docs: add SE5420 core-switch deployment plans; note PVE VM topology

hosts/gfw.windy.lan.md

@@ -8,6 +8,7 @@
 | IPv4 | `192.168.66.1` |
 | SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) |
 | OS | ImmortalWrt 25.12.0 (r37854), Linux `6.12.87`, x86/64 |
+| **Host** | **PVE VM 140 (`gfw`)** — dual NIC: `net0`→vmbr0(LAN66), `net1`→vmbr1(LAN55) (verified 2026-08-09) |
 
 Do not store the root password in this repository.
 
@@ -42,6 +43,21 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
 `8443` is not an OpenClash listener and has no runtime nftables forwarding rule.
 It is included only in OpenClash's common TLS-sniffing port list.
 
+## VLAN 10 Wi-Fi feasibility
+
+`gfw` is a VM attached to untagged LAN 66, rather than a physical VLAN-trunk
+endpoint. The U6 Lite likewise reaches the ER-X over LAN 66, whose DHCP
+service supplies client addresses. Therefore `gfw` cannot currently receive an
+SSID's VLAN 10 traffic merely by creating an `eth0.10` interface inside the VM.
+
+Do not treat a local `eth0.10`/`192.168.10.1` configuration as a deployable
+Wi-Fi gateway unless the hypervisor/vSwitch and the complete physical path to
+the AP have first been configured and verified to carry tagged VLAN 10. The
+`ubnt-upg` test receiving a `192.168.66.x` lease was the expected consequence
+of the available untagged path, not evidence that this host should compete
+with ER-X DHCP. See
+[UniFi Network: Dedicated Wi-Fi through a third-party gateway](../docs/unifi-network.md#dedicated-wi-fi-through-a-third-party-gateway).
+
 ## Operational note
 
 When OpenClash logs a LAN client request such as
@@ -50,4 +66,3 @@ an explicit-proxy client sending its own loopback request to the gateway. Fix
 the originating host's `NO_PROXY` / `no_proxy` configuration; do not create a
 listener on this router to mask the problem. See
 [the UniFi localhost proxy note](../docs/unifi-openclash-localhost.md).
-