diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index fcfd8af..b02fc7c 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2026,8 +2026,20 @@
   ovn-central is waiting on. The benign `Skipping ... internal/admin/public space, no local
   address found` warnings are NOT the cause (those endpoint spaces are unused; the real request
   carries the right SANs). So vault CAN sign (its other consumers are active) but has not produced
-  ovn-central's SERVER cert. LOGGED, awaiting operator direction on remedy (nudge vault to
-  reprocess / investigate the server-cert request handshake). Expected-tail blocked units
+  ovn-central's SERVER cert. **NUDGE TRIED, DID NOT RESOLVE:** `juju run vault/leader reissue-certificates` ran
+  clean (task 47, exit 0); ovn-central still has ca + client.cert only, no server cert -- so
+  it is NOT a hook-timing issue. **CONFIRMED A KNOWN UPSTREAM CHARM BUG, `charm-ovn-central`
+  LP #2044324** ("ovn-central inconsistently blocks after vault:certificates"), status
+  New/Undecided, NO official fix; it hits exactly this multi-space + LXD + juju-3.x shape.
+  Root cause per the bug: ovn-central iterates the internal/admin/public ENDPOINT spaces to
+  build its cert SANs and finds no local address in them (our bundle binds nothing to those
+  endpoint types -- only metal-admin default + metal-internal for ovsdb/*), so the server-cert
+  request never completes. This is a BUILDOUT-mode charm gap (a v6-class ecosystem limitation),
+  not a deploy error. Candidate remedies, none yet applied: (a) provide addresses for the
+  internal/admin/public endpoint types via `juju bind`/config so resolve_address succeeds;
+  (b) escalate on LP #2044324; (c) accept ovn-central degraded and assess blast radius (the OVN
+  control-plane DBs need TLS to serve chassis, so this likely gates functional networking).
+  AWAITING OPERATOR DIRECTION. Expected-tail blocked units
   unchanged (ceph-rbd-mirror cross-DC, designate Stage 7, octavia awaiting-configure); nova-compute
   "services not running" appeared and self-cleared (transient).
   **>>> PRE-VAULT-INIT END STATE REACHED; VAULT PREFLIGHT PASSES `PROCEED` 2026-08-03. <<<**