Blast radius measured (operator-requested): OVN Northbound cluster status
joining cluster / follower / vote unknown, nothing listening on 6641/6642 -- the
OVN DB cluster is not formed and not serving. Without the server cert ovn-central
cannot start TLS OVSDB, so the cluster never forms. Gates tenant networking.

Why it worked before (answers the dropped-binding question, git-traced): NOT a
dropped binding. Commit 5c2b3ab (D-052, 2026-06-25) deliberately split the flat
metal space into metal-admin + metal-internal. Pre-D-052 ovn-central bound
*internal-bindings = default:metal (one space), unambiguous cert resolution --
the shape of the successful past deploys. LP 2044324 is multi-space-specific;
this VR1 deploy is the first real exercise of the D-052 multi-space bindings, so
first to hit it. API charms are multi-space too and work -- defect is
ovn-central-charm-specific. Layered hardening working: D-052 isolation surfaced a
latent charm limitation.

Candidate fix (operator-gated, amends D-052 for one app, needs live verify): move
ovn-central default binding metal-admin -> metal-internal for single-space cert
resolution, leaving D-052 intact elsewhere. Alternatives: os-*-network config;
escalate LP.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf