diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 0cba4be..9c15a6f 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -86,6 +86,7 @@
 | Pre-deploy gate (before add-model) | `bash scripts/preflight.sh` -- THE single entry; do not run the sub-gates piecemeal |
 | Is the cloud actually healthy? (post-deploy, post-restart, pre-change baseline, incident) | `bash scripts/cloud-assert.sh` (add `--capture` at deploy completion for the committed BOM) |
 | Full-cloud restart after outage/maintenance | repo `runbooks/ops-restart-procedure.md` |
+| VR1 site unreachable after a vcloud reboot (`ssh voffice1` / `office1-*` time out) | `bash scripts/site-baseleg.sh check office1` -- `office1-local` is an ISOLATED libvirt net, so the host's base L3 leg (`10.10.0.10/24` + compose route `10.10.1.0/24 via 10.10.0.20`) is dropped every reboot; the `After=libvirtd` unit re-adds it (D-126 amendment / D-128). If MISS and the unit is not yet installed: `sudo bash scripts/site-baseleg.sh apply office1`. This is the vcloud path; the workstation reaches the same over the tailnet (D-107). |
 | Starting any consequential live session | `bash scripts/run-logged.sh <label>` first (as-executed log; docs/as-executed-log-convention.md) |
 | Credential exposures / security TODOs | repo `docs/security-ledger.md` -- add a row, never only a script comment |
 | Resuming work / what is still in flight (esp. after compaction) | repo `docs/session-ledger.md`, then `bash scripts/ledger-scan.sh` to reconcile against repo ground truth |
@@ -106,6 +107,19 @@
 `bash scripts/run-logged.sh <label>` to open the logged shell. Repo HEAD and a
 clean lint are the preconditions for everything else.
 
+**VR1 operating model (D-128 -- invariant; do not re-derive this each session):**
+Claude runs ON the vcloud jumphost -- do NOT relocate the session to a workstation.
+Work splits in two, origins FIXED BY DESIGN: **Plane 1** (substrate -- the OUTER
+`tofu` root `qemu:///system` + local `virsh`, creating the DC *host* VMs) runs on
+vcloud and has no Roosevelt analog; **Plane 2** (MAAS / NetBox / the INNER `tofu`
+root `qemu+ssh`-from-Office1 / tenant tests) EXECUTES on `voffice1` via `ssh
+voffice1 '...'` so runbooks read "from the Office1 headend" and transfer. Claude's
+host only picks the TRANSPORT, not where work runs. Durable Office1 reach = the
+D-126 base-leg oneshot (`scripts/site-baseleg.sh check office1` FIRST if `ssh
+voffice1` is dead post-reboot) -- NOT tailscale-on-vcloud (D-107 is the operator's
+WORKSTATION path / human GUI, left untouched). DCs sit outside the `/22` carve and
+keep the D-126 `-J`-through-`vvr1-dc0` shape.
+
 **Change-delivery loop:** grep for prior art (zeroth decision) -> grep
 design-decisions for the governing D-NNN -> edit -> `bash scripts/repo-lint.sh`
 -> run the touched script's harness (create one if missing -- no script change
diff --git a/docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md b/docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md
new file mode 100644
index 0000000..c0df795
--- /dev/null
+++ b/docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md
@@ -0,0 +1,75 @@
+# 2026-07-17 -- vcloud post-restart sweep + D-126 base-leg oneshot + D-128 operating model
+
+Trigger: operator asked for a full health/status sweep after the vcloud host patch+reboot, which surfaced a
+recurring Office1-access break; the fix + operating-model ruling are recorded here. Branch
+`dc-dc-stage3-phase2-dc-substrate`. Live-host UNIT INSTALL is still PENDING (operator sudo) -- see below.
+
+## vcloud post-restart health sweep (read-only)
+
+The vcloud HOST completed its bookend patch+reboot: running `6.8.0-136`, `apt upgradable` = 0, no
+reboot-required. Libvirt recovered clean (12 nets + 4 pools active/autostart; voffice1 + office1-opnsense
+autostart=enable, both RUNNING). Autostart chain proven end-to-end -- all guests + the edge reported ~3h37m
+uptime matching host boot, i.e. `virsh autostart` -> LXD `boot.autostart` self-recovered the whole Office1
+stack with zero manual start. In-guest (after access restore): opnsense pf Enabled/80 rules, kea-dhcp4 on
+`10.10.0.1:67`, vtnet0/vtnet1 active, LAN+egress OK; office1-netbox HTTP 302; office1-tailscale online
+`100.64.0.53` advertising `10.10.0.0/22`; both LXD service VMs RUNNING. No repo change; sweep result only.
+
+## Finding: the base L3 leg is the un-persisted foundation D-126 never owned
+
+`ssh voffice1` / `office1-*` timed out post-reboot. Root cause (measured): `office1-local` is an ISOLATED
+libvirt net (no `<ip>`/`<forward>`), so the host's own leg -- `10.10.0.10/24` on the bridge (as-built `:41`)
++ compose route `10.10.1.0/24 via 10.10.0.20` (`:88`) -- lives nowhere in the libvirt XML and is dropped on
+every reboot. `ip route get 10.10.0.20` fell through to the default lab gw; `ping .20` 100% loss. D-126 made
+the layers ABOVE this durable but assumed base reachability existed.
+
+**Access restored LIVE (operator sudo, gated)** to verify the exact recipe before encoding it:
+`sudo ip addr add 10.10.0.10/24 dev virbr2` + `sudo ip route replace 10.10.1.0/24 via 10.10.0.20 dev virbr2`
+-> voffice1 0% loss, all aliases live. This is AD-HOC (non-persistent) until the unit is installed.
+**Revert:** `sudo ip addr del 10.10.0.10/24 dev virbr2` (and the route is dropped on next reboot anyway).
+
+## NEW: `scripts/site-baseleg.sh` + `tests/site-baseleg/` (D-126 amendment)
+
+Root `Type=oneshot` systemd unit that re-adds the base leg + compose route at boot, `After=libvirtd.service`
+so it runs AFTER libvirt creates the autostart bridge -- which is why it does NOT hit the netplan-vs-libvirt
+race that made D-126 reject "persist the L3 route" (narrow reopening, base leg ONLY; root because L3 has no
+rootless equivalent -- the D-126 forward DEPENDS on this leg). Subcommands `render|apply|check|install|
+remove|list`. The bridge is DISCOVERED from the stable net NAME (`virsh net-info office1-local`), never a
+baked `virbrN` (lib-net.sh PATTERN-1); `apply` is idempotent (guarded add + `ip route replace`) and
+root-guarded; `check` is the read-only session-verify. Harness `tests/site-baseleg/run-tests.sh` 24/24
+(offline: unit shape, no-baked-bridge, discovery present, idempotency, root-guard, no baked secret, no
+inferred DC IP). Gauntlet ALL GREEN (67 harnesses); repo-lint 0-fail. **Revert:** `git rm
+scripts/site-baseleg.sh tests/site-baseleg/`; on any host where installed, `sudo bash
+scripts/site-baseleg.sh remove office1`.
+
+**Ordering MEASURED (not inferred):** this host runs monolithic `libvirtd.service` (active; virtnetworkd/
+virtqemud inactive), so `After=libvirtd.service` is correct; the unit also orders after `virtnetworkd.service`
+for modular-libvirt hosts (harmless no-op here). `Type=oneshot` has no `Restart=`, so the 60s bridge poll is
+the only backstop (documented limitation). ExecStart is the script's ABSOLUTE path -> a repo rename (D-110)
+breaks the boot unit.
+
+**INSTALLED 2026-07-17 (operator sudo); boot-race UNPROVEN.** `install` wrote + `enabled`
+`/etc/systemd/system/site-baseleg-office1.service`; its `apply` ran at install -> `status=0/SUCCESS`, `check
+office1` -> ok. That run was POST-boot (bridge already up), so it exercised the apply logic but NOT the
+`After=libvirtd`+poll race. Boot durability stays UNPROVEN until an ACTUAL reboot shows `ssh voffice1`
+self-heals -- the next natural reboot is the proof; no separate test reboot forced.
+
+## Records: D-126 amendment + D-128 operating model + skill/doctrine
+
+- `docs/design-decisions.md`: **D-126 amendment** (base-leg durability + the tool) and **NEW D-128** (VR1
+  operating model -- Claude on the vcloud jumphost; two-plane origin split with Plane 1 on vcloud / Plane 2
+  executing on voffice1; workstation tailnet is the human path; D-107 left untouched). ASCII-clean (non-ASCII
+  count unchanged at 239). **Revert:** delete the amendment + the D-128 block.
+- `.claude/skills/openstack-cloud-ops/SKILL.md`: added a routing row (site unreachable post-reboot ->
+  `site-baseleg.sh check office1`) and the D-128 operating-model INVARIANT in the bootstrap loop. **Revert:**
+  `git checkout` the file.
+- `docs/dc-dc-deployment-workflow.md`: added the operating-model bullet to Cross-cutting discipline.
+  **Revert:** `git checkout` the file.
+
+## Why (evidence trail)
+
+Advisor-conferred on the sweep scope + the base-leg mechanism gap. The operating-model ruling followed a
+grounded discussion: the tooling FIXES execution hosts by design (outer `qemu:///system` on vcloud; inner
+`qemu+ssh`-from-Office1, R-5), so Claude's host only picks transport -- relocating the session to the
+workstation would trade away the ONE-session/Remote-Control portability, relocate the gating/secrets
+contract, and put the riskiest Plane-1 ops over a droppable transport, for a reachability win the base-leg
+oneshot already delivers.
diff --git a/docs/dc-dc-deployment-workflow.md b/docs/dc-dc-deployment-workflow.md
index 9530ba6..e7f4f07 100644
--- a/docs/dc-dc-deployment-workflow.md
+++ b/docs/dc-dc-deployment-workflow.md
@@ -262,6 +262,14 @@
   to reconcile open decisions/next-free numbers against `docs/session-ledger.md`.
 - **Any session that will mutate the cloud:** `bash scripts/run-logged.sh <label>`
   first (as-executed log).
+- **Operating model (D-128):** Claude runs ON the vcloud jumphost -- do not relocate
+  the session to a workstation. **Plane 1** (substrate -- outer `tofu` `qemu:///system`
+  + local `virsh`, building the DC *host* VMs) runs on vcloud (no Roosevelt analog);
+  **Plane 2** (MAAS / NetBox / the inner `tofu` root `qemu+ssh`-from-Office1 / tenant
+  tests) EXECUTES on `voffice1` via `ssh voffice1 '...'`, so runbooks read "from the
+  Office1 headend" and transfer to Roosevelt. Durable jumphost->Office1 reach =
+  `scripts/site-baseleg.sh` (D-126 amendment); run `check office1` if `ssh voffice1`
+  is dead after a reboot. The workstation tailnet (D-107) is the human GUI path only.
 - **Before any add-model-like mutation:** `bash scripts/preflight.sh` PASS.
 - **After any deploy/restart/change, and as an incident-triage first step:**
   `bash scripts/cloud-assert.sh` (add `--capture` at real deploy-completion
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index 743381a..5f0b114 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -3877,6 +3877,40 @@
 (rootless) + optionally `loginctl disable-linger`, and `bash scripts/site-ssh-config.sh remove` (leaves the
 Include line + `~/.ssh/config`).
 
+**AMENDMENT (2026-07-17) -- durable BASE L3 leg (the layer this decision assumed).** D-126 made the
+transport ABOVE base reachability durable (the ProxyJump aliases + the systemd `--user` forward), but it
+ASSUMED the vcloud host could already reach voffice1 at `10.10.0.20`. The vcloud OS-patch+reboot (2026-07-17,
+-134 -> -136) exposed that assumption: `office1-local` is an ISOLATED libvirt net (no `<ip>`/`<forward>`),
+so the host's own L3 presence -- `10.10.0.10/24` on the bridge (as-built `:41`) plus the compose route
+`10.10.1.0/24 via 10.10.0.20` (`:88`) -- lives NOWHERE in the libvirt XML and vanished on reboot, stranding
+`ssh voffice1` (measured: `ip route get 10.10.0.20` fell through to the default lab gw; `ping .20` 100% loss).
+So the base leg is the un-persisted foundation D-126 never owned. **This NARROWLY reopens the rejected Option
+B -- for the BASE LEG ONLY.** The original rejection stood on a netplan-vs-libvirt race; a `Type=oneshot`
+unit ordered `After=libvirtd.service` runs AFTER libvirt has created the autostart bridge, so the race does
+not exist, and it is root purely because L3-on-a-bridge has no rootless equivalent (the D-126 forward cannot
+create it -- it depends on it). **Deliverable:** `scripts/site-baseleg.sh` ({render|apply|check|install|
+remove|list}) + `tests/site-baseleg/run-tests.sh` (24/24, offline). It DISCOVERS the bridge from the stable
+net NAME (`virsh net-info office1-local`), never a baked `virbrN` (lib-net.sh PATTERN-1); `apply` is
+idempotent + root-guarded and is what the boot unit invokes; `check` is the read-only session-verify a new
+session runs to confirm the leg without re-deriving it. **Ordering was MEASURED, not inferred:** this host
+runs monolithic `libvirtd.service` (active; `virtnetworkd`/`virtqemud` inactive), which owns network
+creation, so `After=libvirtd.service` is correct here; the unit ALSO orders after `virtnetworkd.service` so
+it stays correct on a modular libvirt host (Ubuntu 24.04 / libvirt 10.x may split the daemons) -- ordering
+against an inactive/absent unit is a harmless no-op, and the bridge poll in `apply` is the real guarantee.
+**Known limitation:** `Type=oneshot` has no `Restart=`, so the `BRIDGE_WAIT` poll (60s) is the ONLY retry --
+if the bridge misses that window at a contended cold boot the leg silently does not come up; widen the wait
+if observed. The `ExecStart` is the script's ABSOLUTE path, so a repo move/rename (cf. D-110) breaks the boot
+unit -- re-run `install` after any relocation. **State: INSTALLED 2026-07-17; boot-race UNPROVEN.** The
+`install` was run (operator sudo): the unit is written + `enabled` (symlinked into `multi-user.target.wants`),
+and its `apply` ran once at install time -> `status=0/SUCCESS`, `check office1` -> ok (leg + route present).
+BUT that run was POST-boot (bridge already up), so it exercised the `apply` logic, NOT the `After=libvirtd` +
+poll race that is the whole point. Boot-time durability stays UNPROVEN until an ACTUAL reboot shows `ssh
+voffice1` self-heals with no manual step. The ad-hoc leg from earlier this session and the unit's `apply`
+converge on the same live state, so `check` alone cannot distinguish them -- only a reboot does. See D-128
+(this is the vcloud-local half of the operating model). **Revert:** `bash scripts/site-baseleg.sh remove
+office1` (root) on any host where installed; `git rm scripts/site-baseleg.sh` + its `tests/` dir; delete this
+amendment.
+
 ## D-127: VR1 host-level VM autostart policy -- foundational service VMs autostart, DC containment VMs manual
 
 **Status:** RULED 2026-07-16 (operator: "set the autostart for the VMs so we don't run into problems if
@@ -3934,3 +3968,46 @@
 fix that makes the edge safe to autostart), `runbooks/ops-restart-procedure.md` (the cloud-side analogue:
 `resume-guests-state-on-host-boot`). **Revert:** `virsh autostart --disable <domain>`; drop the IaC
 `autostart` args; delete this entry.
+
+## D-128: VR1 operating model -- Claude on the vcloud jumphost; two-plane origin; workstation tailnet is the human path
+
+**Status:** RULED 2026-07-17 (operator: "I will go with your recommendation"). Recorded + folded into the
+operating skill so no future session re-derives it. Governs WHERE work originates, not any built surface.
+
+**Problem.** The vcloud patch+reboot stranded Office1 access (see D-126 amendment) and raised the operating
+question: the operator SSHes into the vcloud host to run Claude, but the operator's WORKSTATION has tailnet
+access (D-107) that reaches all of `10.10.0.0/22` directly. Should the session relocate -- run Claude from a
+repo on the workstation and tunnel into both vcloud and Office1? We are simulating a deployment FROM Office1
+to the DCs, so "sit in Office1" has real pull.
+
+**Decision -- two planes, fixed origins; Claude stays on the jumphost.**
+- **Plane 1 (substrate / stagehand):** creating the DC *host* VMs (`vvr1-dc0`), libvirt nets/pools, the
+  OUTER `tofu` root (`libvirt_uri = qemu:///system`, `dc-dc-phase0.auto.tfvars:6`) + the ~13 local `virsh`
+  calls. Runs ON the vcloud host. **No Roosevelt analog** -- in Roosevelt the DC hardware exists; nobody
+  creates it. Throwaway simulation scaffolding.
+- **Plane 2 (deployment / management / testing):** MAAS enlist/commission/deploy, the NetBox apex, the INNER
+  `tofu` root (`opentofu/vr1-dc0-substrate/`, `qemu+ssh` FROM Office1 into `vvr1-dc0`, R-5), tenant tests.
+  This is what we REHEARSE for Roosevelt, and it EXECUTES on `voffice1` (the headend) -- reached by `ssh
+  voffice1 '...'` over the D-126 leg, so a runbook step reads "from the Office1 headend", which transfers.
+- **Claude's process stays on the vcloud jumphost.** The execution hosts above are fixed BY DESIGN; Claude's
+  location only picks the TRANSPORT it uses to reach them, not where work runs.
+- **The operator's workstation tailnet is the HUMAN path** (MAAS UI, NetBox UI, browser, an SSH console) --
+  orthogonal to where Claude runs. Keep using it; it needs no decision and touches nothing scoped.
+
+**Why not relocate to the workstation (Option B, rejected).** (1) It trades away the standing "ONE jumphost
+session reached via Remote Control" design that already solves multi-workstation hopping -- putting the
+session ON a workstation ties it to that machine. (2) It relocates the entire gating/secrets contract (the
+PreToolUse guard, permission `ask` rules, creds folders, CLAUDE.md) onto a less-controlled host and puts
+creds there. (3) It puts the riskiest Plane-1 ops (create/destroy host VMs) over a droppable `qemu+ssh`
+transport instead of local libvirt. The Office1-reach cleanliness it would buy is already delivered by the
+D-126 base-leg oneshot with none of those costs. Roosevelt fidelity lives in the runbook's DECLARED ORIGIN +
+transport (achieved by executing Plane-2 ON voffice1), not in which host Claude's process runs on.
+
+**Durable Office1 reach = the D-126 base-leg oneshot (`scripts/site-baseleg.sh`), NOT tailscale-on-vcloud.**
+This is precisely why **D-107 stays untouched**: tailscale is the WORKSTATION path; the jumphost's path is
+its own L3 leg. DCs are outside the `/22` carve and keep the D-126 `-J`-through-`vvr1-dc0` shape regardless.
+
+**Related:** D-126 + its 2026-07-17 amendment (the mechanism), D-107 (workstation tailnet), D-123/R-5
+(inner-root-from-Office1), `docs/dc-dc-deployment-workflow.md` (Cross-cutting: the plane split as doctrine),
+the operating skill (invariant). **Revert:** delete this entry + the skill invariant; the operating model has
+no built-surface footprint to unwind.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 4ff4907..2fde362 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -682,6 +682,25 @@
    libvirt bridge, `virbr2`, not routable off-host): `ssh -L 8443:10.10.0.1:443 <user>@10.17.11.248`
    -> `https://localhost:8443`.
 
+**VCLOUD POST-RESTART SWEEP + D-126 BASE-LEG + D-128 OPERATING MODEL (2026-07-17).** The vcloud host
+completed its bookend patch+reboot (running `6.8.0-136`, 0 upgradable, no reboot-required). Full sweep
+GREEN: libvirt 12 nets/4 pools active+autostart, both VMs autostart=enable+RUNNING, autostart chain proven
+end-to-end (all guests+edge uptime matched host boot). Post-reboot `ssh voffice1` was DOWN -- root cause:
+`office1-local` is an ISOLATED libvirt net, so the host's base L3 leg (`10.10.0.10/24` on the bridge +
+compose route `10.10.1.0/24 via 10.10.0.20`) lives nowhere in the XML and drops every reboot; D-126 made the
+layers above it durable but never owned this base leg. **DELIVERED:** `scripts/site-baseleg.sh` +
+`tests/site-baseleg/` (24/24) -- a root `Type=oneshot` unit `After=libvirtd` that re-adds the leg at boot
+(bridge DISCOVERED from the net name, not baked; idempotent apply; `check` = read-only session-verify).
+Gauntlet ALL GREEN (67), repo-lint 0-fail. **D-126 amendment** + **NEW D-128** (operating model: Claude on
+the vcloud jumphost; Plane-1 substrate on vcloud / Plane-2 executes on voffice1; workstation tailnet = human
+path; D-107 untouched) recorded; skill invariant + workflow Cross-cutting bullet added. See
+`docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md`. **INSTALLED 2026-07-17; boot-race
+UNPROVEN:** `install` run (operator sudo) -- unit written + `enabled` (multi-user.target.wants), `apply` ran
+at install -> status=0, `check office1` -> ok. That run was POST-boot so it did NOT exercise the
+`After=libvirtd`+poll race; boot durability stays UNPROVEN until an ACTUAL reboot shows `ssh voffice1`
+self-heals. The next natural reboot is the proof (no forced test reboot). Ordering MEASURED (monolithic
+libvirtd active here). Next-free D now **129**.
+
 ## OPEN WORK -- VR0 / DC0 (the running testcloud)
 
 1. **d011 batch-3 live-validation queue** -- `scripts/checks/d011-04-octavia-lb.sh` and
diff --git a/scripts/site-baseleg.sh b/scripts/site-baseleg.sh
new file mode 100755
index 0000000..34c16fc
--- /dev/null
+++ b/scripts/site-baseleg.sh
@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# scripts/site-baseleg.sh {render|apply|check|install|remove|list} <site>
+#
+# Durable BASE L3 leg from the vcloud jumphost into a host-local, ISOLATED
+# libvirt site network (D-126 amendment, 2026-07-17). office1-local is an
+# isolated libvirt net (no <ip>, no <forward>), so the vcloud host has NO L3
+# presence on 10.10.0.0/24 by default -- it must add its own address on the
+# bridge (10.10.0.10/24, as-built) plus a route to the compose net
+# (10.10.1.0/24 via voffice1 10.10.0.20). Both are lost on every reboot, which
+# is exactly what stranded `ssh voffice1` after the vcloud patch+reboot.
+#
+# WHY a root system unit here (and NOT the D-126 rootless user forward): the
+# forward in site-forward.sh PRESUPPOSES this leg -- it SSHes to 10.10.0.20,
+# which is unreachable until the leg + route exist. L3 on a bridge needs root;
+# there is no rootless equivalent. D-126 originally rejected "persist the L3
+# route" over a netplan-vs-libvirt race, but a `Type=oneshot` unit ordered
+# `After=libvirtd.service` runs AFTER libvirt has created the autostart bridge,
+# so the race does not exist. This is that narrow reopening -- base leg ONLY.
+#
+# NO DRIFTING IDs (lib-net.sh PATTERN-1): the bridge name (virbr2 today) is
+# assigned by libvirt and drifts on redefine. The STABLE key is the network
+# NAME (office1-local); the bridge is DISCOVERED via `virsh net-info` at run
+# time, never baked.
+#
+# NO SECRETS: this tool touches no key or credential material. `render`,
+# `check`, `list` are READ-ONLY. `apply` mutates host L3 (idempotent) and needs
+# root -- the boot unit runs it. `install`/`remove` manage the unit and are
+# OPERATOR-RUN (root). ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"   # self-locate
+SELF="$HERE/site-baseleg.sh"
+
+# --- leg table: MEASURED / as-built values ONLY (hard rule 2). Format:
+#     name = "NET_NAME|HOST_CIDR|ROUTE_CIDR|ROUTE_GW"
+#   NET_NAME   libvirt network NAME (stable key; the bridge is discovered from it)
+#   HOST_CIDR  address the vcloud host adds on that bridge
+#   ROUTE_CIDR service/compose net reached THROUGH the site
+#   ROUTE_GW   next hop for ROUTE_CIDR (the containment VM on NET_NAME)
+#
+# office1: net office1-local (as-built vr1-office1-as-built.md:41 -> vcloud
+# 10.10.0.10 on virbr2); compose 10.10.1.0/24 via voffice1 10.10.0.20 (:88).
+# DC rows are DEFERRED: the DCs nest inside vvr1-dc0 and are reached by qemu+ssh
+# (D-123 / R-5), NOT necessarily an L3 leg -- add a row ONLY if/when a DC needs
+# one AND its values are measured (never an inferred IP).
+declare -A LEGS=(
+  [office1]="office1-local|10.10.0.10/24|10.10.1.0/24|10.10.0.20"
+  # [vr1-dc0]="<net>|<host-cidr>|<route-cidr>|<route-gw>"   # MEASURE first (qemu+ssh may make this moot)
+)
+
+UNIT_PREFIX="site-baseleg-"
+# The poll below is the ONLY backstop: Type=oneshot does NOT support Restart=, so
+# if the bridge is not up within BRIDGE_WAIT at a contended cold boot, the leg
+# never comes up and there is NO systemd-level retry. Widen this (not lower it)
+# if a slow cold boot is observed to miss the window.
+BRIDGE_WAIT=60   # seconds to wait for the autostart bridge post-libvirtd
+
+die() { echo "site-baseleg: $*" >&2; exit 1; }
+
+usage() {
+  cat <<EOF
+usage: bash scripts/site-baseleg.sh <cmd> <site>
+  render  <site>   print the systemd system unit (read-only)
+  apply   <site>   add the host leg + compose route, idempotent (root; the unit runs this)
+  check   <site>   verify the leg + route are present (read-only; exit 0=ok, 1=missing)
+  install <site>   write + enable --now the system unit (OPERATOR-RUN, root)
+  remove  <site>   disable + delete the system unit (OPERATOR-RUN, root)
+  list             show configured sites
+sites: ${!LEGS[*]}
+EOF
+}
+
+lookup() {
+  local site="$1"
+  [ -n "${LEGS[$site]+x}" ] || die "unknown site '$site' (have: ${!LEGS[*]})"
+  IFS='|' read -r NET_NAME HOST_CIDR ROUTE_CIDR ROUTE_GW <<<"${LEGS[$site]}"
+  [ -n "$NET_NAME" ] && [ -n "$HOST_CIDR" ] && [ -n "$ROUTE_CIDR" ] && [ -n "$ROUTE_GW" ] \
+    || die "site '$site' row is malformed"
+}
+
+# Resolve the bridge from the STABLE network name (never a baked virbrN).
+discover_bridge() {
+  command -v virsh >/dev/null 2>&1 || die "no virsh on PATH (are we on the vcloud host?)"
+  virsh net-info "$NET_NAME" 2>/dev/null | awk '/^Bridge:/{print $2}'
+}
+
+render_unit() {
+  local site="$1"
+  lookup "$site"
+  # No baked bridge, no baked IP command: the unit invokes THIS script's `apply`,
+  # which discovers the bridge and does the idempotent add at run time (hard rule
+  # 2 + PATTERN-1). Ordered After=libvirtd so the autostart bridge already exists.
+  # Ordering: MEASURED on the vcloud host -- monolithic libvirtd.service is active
+  # and owns network creation here (virtnetworkd/virtqemud inactive). We ALSO order
+  # after virtnetworkd.service so the unit stays correct on a modular libvirt host
+  # (Ubuntu 24.04 / libvirt 10.x can split the daemons); After= on an inactive/absent
+  # unit is a harmless no-op. The bridge poll in `apply` is the real guarantee.
+  # NOTE: ExecStart is this script's ABSOLUTE path; a repo move/rename (cf. D-110)
+  # breaks the boot unit -- re-run `install` after any relocation.
+  cat <<EOF
+[Unit]
+Description=D-126 base L3 leg for ${site} (${HOST_CIDR} on ${NET_NAME} + route ${ROUTE_CIDR})
+After=libvirtd.service virtnetworkd.service
+Wants=libvirtd.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${SELF} apply ${site}
+
+[Install]
+WantedBy=multi-user.target
+EOF
+}
+
+apply_leg() {
+  local site="$1"
+  lookup "$site"
+  [ "$(id -u)" -eq 0 ] || die "apply needs root (adds an address + route)"
+  local br="" i
+  for ((i=0; i<BRIDGE_WAIT; i++)); do
+    br="$(discover_bridge)"; [ -n "$br" ] && break
+    sleep 1
+  done
+  [ -n "$br" ] || die "bridge for net '$NET_NAME' not present after ${BRIDGE_WAIT}s (libvirtd up?)"
+  # Idempotent: only add the address if the bridge does not already carry it.
+  if ip -br addr show dev "$br" 2>/dev/null | grep -qw "$HOST_CIDR"; then
+    echo "leg present: $HOST_CIDR on $br"
+  else
+    ip addr add "$HOST_CIDR" dev "$br" || die "failed to add $HOST_CIDR on $br"
+    echo "added leg: $HOST_CIDR on $br"
+  fi
+  # `ip route replace` is idempotent by construction.
+  ip route replace "$ROUTE_CIDR" via "$ROUTE_GW" dev "$br" || die "failed to set route $ROUTE_CIDR"
+  echo "route set: $ROUTE_CIDR via $ROUTE_GW dev $br"
+}
+
+check_leg() {
+  local site="$1"
+  lookup "$site"
+  local br; br="$(discover_bridge)"
+  [ -n "$br" ] || { echo "check: net '$NET_NAME' has no bridge"; return 1; }
+  local rc=0
+  if ip -br addr show dev "$br" 2>/dev/null | grep -qw "$HOST_CIDR"; then
+    echo "ok   leg   $HOST_CIDR on $br"
+  else
+    echo "MISS leg   $HOST_CIDR on $br"; rc=1
+  fi
+  if ip route show "$ROUTE_CIDR" 2>/dev/null | grep -q "via $ROUTE_GW"; then
+    echo "ok   route $ROUTE_CIDR via $ROUTE_GW"
+  else
+    echo "MISS route $ROUTE_CIDR via $ROUTE_GW"; rc=1
+  fi
+  return $rc
+}
+
+cmd="${1:-}"; site="${2:-}"
+case "$cmd" in
+  -h|--help|help|"") usage; [ -z "$cmd" ] && exit 1 || exit 0 ;;
+  list)    echo "configured sites:"; for s in "${!LEGS[@]}"; do echo "  $s -> ${LEGS[$s]}"; done ;;
+  render)  [ -n "$site" ] || die "render needs a <site>";  render_unit "$site" ;;
+  apply)   [ -n "$site" ] || die "apply needs a <site>";   apply_leg "$site" ;;
+  check)   [ -n "$site" ] || die "check needs a <site>";   check_leg "$site" ;;
+  install)
+    [ -n "$site" ] || die "install needs a <site>"
+    [ "$(id -u)" -eq 0 ] || die "install needs root (writes /etc/systemd/system, enables the unit)"
+    lookup "$site"
+    unit="${UNIT_PREFIX}${site}.service"
+    render_unit "$site" > "/etc/systemd/system/$unit"
+    echo "wrote /etc/systemd/system/$unit"
+    systemctl daemon-reload
+    systemctl enable --now "$unit"
+    systemctl --no-pager status "$unit" | head -8 || true
+    ;;
+  remove)
+    [ -n "$site" ] || die "remove needs a <site>"
+    [ "$(id -u)" -eq 0 ] || die "remove needs root"
+    lookup "$site"
+    unit="${UNIT_PREFIX}${site}.service"
+    systemctl disable --now "$unit" 2>/dev/null || true
+    rm -f "/etc/systemd/system/$unit"
+    systemctl daemon-reload
+    echo "removed $unit"
+    ;;
+  *) die "unknown command '$cmd' (see --help)" ;;
+esac
diff --git a/tests/site-baseleg/run-tests.sh b/tests/site-baseleg/run-tests.sh
new file mode 100755
index 0000000..f29eca9
--- /dev/null
+++ b/tests/site-baseleg/run-tests.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# tests/site-baseleg/run-tests.sh
+#
+# Harness for scripts/site-baseleg.sh (D-126 amendment). OFFLINE -- touches no
+# libvirt, no systemd, no network, no root. Renders the unit and greps it, and
+# drives the error paths. It PINS the discipline-relevant shape: NO baked bridge
+# (virbrN is discovered, PATTERN-1), idempotent mutation, root-guarded apply,
+# no baked secret, no inferred DC IP. A careless edit reddens HERE, not at boot.
+# ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+S="$(cd "$HERE/../../scripts" && pwd)/site-baseleg.sh"
+pass=0; fail=0
+ok()  { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "  FAIL: $1"; }
+
+command -v bash >/dev/null 2>&1 || { echo "FAIL: bash required"; exit 1; }
+
+# --- parse / help / list ---
+bash -n "$S" 2>/dev/null && ok || bad "does not parse (bash -n)"
+bash "$S" --help >/dev/null 2>&1 && ok || bad "--help -> nonzero"
+bash "$S" >/dev/null 2>&1; [ $? -ne 0 ] && ok || bad "no-arg must be nonzero (prints usage)"
+bash "$S" list 2>&1 | grep -q 'office1' && ok || bad "list lost office1"
+
+R="$(bash "$S" render office1 2>&1)"
+
+# --- unit shape ---
+printf '%s' "$R" | grep -q 'Description=D-126' && ok || bad "unit not tagged D-126"
+printf '%s' "$R" | grep -q '^After=libvirtd.service' && ok || bad "lost After=libvirtd (the race fix)"
+printf '%s' "$R" | grep -q '^Type=oneshot' && ok || bad "not a oneshot"
+printf '%s' "$R" | grep -q '^RemainAfterExit=yes' && ok || bad "lost RemainAfterExit"
+printf '%s' "$R" | grep -qE '^ExecStart=/[^ ]*/site-baseleg.sh apply office1$' && ok || bad "ExecStart is not an absolute self-call to 'apply office1'"
+printf '%s' "$R" | grep -q '^WantedBy=multi-user.target' && ok || bad "lost system-target install"
+
+# --- PATTERN-1: NO baked drifting bridge id in the rendered unit ---
+printf '%s' "$R" | grep -q 'virbr' && bad "unit bakes a virbrN (must discover from net name)" || ok
+# discovery is via the stable network name, at run time
+grep -q 'virsh net-info' "$S" && ok || bad "bridge not discovered via virsh net-info"
+printf '%s' "$R" | grep -q 'office1-local' && ok || bad "unit lost the stable net name office1-local"
+
+# --- measured / as-built values present (hard rule 2) ---
+bash "$S" list 2>&1 | grep -q 'office1-local|10.10.0.10/24|10.10.1.0/24|10.10.0.20' && ok \
+  || bad "office1 leg row drifted from as-built (net|host|route|gw)"
+
+# --- idempotency: guarded add + route replace ---
+grep -q 'ip route replace' "$S" && ok || bad "route is not idempotent (use ip route replace)"
+grep -qE 'grep -qw "\$HOST_CIDR"' "$S" && ok || bad "address add is not guarded (idempotency)"
+
+# --- apply MUTATES and is root-guarded; check/render/list are read-only ---
+grep -qE 'apply needs root' "$S" && ok || bad "apply not root-guarded"
+# non-root apply must refuse (we run tests as non-root) and must NOT touch libvirt first
+if [ "$(id -u)" -ne 0 ]; then
+  out="$(bash "$S" apply office1 2>&1)"; rc=$?
+  [ $rc -ne 0 ] && printf '%s' "$out" | grep -q 'needs root' && ok || bad "non-root apply did not refuse cleanly"
+else
+  ok  # running as root in CI: skip the refuse-path assertion
+fi
+
+# --- error paths (capture-then-grep: die exits nonzero, which pipefail would
+#     otherwise propagate through the pipe even when grep matches) ---
+e1="$(bash "$S" render 2>&1)";       printf '%s' "$e1" | grep -q 'render needs a <site>' && ok || bad "render w/o site not rejected"
+e2="$(bash "$S" render bogus 2>&1)"; printf '%s' "$e2" | grep -q "unknown site 'bogus'" && ok || bad "unknown site not rejected"
+e3="$(bash "$S" boguscmd 2>&1)";     printf '%s' "$e3" | grep -q "unknown command" && ok || bad "unknown command not rejected"
+
+# --- SECRETS: nothing key/credential-shaped is baked ---
+grep -qE '\-creds/|BEGIN [A-Z ]*PRIVATE KEY|api\.token|authkey' "$S" && bad "script bakes a secret path/material" || ok
+grep -q 'NO SECRETS' "$S" && ok || bad "lost the no-secrets contract comment"
+
+# --- NO INFERRED VALUE: no unmeasured DC IP in an ACTIVE leg row ---
+# active rows are the declare -A body lines that are NOT commented; DC supernets
+# (10.12., 172.31.) must not appear un-commented until measured.
+active="$(sed -n '/declare -A LEGS=(/,/^)/p' "$S" | grep -vE '^[[:space:]]*#')"
+printf '%s' "$active" | grep -qE '10\.12\.|172\.31\.' && bad "an ACTIVE leg row carries an unmeasured DC supernet" || ok
+
+echo "site-baseleg: ${pass} passed, ${fail} failed"
+[ "$fail" -eq 0 ]