Autonomous step-1 measurement refuted the committed rdns_mode diagnosis:
- rdns_mode=2 on ALL planes; the PTR EXISTS at the region BIND (10.12.8.6
  answers dig -x 10.12.12.122). "enable rdns_mode" is a VOID no-op.
- metal-internal is deliberately isolated (link-scoped routes only; ping -I
  eth1 10.12.8.6 -> NO ROUTE). The region controller has no metal-internal
  interface, so no resolver is reachable on that plane.
- systemd-resolved scopes the reverse of a container's OWN metal-internal
  address to eth1 -> no reachable resolver -> empty cert CN. Discriminating
  test (advisor-directed): both links set to the reachable 10.12.8.6 STILL
  failed "No route to host" -> NOT a dns_servers change either.

The fix is therefore a DECISION (decouple ovn-central's cert CN from
metal-internal reverse-DNS), a precondition for any redeploy (same MAAS,
verify at provision time). VOID banners + CORRECTION blocks added to the
reeval, remediation-plan, sweep, and CURRENT-STATE. Refutation of LP #2044324
and the vault-issuance rule are unchanged and stand.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf