fix: remove conflicting ATS CA pin and verify physical LiveKit trust

docs/ENGINEERING_LEARNINGS.md

@@ -38,6 +38,10 @@ Read [PROJECT_STATUS.md](PROJECT_STATUS.md) for the current product scope.
 - Gate live TLS tests with explicit opt-in and print started/skipped scope; a test
   returning early is not runtime proof. Regenerate XcodeGen for added test membership.
   Physical test bundles require a development team override, not just app signing.
+- Proven device ATS trap: `NSPinnedCAIdentities` can still reject a manually
+  full-trusted self-signed server with -1202/-9807. Same-phone A/B removal of this
+  redundant rule made system HTTPS and actual LiveKit WSS pass. Retain exact app
+  HTTP pin + normal SDK system trust; do not infer validity-length cause from dates.
 - Certificate profiles require public-only verified data, user installation/full
   trust, and persistent hosting. Copying a file into an active container is erased
   at redeploy. Exact nginx alias may expose a public profile from cert mount; never

docs/PROJECT_STATUS.md

@@ -104,8 +104,19 @@ unit suite:58 passed, including two explicit-opt-in live TLS cases skipped in of
 run. Actual opted-in physical HTTPS test passed separately. New live tests use
 environment-only credentials, never fixtures/source/argv. Updated signed phone
 build passed (`/tmp/hope-square-phone-build.log`) and app installed/launch succeeded
-on the iPhone14ProMax (`dev.shane.voice`, 18:00 local). Real WSS/login after profile trust and
-physical speech remain user qualification.
+on the iPhone14ProMax (`dev.shane.voice`, 18:00 local). Physical speech remains user qualification.
+
+Follow-up: user installed profile/full trust but SDK still reported validation cert
+invalid. Reproduced physically: exact pinned HTTPS passed; system URLSession HTTPS
+failed -1202/-9807. Controlled A/B removed redundant `NSPinnedCAIdentities` in
+XcodeGen (normal iOS trust, HTTPS/WSS and exact HTTP leaf pin remain unchanged).
+System trust then passed on same phone, establishing ATS CA-only rule conflict,
+not proven certificate validity-length rejection. Final physical native live test
+**3 passed**: pinned HTTPS, system-trusted HTTPS, and admin login/me/bootstrap →
+actual LiveKit SDK authenticated WSS connect/disconnect → logout; no microphone
+enabled. Evidence `/tmp/hope-phone-wss-qualified.log`. John Doe remains deleted.
+Signed corrected build passed `/tmp/hope-square-tls-fixed-build.log`.
+
 
 ## Current direction