diff --git a/questions-v7.md b/questions-v7.md
new file mode 100644
index 0000000..1cd24a6
--- /dev/null
+++ b/questions-v7.md
@@ -0,0 +1,76 @@
+# Questions — v7 (current round)
+
+Round v6 carried below (badge Q4 still open). New this round: the
+Proxmox Mail Gateway pair (#696, child of #694) design questions
+PQ1–PQ7. Recommended defaults are stated per question — answering
+"defaults fine" (or naming exceptions) is enough.
+
+## PMG round (#696) — awaiting answers
+
+**PQ1. Mail domains + backend target?**
+Which domains' mail should flow through the PFV PMG pair (e.g.
+knownelement.com, turnsys.com, thefnf.net)? And what sits behind PMG
+as the delivery target — the Cloudron VPS in Reston VA? If so, which
+hostname should PMG smarthost to (e.g. `mail.<domain>`)?
+*Ground truth: the internal Technitium `knel.net` zone has no MX
+records; public MX lives at OVH/Cloudron (founder DNS).*
+
+**PQ2. Inbound path from the internet?**
+Recommendation: edge DNAT of SMTP :25 → both PMG nodes (LAN IPs),
+PMG filters then relays to the Cloudron backend. Which edge does the
+DNAT live on today — the rrinfra Cisco (existing), and are there any
+existing mail port-forwards I should be aware of?
+
+**PQ3. Outbound smarthost?**
+Should LAN/Tailscale systems (hosts, VMs, appliances) relay outbound
+mail through PMG? If yes, confirm authorized source subnets for the
+allowlist. And Cloudron's own outbound: keep it direct (as today) or
+route it back through PMG too?
+
+**PQ4. VM placement + sizing?**
+Recommendation: 2 VMs, each 2 vCPU / 4G RAM / 32G system disk (PMG is
+light). PMG-01 on tsys4, PMG-02 on tsys6 — honoring the standing
+ruling that tsys6/7 use USB storage only (PMG disks are small, fits
+fine). VMIDs: next free in the production range unless you want
+specifics. OK?
+
+**PQ5. Native PMG cluster or independent pair?**
+Recommendation: PMG native clustering (config + quarantine DB
+replicates between the two), managed strictly serial with a health
+gate between hops per the blue/green house rule. OK?
+
+**PQ6. TLS from the fleet CA (#697)?**
+Recommendation: issue certs for `pmg-01.knel.net` / `pmg-02.knel.net`
+from the tsys-ca intermediate for the admin UIs; SMTP keeps
+opportunistic TLS (external senders never see our internal CA, so no
+interop risk). OK?
+
+**PQ7. Quarantine + admin notifications?**
+Defaults I'd apply unless you say otherwise: quarantine retention 7
+days, daily quarantine digest to your admin address — **which address
+should receive quarantine reports and PMG alerts?**
+
+## Carried from v6 — still open
+
+**Q4. Second human approver in gitea?**
+**A (from v6):** Founder: "planned for very near future." Until
+granted + named, KNEL/access-roster merges are IMPOSSIBLE by design
+(fail-safe). Does not block code/deploy work.
+
+## Carried from v6 — resolved
+
+**Q1. Door actuator path?** Same 2018 hardware — usbrelay strike on
+pfvsvrpi (16c0:05df); usbrelay tool install is ticket-gated #356.
+
+**Q2. Reader model + badge format?** Both readers = 13ba:0018 PCPlay
+PCP-BCG4209; pfvsvrpi aarch64/event0, ultix-field x86_64/event15;
+24-byte records; 10-digit decimal + Enter.
+
+**Q3. Badge whitelist home?** HA-side whitelist, materialized as
+separate repo KNEL/access-roster (see Q5).
+
+**Q5. Two-approval gate on roster home?** RESOLVED 2026-09-02 —
+founder ruling: roster is 100% separate. Built: KNEL/access-roster
+(private, PR-only + two human approvals); holds roster/badges.yaml.
+doorman code repo de-gated. HA consumption owned by the pfv-bms
+session.