CORRECT ovn-central root cause: NOT rdns_mode -- metal-internal is isolated (no reachable resolver) ...

Autonomous step-1 measurement refuted the committed rdns_mode diagnosis:
- rdns_mode=2 on ALL planes; the PTR EXISTS at the region BIND (10.12.8.6
  answers dig -x 10.12.12.122). "enable rdns_mode" is a VOID no-op.
- metal-internal is deliberately isolated (link-scoped routes only; ping -I
  eth1 10.12.8.6 -> NO ROUTE). The region controller has no metal-internal
  interface, so no resolver is reachable on that plane.
- systemd-resolved scopes the reverse of a container's OWN metal-internal
  address to eth1 -> no reachable resolver -> empty cert CN. Discriminating
  test (advisor-directed): both links set to the reachable 10.12.8.6 STILL
  failed "No route to host" -> NOT a dns_servers change either.

The fix is therefore a DECISION (decouple ovn-central's cert CN from
metal-internal reverse-DNS), a precondition for any redeploy (same MAAS,
verify at provision time). VOID banners + CORRECTION blocks added to the
reeval, remediation-plan, sweep, and CURRENT-STATE. Refutation of LP #2044324
and the vault-issuance rule are unchanged and stand.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

audit: ovn-central cert reeval + remediation plan + Stage-5 misses sweep ...

Re-evaluation of the prior (wrong) ovn-central "awaiting server certificate
data" diagnosis, from fresh live measurement + 3 source-level agents + an
adversarial review. Corrected root cause: ovn-central derives its cert CN from
a REVERSE lookup of its metal-internal address; metal-internal is the only
plane of six without reverse-DNS PTRs, so get_hostname() -> None -> empty
common_name -> vault issues no server cert -> ovn-central blocks. LP #2044324
is NO MATCH; no upstream fix / channel bump helps.

- ovn-central-cert-reeval-20260803.md      -- root cause, evidence, what the
  prior diagnosis got wrong, ranked remedies, why-no-PTR.
- ovn-central-cert-remediation-plan-20260803.md -- gated rdns_mode + re-fire
  sequence with corrected (non-false-green) acceptance criteria.
- stage5-sweep-misses-20260803.md          -- F1 metal-internal rdns outlier +
  standup tooling never sets rdns_mode; F2 four hacluster units blocked on
  stale pre-D-141 IPv6 VIP CIB resources; F3 octavia error is downstream of
  neutron VIP TLS. Meta: incomplete-transition tails.

All findings MEASURED read-only this session; every remediation step is
operator-gated and NOT executed. SEC-033 (relation databag exposes vault
global-client key) noted for separate filing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf