diff --git a/docs/RUNBOOK-PhaseC.md b/docs/RUNBOOK-PhaseC.md
index f44dd23..23bc20f 100644
--- a/docs/RUNBOOK-PhaseC.md
+++ b/docs/RUNBOOK-PhaseC.md
@@ -91,13 +91,33 @@ ci validate host ; echo "exit=$?"
 Checks vmrun, template snapshots, keyring, `/var/lib/ci` permissions, `act-runner`
 unit. Exit `0` + all `[OK ]`; a `[FAIL]` line names the broken check.
 
+### Find a running guest's IP (needed for `validate guest`)
+`vmrun getGuestIPAddress` reads the IP from VMware Tools — the VM must be
+**powered on** and Tools running. Run it as `ci-runner` (the VMs are started by
+that user, so its `vmrun` inventory is the one that sees them):
+```bash
+# Linux template
+sudo -u ci-runner vmrun getGuestIPAddress /var/lib/ci/templates/LinuxBuild2404/LinuxBuild2404.vmx
+# Windows template
+sudo -u ci-runner vmrun getGuestIPAddress /var/lib/ci/templates/WinBuild2025/WinBuild2025.vmx
+# A build clone (glob the job dir)
+sudo -u ci-runner vmrun getGuestIPAddress /var/lib/ci/build-vms/Clone_*/Clone_*.vmx
+
+# List which VMs are powered on first
+sudo -u ci-runner vmrun list
+```
+> **Gotcha (AGENTS.md #1):** `getGuestIPAddress` can exit `0` and print
+> `Error: The VMware Tools are not running...` on stdout when Tools are down.
+> A line starting with `Error:` means *no IP yet* — wait for boot, don't parse it.
+
 ### `validate guest` — diagnose a running guest's transport
 ```bash
-ci validate guest --host 192.168.79.200 --ssh   --guest-os linux     # SSH
-ci validate guest --host 192.168.79.201 --winrm --guest-os windows   # WinRM
+ci validate guest --host 192.168.79.128 --ssh   --guest-os linux     # SSH (Linux)
+ci validate guest --host 192.168.79.201 --winrm --guest-os windows   # WinRM (Windows)
 ```
 Connects + runs a trivial command, printing the explicit cause on failure
-(connect vs auth vs command). The guest must already be booted.
+(connect vs auth vs command). The guest must already be booted — get its IP
+with `getGuestIPAddress` above.
 
 ### `monitor disk` — free-space alert
 ```bash