diff --git a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
index c966fda..3126e9a 100644
--- a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
+++ b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
@@ -183,3 +183,27 @@ denied card (the one shown at denial) never got the CTA.
 **Fix (deploy `253d7a3e`):** both denied-shaped instances now build with the
 Telegram-only settings CTA. Deployed `index.html` verified to carry
 telegram-web-app.js (round 3 fix verified live via curl).
+
+## 2026-10-23 debug round 5 (buttons render but all appear dead)
+
+**Symptom:** LOCATION SETTINGS now visible (round 3 confirmed — the app IS
+served and parsed), but all three CTAs appear to do nothing; strip shows
+LOCATION OFF.
+
+**Working hypothesis:** the user may be viewing the app OUTSIDE a real
+Telegram webview (plain Chrome address bar). With round 3's script tag,
+window.Telegram.WebApp now exists even off-Telegram (SDK defines it
+unconditionally), so LOCATION SETTINGS renders — but initData is empty
+there → every session POST 401s → TRY AGAIN/ASK VIA CHAT both bounce back
+to denied instantly (visually indistinguishable). openSettings() no-ops
+off-Telegram.
+
+**Fix (deploy `7cbb73f9`, commit `f445399`):** on-screen DIAGNOSTIC PROBE,
+bottom-left, category-only: `WA <version>/<platform> · q <initData-chars> ·
+s <session-category> · loc <state>`. No payload, no coordinates, no ids —
+category-only law (D-14); removed at the device-matrix exit. Expected
+readings:
+- real Telegram webview: `WA 8.0+/android|ios` (not `none`), `q` > 0
+- plain browser: `WA unknown/unknown · q 0ch · s malformed/tampered`
+
+**Re-test:** the probe line is what to report, verbatim, in the next message.