# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: patch -->

## What Changed

- The Telegram authorized-user check is now type-tolerant. The legacy auth path compared the incoming numeric Telegram id against the configured `authorizedUserIds` with a strict membership check, so an id written as a string in config silently failed to match and the authorized user was treated as unknown (hitting the registration gate).
- The mini-onboarding auto-add now also compares ids loosely, so it no longer appends a duplicate when the configured list already holds the id as a string.

## What to Tell Your User

- **Telegram access fix**: "If your Telegram user id was ever written as text in my config, I would have wrongly treated you as a stranger and asked you to register. That comparison now ignores whether the id is stored as a number or text, so the right person is recognized either way."

## Summary of New Capabilities

| Capability | How to Use |
|-----------|-----------|
| Type-tolerant Telegram authorization | No action needed. Existing `authorizedUserIds` entries are honored whether they are stored as numbers or strings. |

## Evidence

Added a focused unit test (`telegram-auth-id-type-tolerant.test.ts`, 5 cases) covering number-configured ids, string-configured ids (the regression), mixed lists, unauthorized rejection, and the empty/open passthrough. `tsc --noEmit` is clean. CI is the authority across the full shard matrix.
