# Changelog 2026-07-10 -- DOCFIX-180: dc-dc-phase0 runbook as-executed corrections

**Context.** End-of-Stage-1 runbook update. Per the operator's model (keep a
DOCFIX log through a whole phase, then update the runbook at phase close), the
corrections accrued during the first real execution of
`runbooks/dc-dc-phase0-vcloud-prep.md` (2026-07-10) are now folded back into the
runbook as draft updates. The live execution itself is DOCFIX-179 (scaffold) +
DOCFIX-178 (prereq installers); this entry is the runbook-text reconciliation.

## What changed in `runbooks/dc-dc-phase0-vcloud-prep.md`

1. **Top banner** -- marks the runbook FIRST EXECUTED 2026-07-10 and points at
   the DOCFIX-178/179/180 changelogs.
2. **Known-gap section -> RESOLVED.** The `provider "maas"` block DID force
   `tofu plan` to demand both `maas_api_url` AND the sensitive `maas_api_key`
   for a zero-MAAS plan. Recorded the operator's structural resolution (defer the
   provider block + both vars to Stage 3; DOCFIX-179) instead of the placeholder
   workaround. Also corrected a stale reference ("Step 4" -> it surfaces at
   Step 8/9).
3. **Step 3 (MTU).** Added the two-MTU-domains clarification: the measured host
   *uplink* MTU (1500) is the ISP/WAN-edge value (Stage 2/3), while `underlay_mtu`
   drives host-internal jumbo-capable virtio bridges -> set it to jumbo (9000)
   for the internal fabric. First run: measured 1500, ruled `underlay_mtu=9000`.
4. **Step 5 (pools).** Added the non-pristine-host reality (a prior VR0 topology
   + `wan` were present): inventory first, tear down leftovers gated, KEEP `wan`
   as a gap-#17 ISP-uplink model. Replaced the bare `sudo mkdir` with the
   self-owned-parent pattern (`install -d -o $USER -g libvirt /var/lib/libvirt/vr1`
   once, then sudo-free subdirs). Recorded that DC2's storage pool IS wired now
   (planes still deferred).
5. **Step 8 (init/validate).** Recorded the first-`init` failure + its two fixes
   (per-module `required_providers`; `tofu fmt -recursive`) and the README banner
   flip to STAGE-1-VALIDATED.
6. **Step 9 (plan).** Added `-input=false` (non-interactive safety) and corrected
   the expected plan from 11 to the real **13 resources** (added the omitted
   `office1_network` and the newly-wired `dc2_storage`).

## Verification
- `bash scripts/repo-lint.sh` -> 0 fail (1 documented legacy WARN).
- No script changed here (doc-only), so no harness; the tooling changes these
  notes describe are covered by DOCFIX-178/179's harnesses.

## Revert
- `git checkout runbooks/dc-dc-phase0-vcloud-prep.md` to the pre-DOCFIX-180
  revision (removes the 6 as-executed edits), and
  `git rm docs/changelog-20260710-phase0-runbook-as-executed.md`.

## Follow-up (logged)
- The other `dc-dc-phaseN` runbooks will get the same end-of-phase as-executed
  treatment as each is first-executed (their own DOCFIX numbers).