diff --git a/web/src/telegram/safe-area.ts b/web/src/telegram/safe-area.ts
index ab98a37..87413e1 100644
--- a/web/src/telegram/safe-area.ts
+++ b/web/src/telegram/safe-area.ts
@@ -56,3 +56,28 @@ export function applySafeArea(insets: SafeInsets): void {
   root.setProperty("--safe-left", `${insets.left}px`);
   root.setProperty("--safe-right", `${insets.right}px`);
 }
+
+/*
+ * PX-04/D-03: the insets above are computed ONCE at boot — but a device
+ * rotation or a fullscreen transition can alter them mid-session
+ * (RESEARCH Pitfall 3), leaving the cockpit under a notch or a Telegram
+ * control. watchSafeAreaChanges re-resolves through the SAME union
+ * authority on the client's inset events — never a duplicated computation.
+ */
+export function watchSafeAreaChanges(wa: TelegramWebAppLike | null): void {
+  if (wa === null || typeof wa.onEvent !== "function") return;
+  wa.onEvent("safeAreaChanged", () => {
+    try {
+      applySafeArea(resolveSafeInsets(wa));
+    } catch {
+      /* a throwing inset event must never break the boot (T-07-06b) */
+    }
+  });
+  wa.onEvent("contentSafeAreaChanged", () => {
+    try {
+      applySafeArea(resolveSafeInsets(wa));
+    } catch {
+      /* a throwing inset event must never break the boot (T-07-06b) */
+    }
+  });
+}