Updated environment

docs/04-security-hardening.md

@@ -54,6 +54,23 @@ Default-deny at datacenter/node level, whitelist only what's needed (see
 `config/pve-firewall/cluster.fw.example`, applied by
 `scripts/deploy-firewall.sh`.
 
+**ICMP echo (ping) is explicitly allowed from the management network**,
+alongside SSH/8006 — not required for anything to function, but without
+it `policy_in: DROP` silently eats ping while SSH/web UI keep working.
+That split (ping dead, everything else fine) reads exactly like a real
+outage mid-troubleshooting; see `06-pve-test-wifi-network.md` for a case
+this caused genuine confusion after a network change. If you ever debug
+"can't ping but can SSH", check this firewall before assuming the
+network itself is broken.
+
+**This file is cluster-wide, not per-node**: `cluster.fw` lives in
+`/etc/pve/firewall/` — shared via pmxcfs across every node in a cluster.
+A node that joins a cluster inherits whatever's already there, and (per
+`docs/05-node-roles.md`) keeps its own local copy after leaving. Don't
+assume a node's firewall state matches what `deploy-firewall.sh` was
+last run with directly against it — check `pve-firewall status` /
+`/etc/pve/firewall/cluster.fw` on the actual node.
+
 ## Repos and updates
 
 Fresh installs point at the enterprise repo, which fails on `apt update`