diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index b02fc7c..1c3e22c 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2042,6 +2042,27 @@
   AWAITING OPERATOR DIRECTION. Expected-tail blocked units
   unchanged (ceph-rbd-mirror cross-DC, designate Stage 7, octavia awaiting-configure); nova-compute
   "services not running" appeared and self-cleared (transient).
+  **>>> BLAST RADIUS MEASURED (operator-requested) + THE "WHY NOW" ROOT CAUSE. <<<**
+  **BLAST RADIUS: REAL, gates tenant networking.** `ovs-appctl cluster/status OVN_Northbound`
+  on ovn-central/0 reads **"Status: joining cluster, Role: follower, Vote: unknown"** and
+  **nothing listens on 6641/6642** -- the OVN NB/SB database cluster is NOT formed and NOT
+  serving. Without the server cert ovn-central cannot start its TLS OVSDB listeners, so the
+  cluster never forms; ovn-chassis "active" is optimistic (no DB to reach). This blocks a
+  functional OVN datapath. **WHY IT WORKED BEFORE AND NOT NOW, git-traced (answers the operator's
+  question -- it is NOT a dropped binding):** commit `5c2b3ab` (**D-052**, ADOPTED 2026-06-25)
+  deliberately split the single flat `metal` space into `metal-admin` + `metal-internal`
+  (three-plane isolation). Pre-D-052 ovn-central bound `bindings: *internal-bindings` = `"":
+  metal` (ONE space), where cert resolution is unambiguous -- the shape of every SUCCESSFUL past
+  deploy. LP #2044324 is a MULTI-SPACE-specific bug; **this VR1 deploy is the first real exercise
+  of the D-052 multi-space bindings**, so it is the first to hit it. The API charms (keystone
+  et al.) are multi-space too and get certs fine -- the defect is specific to the ovn-central
+  charm's cert-address resolution across multiple spaces. **This is layered-hardening working:
+  adding D-052 isolation surfaced a latent charm limitation.** CANDIDATE FIX (unverified, touches
+  a RULED decision so operator-gated): give ovn-central single-space cert resolution -- e.g. move
+  its `""` default binding metal-admin -> metal-internal (where its certs + ovsdb already live),
+  making ovn-central effectively single-space while leaving D-052 isolation intact for every other
+  app. Alternatives: os-internal/admin/public-network config; escalate LP #2044324. Needs an
+  operator ruling (it amends D-052 for one app) and live verification.
   **>>> PRE-VAULT-INIT END STATE REACHED; VAULT PREFLIGHT PASSES `PROCEED` 2026-08-03. <<<**
   After the stall fix, the model converged: `scripts/phase-02-vault-preflight.sh vr1-dc0`
   (staged + sha256-verified on the rack, `90910dfb`) reports **PROCEED** -- mysql cluster 3/3