- Reorder §3.3: create VLAN66/55 before SVI; keep VLAN1 until management path verified - Fix §3.4 verification port wording (enabled VLAN66 access port, e.g. port 6) - Harden VLAN10 phase: PVE boundary, gfw NAT/IPv6 policy, rollback order, verification chain