- ROOT: the '' default is the MANAGEMENT binding (primary NIC + juju agent<->controller),
  universal '' = metal-admin across all 56 apps. The 08-03 amendment ('' -> metal-internal,
  never deployed until 08-04) left ovn-central single-legged on the isolated metal-internal
  plane -> no route to controller (10.12.8.5:17070 unreachable) -> agent-binary download failed
  -> ovn-central never started. Its cert rationale was already withdrawn; cert CN is fixed
  independently by the /etc/hosts postruncmd (dc-node-etchosts.sh, Step 1.2b).
- bundle.yaml: ovn-central '' -> metal-admin; functional endpoints (certificates, ovsdb*,
  coordinator) STAY metal-internal. provider-bundle-check 55/55, repo-lint 0 fail.
- D-052 RE-AMENDMENT 2026-08-05 recorded (GA-R5, operator utterance quoted). Scope: ovn-central
  only; every other binding re-verified correct vs dataflow (ruled exceptions: D-072 dashboard,
  D-106 designate:dnsaas).
- NEW docs/network-space-binding-reference.md: 6-plane roles + CIDRs + RHOSP analogs, the ''
  management-binding rule, full 56-app placement matrix, dataflow confirmation, ruled exceptions.
- Stage 5 remains OPEN. NEXT: re-stage bundle to rack, re-home ovn-central on the live model,
  then vault init (operator-only) -> ovn cert -> converge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728