N1 retake — head APK bbb9042e92b21c2341a392677bbb9715468359d7; native fingerprint 0b110f6b762ef37e6f8d41fced4244ec904ac21a.
Root A regenerated; same new root and leaf as B1. Head setup successfully paired against it before removal: descriptor/token/ticket, WSS 101, shell read, and Connected screenshot. Thus the saved credential was valid. No alternate advertised HTTP/public/relay route. Root was never installed in system store. Relaunch discards prior TLS/trust caches.
Narration / exact exported checkpoint frames:
00:02 User tab contains Android CA proof 25730.
00:18 certificate details display regenerated root SHA256 DB:AE:E9:55:37:87:BC:E9:86:56:52:20:FC:DE:24:25:E2:6F:6E:1B:F4:07:A9:78:A5:A4:26:D0:A9:22:0E:F4.
~00:31 Uninstall; 00:32 clean confirmation dialog; confirm removal; 00:36 User tab empty.
00:46 app relaunch logo. EXPLICIT CUT at 00:50: omit raw 00:50–01:15 blank Metro startup. Resume the same recording at raw 01:15. 00:52 loaded app displays Reconnecting to fs-13; cached New thread is not live data.
EXPLICIT CUT at 01:05 to separate contiguous saved-route retry take starting 01:36:01 UTC. Manual reconnect pressed at 01:36:03 UTC; video ~01:07 Connecting; 01:10 settled network rejection/offline state, held through 01:19. TLS certificate-unknown alerts at 01:36:04.500, 07.402, 10.125 UTC correlate to that retry.
HTTPS discovery is rejected before WSS. This does not independently exercise WSS rejection. No fresh successful read after removal. The 01:34:26 explicit-root curl control returned 200 and is labeled separately below; its accepted TLS/HTTP does not belong to the app.
Retained segments: N1-removal-raw.mp4 [0,50), [75,90); N1-retry-raw.mp4 [0,end), plus three-second final frame hold. Each segment contiguous; top 80 px status bar masked. No blank/ghosted frame at narrated settled checkpoints. The retry export initially failed recorder ownership confirmation; same-session record stop retry exported the 16.2s clip, visually inspected in full checkpoint review.

Redaction: no request queries, headers, pairing codes, tokens, credentials, cookies or message payloads. TLS alerts are server observations of client trust abort. UTC and video time are correlated approximately; Android screenrecord uses variable presentation timing.

DEVICE ACTIONS (UTC):
{"time": "2026-10-28T01:33:19.153462+00:00", "step": "N1-record-start", "phase": "start"}
{"time": "2026-10-28T01:33:20.909540+00:00", "step": "N1-record-start", "phase": "end", "status": 0}
{"time": "2026-10-28T01:33:34.156422+00:00", "step": "N1-open-certificate", "phase": "start"}
{"time": "2026-10-28T01:33:41.315985+00:00", "step": "N1-open-certificate", "phase": "end", "status": 0}
{"time": "2026-10-28T01:33:51.492583+00:00", "step": "N1-uninstall", "phase": "start"}
{"time": "2026-10-28T01:33:53.718162+00:00", "step": "N1-uninstall", "phase": "end", "status": 0}
{"time": "2026-10-28T01:33:54.152289+00:00", "step": "N1-confirm-removal", "phase": "start"}
{"time": "2026-10-28T01:33:56.021760+00:00", "step": "N1-confirm-removal", "phase": "end", "status": 0}
{"time": "2026-10-28T01:33:59.001341+00:00", "step": "N1-relaunch", "phase": "start"}
{"time": "2026-10-28T01:34:09.360932+00:00", "step": "N1-relaunch", "phase": "end", "status": 0}
{"time": "2026-10-28T01:34:42.268477+00:00", "step": "N1-settings", "phase": "start"}
{"time": "2026-10-28T01:34:45.592607+00:00", "step": "N1-settings", "phase": "end", "status": 0}
{"time": "2026-10-28T01:34:45.974215+00:00", "step": "N1-environments", "phase": "start"}
{"time": "2026-10-28T01:34:48.171832+00:00", "step": "N1-environments", "phase": "end", "status": 0}
{"time": "2026-10-28T01:34:48.576712+00:00", "step": "N1-private-detail", "phase": "start"}
{"time": "2026-10-28T01:34:49.871695+00:00", "step": "N1-private-detail", "phase": "end", "status": 1}
{"time": "2026-10-28T01:34:55.671853+00:00", "step": "N1-private-detail", "phase": "start"}
{"time": "2026-10-28T01:34:57.982250+00:00", "step": "N1-private-detail", "phase": "end", "status": 0}
{"time": "2026-10-28T01:35:06.141198+00:00", "step": "N1-expand-error", "phase": "start"}
{"time": "2026-10-28T01:35:09.154287+00:00", "step": "N1-expand-error", "phase": "end", "status": 0}
{"time": "2026-10-28T01:35:16.756953+00:00", "step": "N1-retry", "phase": "start"}
{"time": "2026-10-28T01:35:17.259206+00:00", "step": "N1-retry", "phase": "end", "status": 1}
{"time": "2026-10-28T01:35:20.676280+00:00", "step": "N1-record-stop", "phase": "start"}
{"time": "2026-10-28T01:35:27.860153+00:00", "step": "N1-record-stop", "phase": "end", "status": 0}
{"time": "2026-10-28T01:36:00.815832+00:00", "step": "N1-retry-record-start", "phase": "start"}
{"time": "2026-10-28T01:36:02.834573+00:00", "step": "N1-retry-record-start", "phase": "end", "status": 0}
{"time": "2026-10-28T01:36:03.279971+00:00", "step": "N1-manual-retry", "phase": "start"}
{"time": "2026-10-28T01:36:06.856437+00:00", "step": "N1-manual-retry", "phase": "end", "status": 0}
{"time": "2026-10-28T01:36:18.777964+00:00", "step": "N1-retry-record-stop", "phase": "start"}
{"time": "2026-10-28T01:36:19.658512+00:00", "step": "N1-retry-record-stop", "phase": "end", "status": 1}

PROTOCOL MILESTONES (UTC):
{"time": "2026-10-28T01:31:14.528Z", "type": "TLS_ACCEPT", "label": "private-ca", "protocol": "TLSv1.3", "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:14.548Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:14.816Z", "type": "HTTP", "label": "private-ca", "method": "POST", "path": "/oauth/token", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:15.782Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:16.182Z", "type": "HTTP", "label": "private-ca", "method": "POST", "path": "/api/auth/websocket-ticket/rpc", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:16.339Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:16.569Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/api/auth/session", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:16.857Z", "type": "TLS_ACCEPT", "label": "private-ca", "protocol": "TLSv1.3", "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:16.887Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/api/auth/session", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:16.928Z", "type": "WS_UPGRADE", "label": "private-ca", "path": "/ws", "status": 101, "generation": 1, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:17.951Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/api/orchestration/shell", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:18.181Z", "type": "TLS_ACCEPT", "label": "private-ca", "protocol": "TLSv1.3", "source": "private TLS proxy"}
{"time": "2026-10-28T01:31:18.206Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/api/auth/session", "status": 200, "source": "private TLS proxy"}
{"time": "2026-10-28T01:33:21.168Z", "type": "WS_CLOSE", "label": "private-ca", "generation": 1, "source": "private TLS proxy"}
{"time": "2026-10-28T01:34:26.468Z", "type": "TLS_ACCEPT", "label": "private-ca", "protocol": "TLSv1.3", "source": "explicit-root curl reachability control; not mobile"}
{"time": "2026-10-28T01:34:26.472Z", "type": "HTTP", "label": "private-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "explicit-root curl reachability control; not mobile"}
{"time": "2026-10-28T01:34:32.991Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:34:35.423Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:34:37.579Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:34:41.976Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:34:55.432Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:35:44.105Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ECONNRESET", "message": "socket hang up", "source": "private TLS proxy"}
{"time": "2026-10-28T01:36:04.500Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:36:07.402Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:36:10.125Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:36:18.589Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}
{"time": "2026-10-28T01:36:30.188Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0040233177F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "private TLS proxy"}