docs(04-04): leg-5 carrier note — browser hits the session wall by design; t.me startapp link is the on-device procedure

.planning/phases/04-destination-search-kl-gazetteer/04-DEVICE-GATE.md

@@ -108,10 +108,17 @@ real client proves Telegram actually delivers the button's query string into the
 
 ### 5. The honest unknown-id state
 
-- [ ] Open the Mini App with a deliberately wrong id — append `?dest=not-a-real-place` to the
-  deployed URL (browser or a crafted link): expected the "DESTINATION / Destination
-  unavailable / That place is not in this build. Search again from the bot." surface.
-- [ ] FAIL SYMPTOMS: a blank map, a fabricated pin, a crash — none may occur.
+- **Carrier note (orchestrator, 2026-10-24):** a plain browser CANNOT observe this leg —
+  with no initData the boot stops at the session wall (denied card) before the destination
+  reader runs. Verified live 2026-10-24: `?dest=not-a-real-place` in desktop Chrome →
+  the denied card (`leg5-browser-sessionwall.png`). That is correct off-Telegram behavior,
+  NOT this leg's verdict.
+- **On-device procedure:** in ANY chat, send yourself the deep link
+  `https://t.me/arah2bot?startapp=not-a-real-place` and tap it — Telegram opens the Mini
+  App with `start_param=not-a-real-place` (the secondary carrier), the session validates,
+  and the reader must show the honest surface.
+- [ ] Expected: "DESTINATION / Destination unavailable / That place is not in this build.
+  Search again from the bot." — never a blank map, never a fabricated pin, never a crash.
   Verdict: `UNVERIFIED`
   Observed / Symptom: ______________________________________