snapshots kept for N days
Watch Paths

Directories monitored by inotify (eBPF intercepts system-wide regardless)

Telegram
read-only
read-only