diff --git a/questions-09022206.md b/questions-09022206.md
index 3607994..c3c9a0d 100644
--- a/questions-09022206.md
+++ b/questions-09022206.md
@@ -53,3 +53,20 @@ HA WiZ entries by host + we identify the other ~11 lights' integration.
 - #684 PBS session scheduling (+ drive-rotation target design)
 - TasmoAdmin uninstall (stopped+disabled 2026-09-02 — full uninstall?)
 - Govee disabled dup entry: one-click delete in HA UI
+
+### 13. Cloudron API token (#685/#727) — unblocks API-first access
+The #685 perf investigation ran over raw SSH (root@my.knownelement.com) because
+no panel API token exists. A token (read scope minimum) lets the agent use the
+Cloudron API (apps/configs/backups) instead of shell — cleaner audit trail and
+the path for AWX/Ansible modules. Also tracked in KNEL/cloudron
+questions-v1.md (https://git.knownelement.com/KNEL/cloudron).
+- [ ] Create token (panel: my.knownelement.com → profile → API access)
+- [ ] Material value → ~/.creds/cloudron.env as CLOUDRON_API_TOKEN=<token>
+
+### 14. docker daemon.json bounce window — my.knownelement.com (#727)
+One planned dockerd restart (ALL ~300 containers bounce; live-restore=false
+today, so no zero-downtime path) to apply nofile 262144 defaults + log
+rotation + live-restore. Script ready: KNEL/cloudron
+perf/docker-daemon.json.planned. Until then the postgres nofile bridge is
+ephemeral (lost on postgres container recreate). Detail: t/316.
+- [ ] Pick a window (suggest pre-storm weekday morning)