Using the current version 6.0.1, and building with MABS 7.0. Tests below were done on Android 8, SG7 Edge

Our app is currently using <something>.outsystemsenterprise.com, and the full domain is entered in pinning.json, no wildcards, and the current fingerprint is U6vSutzZQ4RuSJwV2i0vUO6qtGcX5vGltvpGnNd5BEg=

To test whether it works...

1. I completely removed the dev environment's domain from pinning.json, so that the domain and fingerprints for the dev environment are missing from the file. 
2. Updated pinning.json into the application module, and publish
3. rebuild the application
4. Removed/deleted the old version of the app on the phone to be sure
5. Download the application to the phone
6. Use Chrome USB remote debugging to inspect network requests, it still connects to the domain, and everything works fine.
7. Download the application to PC, use APKtool to extract the pinning.json file
8. I confirm that pinning.json DOES NOT have the domain that the app is connecting to. 

Another test:

1. I re-added the domain eg. "client-dev.outsystemsenterprise.com", with fake hashes e.g. "aaa...", bbb..."
2. followed the same steps above
3. The app still works, and I confirm that the pinning.json file in the apk contains the correct domain, with the fake hashes.

According to the documentation, "Calls to server actions stop working if there's a hash mismatch." 

This doesn't seem to be the case.