diff --git a/questions-09022206.md b/questions-09022206.md
index 3f150a9..d1465fe 100644
--- a/questions-09022206.md
+++ b/questions-09022206.md
@@ -70,3 +70,25 @@ rotation + live-restore. Script ready: KNEL/cloudron
 perf/docker-daemon.json.planned. Until then the postgres nofile bridge is
 ephemeral (lost on postgres container recreate). Detail: t/316.
 - [x] Pick a window — DONE 2026-09-02 ~19:30 CDT: applied (live-restore + nofile 262144 defaults); first-attempt log-driver conflict incident documented on #731
+
+## CMDB change-control rulings needed (#705 P0 live → P2/P3)
+
+### C1. CR itemtype for the 7-state workflow
+GLPI natively has both Ticket and Change. The t/319 workflow
+(Draft→Review→Approved→Scheduled→Implemented→Verified→Closed) maps most
+cleanly onto GLPI **Changes** (validation/plan/approval fields built in),
+with Tickets for break-fix. Recommend: Changes for CRs, Tickets stay for
+incidents; both linked to the CI they touch.
+
+### C2. Write access for the cmdb agent in the CR phase
+Agent is Read-Only today (verified). If CRs live in GLPI, the agent needs
+to CREATE/transition them — recommend adding the Self-Service profile
+alongside Read-Only (can open + follow own items, still can't edit CIs).
+Alternative: CRs enter via Redmine only and GLPI stays read-only for now.
+
+### C3. #307 → GLPI refresh cadence
+from-inventory.sh regenerates the CSV from the Discourse #307 raw;
+to-glpi.sh is idempotent by name. Recommend folding "refresh #307 →
+regenerate → import → report diff" into the daily 09:00 C2 housekeeping.
+Related data-quality: #307 §5 has `pfvsvrki.knel.net` typo; 14
+stale-dns-record CIs need reconcile-or-delete ruling.