Two PCs on the same switch but different VLANs cannot ping — is that broken?

It's working exactly as designed — that's what VLANs are for. Each VLAN is a separate broadcast domain: PC1's ARP request for PC2 floods only VLAN 10 ports, so PC2 never even hears it. A switch never bridges between VLANs, full stop. Two fixes, one wrong and one right. Wrong: putting both PCs in the same subnet doesn't help — L2 separation trumps L3 addressing. Right: give each VLAN its own subnet and route between them — either a router-on-a-stick (one trunk to a router with subinterfaces) or an SVI per VLAN on a Layer 3 switch. And if traffic does pass between your VLANs without a router, that's when you should worry — it usually means every port landed in VLAN 1.