diff --git a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
index e0fed75..9364c5e 100644
--- a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
+++ b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md
@@ -153,3 +153,21 @@ but never invoked anywhere.
 the app from the menu button, on the denied card tap LOCATION SETTINGS →
 grant location in Telegram's pane → the app should reach LIVE without
 another tap. Legs 1/2/6 resume from there.
+
+## 2026-10-23 debug round 3 (definitive production root cause)
+
+**Symptom:** cards render but the app behaves as if there is NO Telegram at all —
+no initData (session always 401s), no LOCATION SETTINGS button, BackButton dead.
+Even the recenter/theme machinery could not function through real Telegram.
+
+**Root cause:** `web/index.html` never loaded `telegram-web-app.js`. Telegram does
+NOT auto-inject `window.Telegram` (03-RESEARCH.md line ~687 made the opposite call —
+erratum logged in RESEARCH). Every production symptom traces to `getWebApp()` → null.
+
+**Fix (deploy `3c25dd32`):** `<script src="https://telegram.org/js/telegram-web-app.js">`
+added to `<head>` before the module script. Builds + 33/33 gates green.
+Erratum recorded in 03-RESEARCH.md.
+
+**Re-test:** restart Telegram client, reopen web app from the menu button —
+expect the REAL boot (BOT-01 → BOT-02 → LIVE with an actual permission ask or
+a live LocationManager read + LOCATION SETTINGS available on denial).