diff --git a/evidence/vps-g2-pending-status-20260521.md b/evidence/vps-g2-pending-status-20260521.md
new file mode 100644
index 0000000..614dee3
--- /dev/null
+++ b/evidence/vps-g2-pending-status-20260521.md
@@ -0,0 +1,52 @@
+# VPS G2 Pending Status Check - 2026-05-21
+
+Owner: VPS_EXECUTOR
+Task: T10A - G2 VPS Gateway Pending Status Read-Only Check
+Workspace: `/home/ubuntu/openclaw-control-plane`
+
+## Preconditions
+
+- Latest `git pull` completed before the Gateway status check.
+- Read `USER_STATUS.md`, `AGENT_BOARD.md`, `docs/G2_RUNBOOK.md`, `tasks/T9-G2-PC-node-run.md`, `tasks/T10A-G2-VPS-pending-status-check.md`, `tasks/T10-G2-VPS-pairing-approve.md`, `handoff/VPS_EXECUTOR.md`, and `sync-state/`.
+- T9 evidence `evidence/pc-g2-node-run-20260521.md` reports user-observed connection to `openclaw.smartmotor.cloud`, but no pairing request ID or pending node ID.
+- Sync-health files were present and clean; no `sync-state/error-*.md` files were present.
+
+## Read-Only Commands Used
+
+No token/password/secret value was supplied.
+
+```bash
+docker exec openclaw-gateway node openclaw.mjs nodes --help
+docker exec openclaw-gateway node openclaw.mjs devices --help
+docker exec openclaw-gateway node openclaw.mjs nodes pending --help
+docker exec openclaw-gateway node openclaw.mjs nodes list --help
+docker exec openclaw-gateway node openclaw.mjs nodes status --help
+docker exec openclaw-gateway node openclaw.mjs nodes pending --json
+docker exec openclaw-gateway node openclaw.mjs nodes list --json
+docker exec openclaw-gateway node openclaw.mjs nodes status --json
+docker exec openclaw-gateway node openclaw.mjs devices list --help
+docker exec openclaw-gateway node openclaw.mjs devices list --json
+```
+
+## Result Summary
+
+Target identity: `desktop-vuor0gs`
+
+- `nodes pending --json`: no pending node pairing requests.
+- `nodes list --json`: pending `0`, paired `0`.
+- `nodes status --json`: no known nodes.
+- `devices list --json`: no pending device pairing requests.
+- `desktop-vuor0gs` was not visible as pending, paired, online, or approved in the Gateway node status output.
+- No non-secret pairing request ID or pending node ID was found for `desktop-vuor0gs`.
+- No VPS approval target is available from this check.
+
+## Safety Confirmation
+
+- No `devices approve`, `nodes approve`, `reject`, `remove`, `rename`, `revoke`, `rotate`, `invoke`, restart, reload, token rotation, config edit, Nginx edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
+- No token/password/secret value was requested, supplied, recorded, or stored in this evidence.
+- This evidence records only non-secret command shapes and status summary.
+
+## Follow-Up
+
+- T10 should remain blocked because there is no specific non-secret request/node ID to approve.
+- ORCHESTRATOR may decide whether PC_EXECUTOR should refresh the foreground node run evidence or whether another read-only verifier step is needed.
diff --git a/handoff/VPS_EXECUTOR.md b/handoff/VPS_EXECUTOR.md
index 816be46..a6ccb7a 100644
--- a/handoff/VPS_EXECUTOR.md
+++ b/handoff/VPS_EXECUTOR.md
@@ -38,6 +38,19 @@ After the Gitea control plane is synchronized, collect current VPS baseline evid
 
 ## Last Update
 
+2026-05-21 T10A read-only Gateway pending/online status check completed.
+
+- Evidence written to `evidence/vps-g2-pending-status-20260521.md`.
+- Latest `git pull` completed before checking.
+- Read-only commands used: Gateway `nodes --help`, `devices --help`, `nodes pending/list/status --help`, `nodes pending/list/status --json`, `devices list --help`, and `devices list --json`.
+- Result for `desktop-vuor0gs`: not visible as pending, paired, online, or approved in Gateway node status output.
+- Gateway node summary: no pending node requests, no paired nodes, no known nodes.
+- Device summary: no pending device pairing requests.
+- No non-secret request ID or pending node ID was found for `desktop-vuor0gs`; no VPS approval target is available.
+- T10 should remain blocked unless ORCHESTRATOR opens a new path with a specific non-secret target.
+- No approval, restart, reload, token rotation, config edit, Nginx edit, Docker/compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
+- No token/password/secret value was requested, supplied, recorded, or stored.
+
 2026-05-19 fresh second G2 authorization recorded, but T10 remains blocked until T9 evidence exists.
 
 - T10 is blocked and must not be claimed or executed.
diff --git a/tasks/T10A-G2-VPS-pending-status-check.md b/tasks/T10A-G2-VPS-pending-status-check.md
index 2bd2cb1..31a9501 100644
--- a/tasks/T10A-G2-VPS-pending-status-check.md
+++ b/tasks/T10A-G2-VPS-pending-status-check.md
@@ -2,7 +2,7 @@
 
 ## Status
 
-ready
+done
 
 ## Owner
 
@@ -77,3 +77,11 @@ If a listed command is unavailable, VPS_EXECUTOR may use the nearest read-only `
 ## Acceptance
 
 ORCHESTRATOR uses this read-only evidence to decide whether T10 remains blocked pending a specific non-secret approval target, can be opened for a specific approval, or can be skipped because the intended PC node is already online/approved.
+
+## Completion Notes
+
+- VPS_EXECUTOR completed the read-only Gateway status check on 2026-05-21.
+- Evidence: `evidence/vps-g2-pending-status-20260521.md`.
+- Handoff updated: `handoff/VPS_EXECUTOR.md`.
+- Result: `desktop-vuor0gs` was not visible as pending, paired, online, or approved; no non-secret request ID or node ID was found.
+- No approval, restart, reload, token rotation, config edit, Nginx edit, Docker/compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.