Operator ruling, exact utterance: 'ovn-central should be in metal-internal.'
Follow-on: 'Complete a bundle sweep for any other bindings that are bound to a
plane that does not match the planes intended purpose.'

ovn-central's '' default binding moves metal-admin -> metal-internal. Its
certificates + ovsdb* endpoints already live on metal-internal; moving the
default makes it single-space for cert resolution, dodging LP #2044324 (the
multi-space ovn-central cert bug this deploy hit). D-052 isolation unchanged for
every other app.

Bundle plane-purpose sweep (all 56 apps, capture
binding-plane-purpose-sweep-20260803.txt): classified every binding against
D-052's plane purposes, verified each flag against the relation topology. Exactly
ONE other real deviation: openstack-dashboard:cluster on metal-admin where D-052
places cluster peers on metal-internal (sole outlier of 14 cluster-carrying apps;
benign but off-intent) -- PROPOSED, not ruled. Four flags verified non-issues:
octavia:ovsdb-cms is dangling (no relation); ceph-radosgw public/object-store/
cluster are gateway endpoints correctly placed.

Not yet applied -- bundle edit + live juju bind are the next gated step.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf