[lweberru]

Corporate orders with Automatic network size and inherited DNS passed validate but failed the provider's IPv4 validation during Plan. The native module now reads the attached regional SNA default and supplies the effective prefix while keeping DNS. Explicit prefixes and Public networks avoid that lookup. The Application Runner is pinned to the reviewed native commit 1ed855609d4dcbfded6759c7c8b4fabf7bd6725d; migrations retain existing source allowlists and immutable versions/State bindings.

Orders created before the owner's valid STACKIT login can now complete their missing verified owner binding in place, before any approval or job exists. SQL independently restricts the completion to the same current owner/tenant and declared context roles, with immutable before/after audit. A genuine changed identity or existing execution evidence remains protected. The UI refreshes the same order and explains those boundaries.

The Assistant explains Automatic inheritance and proposes the exact requested numeric/null setting. Updated knowledge, production grounding and factual positive/negative tests distinguish the native fix from an invented provider upgrade and preserve unrelated settings. Human provider diagnostic details are now visible after the existing redaction, excluding structured snippets/expressions.

Validation:

• Complete npm run check: 1010 passed, 71 environment-gated skipped.
• Isolated PostgreSQL identity/Application suite: 51/51, including migrations 065/066, concurrent completion and authorization/immutability boundaries.
• Desktop/mobile identity browser regressions: 6/6; existing catalogue browser flow: 10/10.
• Offline native Application root/module/pinned compiler suites: 16 + 13 + 36 passed. Seven local-only tests with the real pinned provider cover invalid raw combinations and known/deferred effective prefixes; no customer access.
• Actual local Runner packaging/initial-engine probes: 3 passed, 131 intentionally unselected tests skipped.
• Final targeted real-model qualification: five affected project-template cases twice, 10/10, execution disabled. Earlier failed experiments remain in local receipts; this does not replace release qualification.

English/German user, native-module and contributor documentation is updated. New sources require a new published template version/order; existing orders retain their reviewed source. A partial infrastructure Apply must be recovered against its existing State separately; this PR does not import, unlock, retry or replace customer infrastructure.

Refs #93. Real Corporate/Public cloud acceptance remains open.

Integrated with current main on 2026-10-23: published recovery migration 064 remains byte-for-byte unchanged; new source and identity migrations now follow as 065/066. The combined recovery/identity database scenario uses the same bounded 30-second budget as the neighboring extended scenario (the former 5-second limit expired under the combined workload; no assertions were removed). Full local check: 1049 passed / 71 gated skipped; real isolated identity/Application database suite: 51 passed; platform State/recovery database suite: 63 passed. Earlier timed-out runs are retained in local logs.

The user has since confirmed first-attempt Public Plan/Apply including Observability and successful Corporate recovery on the prior runtime (#93). These results do not qualify this PR's new Automatic prefix or identity-completion behavior in the cloud.