fix(triage): pass the TL object to loadChats, not a bare symbol

Step 1 called (telega--loadChats 'main). That's a raw TL wrapper, so it drops its argument into the request as :chat_list untouched. The symbol went out on the wire as main, and the C parser aborts on any value it can't start. Every telegram sweep has been killing telega-server. Both call sites now pass '(:@type "chatListMain"), which is what telega's own callers use.

I merged this with the down-is-launch fix parked since 2026-07-24 rather than applying either alone. The parked file still carried the bad call, and its new prose cited the segfault gotcha as the reason docker mode is mandatory. That's the same gotcha this rewrites to say the deaths were our own bad argument. Shipping them in sequence would have left the file arguing against itself, so I reconciled the prose in both places and kept the docker requirement on its own evidence.

The gotcha keeps two caveats. A crash with no triage verb running needs its own investigation. And a short chat list is a real short list, because 19 was the true account size measured at both ends, not a scan truncated by this bug.

1 files changed, 33 insertions, 0 deletions

diff --git a/working/triage-telegram-segfault-rootcause/note-0615-superseded.org b/working/triage-telegram-segfault-rootcause/note-0615-superseded.org
new file mode 100644
index 0000000..d948d07
--- /dev/null
+++ b/working/triage-telegram-segfault-rootcause/note-0615-superseded.org
@@ -0,0 +1,33 @@
+#+TITLE: Intro note for the triage-intake.telegram.org file sent alon
+#+SOURCE: from .emacs.d
+#+DATE: 2026-07-28 06:15:25 -0500
+
+Intro note for the triage-intake.telegram.org file sent alongside this.
+
+WHAT CHANGED
+
+Step 1 called (telega--loadChats 'main). That symbol kills telega-server outright. Fixed to (telega--loadChats '(:@type "chatListMain")) at both call sites, and the SEGFAULT GOTCHA section is rewritten, because it documented the wrong cause and actively misdirected later investigations.
+
+THE CHAIN
+
+telega--loadChats is a raw TL wrapper. It drops its argument into the request as :chat_list with no conversion. telega-server--send prin1's the plist, and telega--tl-pack passes atoms through untouched, so the symbol goes out bare as main. The C parser in server/telega-dat.c, tdat_plist_value, accepts only ( [ " - digit t : or n to start a value. It hits m, prints 'Unexpected char m in plist value', and calls assert(false), which aborts the process. The m in the error is the first character of main.
+
+The symbol shorthand is real but lives in a different layer. telega-filter.el and telega-folders.el convert (eq cl-fspec 'main) into '(:@type "chatListMain"). The raw TL layer never does. telega's own callers always pass the object.
+
+PROVED, NOT INFERRED
+
+From a live Ready server, (telega--loadChats 'main) killed it within seconds and added one coredump with that exact assertion. A restart plus the corrected call survived three consecutive loads with no new coredump and no assertion.
+
+WHY THE OLD GOTCHA MATTERS
+
+It recorded the deaths as spontaneous musl memory corruption and stated 'the verbs are sound'. That is what sent later work at the docker image and tdlib versions rather than at this file. The corrupted stack in the coredump backtraces is what an assert abort looks like; it was read as independent evidence of a memory bug. Two separate investigations lost time to it, and .emacs.d shipped an image pin last night that was aimed at the wrong target.
+
+The rewritten section keeps a caveat: if crashes ever appear with no triage verb running, that is a genuinely separate cause and needs its own investigation rather than reuse of the old story.
+
+BLAST RADIUS
+
+Every project running telegram triage from this plugin has been killing telega-server on every sweep. Work reported it as intermittent Telegram coverage loss, their scan stalling at 19 chats of roughly 50; that stall is this bug seen from outside, since the initial sync populates the hash and then the bad loadChats kills the server before more arrive. I am notifying work directly so they can patch locally before their next sync.
+
+FOLLOW-UP WORTH CONSIDERING
+
+A general rule for the plugin family, or a lint: any argument handed to a telega--* TL wrapper must be a TL object or a plain string, number, or list, never a bare symbol. The failure mode is a hard process abort rather than an elisp error, so ignore-errors around such a call catches nothing, which is exactly why this hid for so long.