diff --git a/questions-v10.md b/questions-v10.md
new file mode 100644
index 0000000..1342acc
--- /dev/null
+++ b/questions-v10.md
@@ -0,0 +1,86 @@
+# Questions — v10 (current round)
+
+New round: O&M lane repo split + change management (work order 2026-09-03,
+[#769](https://projects.knownelement.com/issues/769)). Still-open PMG items
+from v9 carried at the bottom. One-line answers fine.
+
+## Done while you were away (no answers needed — for the 20-min sitting)
+
+- PFVCluster split into 12 dedicated KNEL repos (`~/projects/KNEL/<repo>`),
+  each with Redmine ticket + Discourse topic + git history. Map:
+  [t/296](https://community.turnsys.com/t/296) + AGENTS.md. PFVCluster keeps
+  cluster content only; KNELIAC references the new repos.
+- Unit tests moved with code (netinfra, facilities) and pass. All repos
+  carry the enforcement layer; pre-push audits green.
+- Change management: prod/preprod/sectestbed env map from live tsys5 state +
+  snapshot lifecycle tool (`scripts/pve-snapshot.sh`, verified end-to-end on
+  throwaway VM 59999, destroyed same session) — [t/331](https://community.turnsys.com/t/331).
+  Audit log: t/298 reply #120. pfv-bms/netinfra/PMG/PBS hard-protected in the tool.
+
+## O&M round — new (one decision each)
+
+**OQ1 (repo visibility).** Created all 12 repos PUBLIC per the 2026-08-31
+ruling, matching PFVCluster's class. OK, or flip some/all private
+(one-click each; say which)?
+
+**OQ2 (legacy overlaps).** Old repos `TSYS-CA` and `KNELSecretsManager`
+overlap the new `ca` / `secrets`. Archive them into the new scheme
+(redirect README), or leave as-is?
+
+**OQ3 (apt-satellite design).** Recommend: start with a flat pinned-mirror
+(the #758 tsys-ca pattern), graduate to aptly when the fleet grows.
+Approve?
+
+**OQ4 (Prometheus placement).** Recommend: Prometheus + Alertmanager on
+tsys-librenms alongside LibreNMS (same vantage, no new VM); Grafana stays
+on Cloudron. Approve, or name a host?
+
+**OQ5 (Kuma window automation).** `~/.creds/uptime-kuma.env` exists — may I
+wire it into `pve-snapshot.sh` so rollbacks auto-create the maintenance
+window (and close it after), instead of the current manual reminder?
+
+**OQ6 (preprod ownership).** The 531xx preprod lane on tsys5: is THIS lane
+the driver for vendor-version soak (~1wk, then promote), with per-domain
+chats consulted? Or per-stack?
+
+**OQ7 (GLPI changes during converge loops).** Until GLPI change-control is
+ruled (#705/#741): sectestbed playbook iterations stay Redmine-ticket-only,
+exception requests noted in the ticket. OK, or start logging GLPI Changes
+now?
+
+**OQ8 (pfv-bms → KNELBMS rename).** Deferred per your golden rule (HA chat
+active). Confirm the rename lands with the HA chat once you bless it — this
+lane will not touch it.
+
+## Carried from v9 — still open (PMG, #696)
+
+**PQ5 (native PMG cluster?).** Recommended: yes — config + quarantine
+replication between .1.11/.1.10, managed strictly serial. OK?
+
+**PQ6 (TLS from fleet CA #697?).** Recommended: yes for the two admin
+UIs; SMTP stays opportunistic.
+
+**PQ7 (notify address).** Confirm `coo@turnsys.com` for PMG alerts +
+held-mail notices?
+
+**PQ8 (VIP specifics).** Confirm VIP 192.168.3.249 + `smtp.knel.net` +
+dhcpd host-decl pin (VRRP MAC 00:00:5e:00:01:0a)?
+
+**PQ9 (outbound cutover staging).** Serial staged: PVE hosts + PBS first
+(verify a week), then VM postfix. OK?
+
+**PQ11 (Cloudron relay user — founder side).** Create `pfv-relay@turnsys.com`
+for PMG submission, or point me at who does? Fallback: PMG delivers direct
+to recipient MXs.
+
+**PQ12 (k8s submission port).** :25 unauthenticated from trusted LAN as
+default; :587+auth later if wanted. OK?
+
+**PQ10 (side findings — ticket placement).** (a) tsys-ucs-02 root alias
+blackhole; (b) Wazuh alerting never configured (#335). Ride-alongs in #696
+or separate sub-tickets?
+
+## Carried from v6 — still open
+
+**Q4. Second human approver in gitea?** Blocks access-roster merges by
+design until landed. Does not block code/deploy work.