diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 9c15a6f..71544e9 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -118,7 +118,13 @@
 D-126 base-leg oneshot (`scripts/site-baseleg.sh check office1` FIRST if `ssh
 voffice1` is dead post-reboot) -- NOT tailscale-on-vcloud (D-107 is the operator's
 WORKSTATION path / human GUI, left untouched). DCs sit outside the `/22` carve and
-keep the D-126 `-J`-through-`vvr1-dc0` shape.
+keep the D-126 `-J`-through-`vvr1-dc0` shape. **Durable host->site reach is standing
+per-SITE tooling, DCs included (so the gap does not reopen per-DC):** `site-baseleg.sh`
+is site-keyed. At each DC standup, MEASURE how vcloud reaches that DC's containment/
+service net -- if it is an ISOLATED host-local net, add a MEASURED leg row + `install`
+the unit as part of standup definition-of-done (NEVER an inferred DC IP -- the harness
+fails on an un-commented DC supernet); a routed/NAT net or an already-reachable
+`qemu+ssh` path needs none. Register item 20 tracks this.
 
 **Change-delivery loop:** grep for prior art (zeroth decision) -> grep
 design-decisions for the governing D-NNN -> edit -> `bash scripts/repo-lint.sh`
diff --git a/docs/dc-dc-deployment-workflow.md b/docs/dc-dc-deployment-workflow.md
index e7f4f07..caea81e 100644
--- a/docs/dc-dc-deployment-workflow.md
+++ b/docs/dc-dc-deployment-workflow.md
@@ -831,6 +831,36 @@
     Stage 3 OpenTofu work.** Nothing in `opentofu/` should gain a new DC-keyed
     module until it is closed.
 
+20. **NEW 2026-07-17 -- durable host->site (isolated-net) reachability had no owning
+    tool -- CLOSED for Office1; DC path templated.**
+
+    `office1-local` is an ISOLATED libvirt net (no `<ip>`/`<forward>`), so the vcloud
+    host has no L3 presence on `10.10.0.0/24`: its base leg (`10.10.0.10/24` on the
+    bridge) + compose route (`10.10.1.0/24 via 10.10.0.20`) were re-added BY HAND each
+    session and dropped on every reboot. The vcloud OS-patch+reboot (2026-07-17) proved
+    the cost -- it stranded `ssh voffice1` and every ProxyJump alias. D-126 made the
+    layers ABOVE this durable (the `--user` forward, the ssh aliases) but never owned
+    the base leg.
+
+    **CLOSED for Office1 (D-126 amendment):** `scripts/site-baseleg.sh` +
+    `tests/site-baseleg/` (24/24) -- a root `Type=oneshot` unit ordered `After=libvirtd`
+    (MEASURED: monolithic `libvirtd` here; also orders after `virtnetworkd` for modular
+    hosts) that re-adds the leg at boot. Bridge DISCOVERED from the stable net name
+    (never a baked `virbrN`, PATTERN-1); `apply` idempotent; `check` = session-verify.
+    INSTALLED + `enabled` on vcloud 2026-07-17; the `After=libvirtd`+poll BOOT-RACE stays
+    UNPROVEN until an actual reboot self-heals `ssh voffice1`. See D-126 amendment +
+    D-128; `docs/changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md`.
+
+    **DC generalization (so this gap does NOT reopen per-DC):** the tool is SITE-KEYED
+    with a commented DC template row, and the harness FAILS on any un-commented DC
+    supernet (hard rule 2). At each DC standup, MEASURE how the vcloud host reaches that
+    DC's containment/service net: if it is an ISOLATED host-local net, add a MEASURED
+    `site-baseleg.sh` leg row + `install` the unit as part of the standup definition-of-
+    done; if the DC is reached over a routed/NAT net or by `qemu+ssh` to an address the
+    host already holds (D-123 / R-5), no leg is needed. The skill carries this as
+    standing discipline (routing row + operating-model invariant + the VR1 deploy loop).
+    **Status: Office1 CLOSED; DC rows DEFERRED-until-measured (mechanism in place).**
+
 ---
 
 ## Where things stand today (2026-07-09) -- update this as stages close