From c062ebaee1fc48800613af92f12d3fd7a2cc202f Mon Sep 17 00:00:00 2001
From: araharah-executor <executor@araharah.local>
Date: Fri, 23 Oct 2026 01:25:35 +0800
Subject: [PATCH] =?UTF-8?q?docs(03-04):=20log=20debug=20round=205=20?=
 =?UTF-8?q?=E2=80=94=20diagnostic=20probe=20armed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../03-DEVICE-MATRIX.md                       | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
index c966fda..3126e9a 100644
--- a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
+++ b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
@@ -183,3 +183,27 @@ denied card (the one shown at denial) never got the CTA.
 **Fix (deploy `253d7a3e`):** both denied-shaped instances now build with the
 Telegram-only settings CTA. Deployed `index.html` verified to carry
 telegram-web-app.js (round 3 fix verified live via curl).
+
+## 2026-10-23 debug round 5 (buttons render but all appear dead)
+
+**Symptom:** LOCATION SETTINGS now visible (round 3 confirmed — the app IS
+served and parsed), but all three CTAs appear to do nothing; strip shows
+LOCATION OFF.
+
+**Working hypothesis:** the user may be viewing the app OUTSIDE a real
+Telegram webview (plain Chrome address bar). With round 3's script tag,
+window.Telegram.WebApp now exists even off-Telegram (SDK defines it
+unconditionally), so LOCATION SETTINGS renders — but initData is empty
+there → every session POST 401s → TRY AGAIN/ASK VIA CHAT both bounce back
+to denied instantly (visually indistinguishable). openSettings() no-ops
+off-Telegram.
+
+**Fix (deploy `7cbb73f9`, commit `f445399`):** on-screen DIAGNOSTIC PROBE,
+bottom-left, category-only: `WA <version>/<platform> · q <initData-chars> ·
+s <session-category> · loc <state>`. No payload, no coordinates, no ids —
+category-only law (D-14); removed at the device-matrix exit. Expected
+readings:
+- real Telegram webview: `WA 8.0+/android|ios` (not `none`), `q` > 0
+- plain browser: `WA unknown/unknown · q 0ch · s malformed/tampered`
+
+**Re-test:** the probe line is what to report, verbatim, in the next message.