Executive summary
Recurring Telegram updates were traced to the standalone Daylab process restored during Hiro's morning restart.
Daylab is configured to run every 30 minutes. Its self-improvement finalization path unconditionally schedules a Telegram completion briefing after every cycle when Hiro's Telegram notification marker is enabled.
The Telegram marker was re-enabled when the bot was restarted, so the high-cadence evidence collector and the general notification channel became coupled.
Eleven Daylab cycles completed between 08:32 and 13:31, closely matching the observed recurring-update cadence.
All Windows Hiro scheduled tasks remain disabled, the durable sandbox-notification outbox is empty, and the Telegram bot's polling loop does not itself create unsolicited updates.
No settings or processes were changed during diagnosis.