The Telegram bot, and the binding that makes a chat mean a book
One shared bot serves every customer, so a Telegram account id — which is not a credential — is bound to a book by a code produced by a signed-in human in a browser.
One bot for everybody was the only provisionable shape: creating a bot is an interactive chat flow with BotFather and the Bot API has no method for it, so a bot per customer could never have been made at signup.
That makes the bot public, and it makes from.id — an integer anyone can read
off their own account — the entire tenant boundary. Every other door into a book
presents a credential; this one presents a number. So the binding reuses the
device-authorization handshake: the customer starts it from their book’s page
while signed in, and the chat only ever carries the code. A message alone can
never create a link, and redeeming marks the row claimed so a code cannot bind a
second account.
An earlier plan had Telegram delivering straight to the book machine and waking it. That could never have worked — book machines have no public address — and it was wrong in the direction of assuming work was already done.