fix: remove conflicting ATS CA pin and verify physical LiveKit trust

docs/PROJECT_STATUS.md

@@ -104,8 +104,19 @@ unit suite:58 passed, including two explicit-opt-in live TLS cases skipped in of
 run. Actual opted-in physical HTTPS test passed separately. New live tests use
 environment-only credentials, never fixtures/source/argv. Updated signed phone
 build passed (`/tmp/hope-square-phone-build.log`) and app installed/launch succeeded
-on the iPhone14ProMax (`dev.shane.voice`, 18:00 local). Real WSS/login after profile trust and
-physical speech remain user qualification.
+on the iPhone14ProMax (`dev.shane.voice`, 18:00 local). Physical speech remains user qualification.
+
+Follow-up: user installed profile/full trust but SDK still reported validation cert
+invalid. Reproduced physically: exact pinned HTTPS passed; system URLSession HTTPS
+failed -1202/-9807. Controlled A/B removed redundant `NSPinnedCAIdentities` in
+XcodeGen (normal iOS trust, HTTPS/WSS and exact HTTP leaf pin remain unchanged).
+System trust then passed on same phone, establishing ATS CA-only rule conflict,
+not proven certificate validity-length rejection. Final physical native live test
+**3 passed**: pinned HTTPS, system-trusted HTTPS, and admin login/me/bootstrap →
+actual LiveKit SDK authenticated WSS connect/disconnect → logout; no microphone
+enabled. Evidence `/tmp/hope-phone-wss-qualified.log`. John Doe remains deleted.
+Signed corrected build passed `/tmp/hope-square-tls-fixed-build.log`.
+
 
 ## Current direction