[SandyTAP]

Canonical Layer 232 comes from official Telegram Desktop dev@850fb90eb6db96c124b6da1349060f9ed00f4fe4. The last change to Telegram/SourceFiles/mtproto/scheme/api.tl is the same commit; manifest.json locks its Git blob 8319b7df634d145390c299404129fd161a5dbd2a and the normalized SHA-256 76922ce265441d3f2f5188f56b69b41e1cb11354657ea547707507f8c3b93826. The TDesktop source path is clean and the schema commit is reachable from origin/dev. No client patch is part of the schema import.

Relative to Layer 231 the schema adds 24 constructors and reshuffles seven constructor ids. Canonical moves to 232; exact profiles 225–231 remain available.

Constructor	Layer 231	Layer 232
channel	#d49f34c6	#7ad15240 (adds linked_community_id)
channelFull	#a04e8d3a	#c4c4dd40 (adds share_theme)
userFull	#6cbe645	#b90c2afd (adds wallet_card, note)
messageReplyHeader	#1b97dd66	#ddb5ab75 (adds quote_rich)
inputReplyToMessage	#3bd4b7c2	#75c1ad70 (adds quote_rich)
wallet.nftItem	#3441fd1c	#173dfaf3 (adds gift)
payments.getStarGiftWithdrawalUrl	#d06e93a8	#c8ca817b (password:InputCheckPasswordSRP → tmp_password:bytes)

New constructors: messageActionNoPaidMessagesTokenUsed, walletTransactionPeerChannel, walletTransactionPeerTelegramGift, exportedNoPaidMessagesToken, shareThemeDefault, shareThemeEmojiBackdrop, shareThemeGift, inputShareThemeGift, shareThemeBackdropOption, shareThemeBackdropsNotModified, shareThemeBackdrops, inputWalletCardSticker, wallet.cardSticker, wallet.card, payments.starGiftDepositPayload, contacts.exportNoPaidMessagesToken, contacts.importNoPaidMessagesToken, messages.setShareTheme, messages.getShareThemeBackdrops, payments.withdrawStarGift, payments.depositStarGift, payments.displayStarGift, payments.deleteStarGift, wallet.setCardStickers.

No update constructor or pts/pts_count field changed; the MTProto service schema is unchanged.

Compatibility decisions

• payments.getStarGiftWithdrawalUrl in exact 232 carries tmp_password:bytes. A non-empty temporary password is a Telegram temporary-password proof this fork does not issue, so a server without account.getTmpPassword must refuse it rather than treat it as a 2FA proof.
• The historical password:InputCheckPasswordSRP is discarded on the way to canonical 232. The SRP material has no canonical counterpart and must never be promoted into a temporary password. Dropping it keeps the empty-password check authoritative: an account that owns a 2FA password still fails closed, and a passwordless account is unaffected.
• A canonical tmp_password projected to exact 225–231 is rejected. It cannot be encoded as the legacy SRP challenge, and inventing an empty SRP challenge would downgrade an authenticated request to an unauthenticated one.
• A historical profile without tmp_password projects to canonical 232 as empty bytes: "no temporary password supplied".
• New constructors are unavailable in historical profiles. No alias, no byte bridge.
• The seven reshuffled constructor ids are retagged per profile; every exact profile keeps its own wire id.

The reviewed policy document grows from 249 to 270 entries; the 21 new entries are exactly the payments.getStarGiftWithdrawalUrl projections above. The locked generator budgets were re-measured for the eighth profile: 714 projected families, 2538 rewrite variants, 957 unavailable variants, 259 body obligations, 4 result obligations, 1899/1148/969 execution plans, 1527 typed codec wires and 399 unprofiled wrapper invariants.

Verification

• Schema import verified against the locked Git blob and normalized SHA-256; canonical_layer moved to 232 and layer-232.tl was written with its provenance.
• go generate . is deterministic and reproduced the canonical tg model plus the tlprofile sidecar with Profile232 and ProfileCanonical = 232.
• go test ./tlprofile/... ./gen/... ./cmd/gotdgen/... is green.
• Downstream telesrv (internal/rpc, internal/mtprotoedge) builds, vets and passes its full suite against this release.

The review record is _schema/layers/LAYER232_REVIEW.md.