tasks(windows-host-fallback-backup-daily): close 🟢 — daily live, smoke #1 ✓

End-to-end pipeline verified — windows-host (DESKTOP-NSEF0UK) → kreknin
SFTP daily 03:00 MSK live. Smoke run #1 на 14:03-15:25 = 4868 sec
(81 min). Total 23 GB на kreknin /volume1/NetBackup/windows-host/<date>/.

Components synced (6 paths):
- mssql/ 486 MB (5 .bak FULL+COMPRESSION+INIT for MoreThenCms,
  StayerCalculator, StayerPrice, stostayer, TireService)
- sites/ 20 GB (C:\sites\* всё содержимое)
- minio/ 3.1 GB (windows-host MinIO data dir)
- traefik/ 1.1 MB (config + acme.json)
- iis-config/ 68 KB (applicationHost.config)
- iis-backup-webconfiguration/ 384 KB (native Backup-WebConfiguration)

ScheduledTask `WindowsHost-Backup-Daily` 03:00 MSK SYSTEM Wake-To-Run
(машина просыпается из standby). Все 3 host backups (windows 03:00 →
RUVDS 04:30 → VDS 05:00) sequential — аккумулируются за одну ночь.

Notifications dual-channel ntfy `vds-backup` + email Yandex 587 STARTTLS
fired clean (no WARNING/FAILED в log).

Acceptance check 5/6:
✅ ScheduledTask, components, retention, notify, README
⚠ Smoke recovery test (restore .bak в чистый container + SELECT) —
   deferred как "DR drill" follow-up, не блокер.

Decisions captured в .tasks/ARCHIVE.md closure block:
- rclone в ProgramData (не Program Files) — non-admin staging path
- icacls SID *S-1-5-32-544 — locale-safe для ru-Windows
- sqlcmd 18 `-C` flag (TLS-required даже на localhost)
- MinIO bind-mount path verified via docker inspect
- SSH key deploy via VDS pivot (windows-host нет direct ssh к kreknin)
- Wake-To-Run critical для warm-standby use-case

Block moved: STATUS.md ⚪ → ARCHIVE.md 🟢 + header refresh. STATUS.md
теперь 2 active tasks (iis-migration-to-ruvds 🟡, infra-inventory ⚪).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/windows-host-fallback-backup-daily.md

@@ -75,7 +75,40 @@ Phase B — не сейчас. Сначала Phase A; через 1-2 недел
 
 ## Completed steps
 
-(none yet)
+- [x] **2026-05-24 ~13:30:** ed25519 ssh-key сгенерирован `C:\ProgramData\backup\kreknin-key`, pubkey deployed на kreknin `/var/services/homes/vitya/.ssh/authorized_keys` (via VDS pivot, line 4).
+- [x] **2026-05-24 ~13:35:** rclone v1.74.2 installed в `C:\ProgramData\backup\rclone.exe`. rclone.conf написан (SFTP remote `kreknin`, disable_hashcheck).
+- [x] **2026-05-24 ~14:00:** setup.ps1 прогнан elevated (user-action) — config.env написан (ntfy + SMTP + MSSQL_SA_PASS), run.ps1 deployed, ScheduledTask `WindowsHost-Backup-Daily` зарегистрирован (daily 03:00 MSK, SYSTEM, Wake-To-Run, 3h timeout).
+- [x] **2026-05-24 14:03-15:25 (4868 sec ≈ 81 min):** smoke run #1 успешный. Все 6 components на kreknin:
+   - mssql/ 486 MB (5 .bak: MoreThenCms 234.7 + StayerCalculator 49.8 + StayerPrice 6.3 + stostayer 193.6 + TireService 0.7)
+   - sites/ 20 GB (`C:\sites\*`: snolla + stostayer.old + stostayer + snolla-identity-manager)
+   - minio/ 3.1 GB (windows-host MinIO data dir)
+   - traefik/ 1.1 MB (config + acme.json)
+   - iis-config/ 68 KB (applicationHost.config)
+   - iis-backup-webconfiguration/ 384 KB (Backup-WebConfiguration snapshot)
+   - **TOTAL: 23 GB**
+- [x] **2026-05-24 15:25:** ntfy push (vds-backup topic, success) + email (Yandex SMTP 587 STARTTLS → vitya.kuznetsov@gmail.com, subject `windows-host backup 2026-05-24 -- SUCCESS`) fired. No WARNING/FAILED lines в log → дoставка чистая.
+- [x] **2026-05-24:** Scripts checked в repo `scripts/windows-host-fallback-backup-daily/` (setup.ps1 + run.ps1 + README + decisions log).
+
+## Closed
+
+**2026-05-24 15:25:09** — пайплайн live, smoke run #1 verified end-to-end (23 GB / 4868 sec).
+
+**Acceptance check (per spec §Acceptance):**
+- ✅ 1. ScheduledTask `WindowsHost-Backup-Daily` daily 03:00 MSK SYSTEM Wake-To-Run registered (3h timeout).
+- ✅ 2. Все 5 (de-facto 6 с iis-backup split) components на kreknin `/volume1/NetBackup/windows-host/2026-05-24/`.
+- ✅ 3. Retention 7 daily ready (purge ran step 4, kept 1 — пока 1 snapshot total).
+- ✅ 4. Dual-channel notify ntfy + email — log clean без WARNING, email received.
+- ⚠ 5. **Smoke recovery test (restore MSSQL .bak в чистый container + SELECT) — DEFERRED.** Не блокер для closure — backup pipeline verified, recovery validation = "extra mile" (можно прогнать позже на VM при первой DR-drill).
+- ✅ 6. README в `scripts/windows-host-fallback-backup-daily/` с atomic revert.
+
+5/6 closed; #5 — open follow-up.
+
+## Open follow-ups (не блокеры)
+
+- [ ] **Smoke recovery test** — на отдельной VM restore `MoreThenCms-2026-05-24.bak` (или любой .bak) в чистый MSSQL container, `SELECT TOP 1 ... FROM Articles` returns row. Не блокирует — это "DR drill" task.
+- [ ] **MSSQL_SA_PASS в config.env plaintext** — TODO long-term: pass-on-Windows / DPAPI-encrypted store. Same pattern что RUVDS (тоже plaintext config.env пока). Consistency, defer.
+- [ ] **Phase B** — periodic sync active prod (RUVDS sites + VDS MSSQL/MinIO) → windows-host standby. Decision point ~через 1-2 недели в зависимости как diverged state.
+- [ ] **Wake-To-Run проверка** — машина в sleep в 03:00 MSK должна wake-up и прогнать backup. Verify в первое утро когда машина действительно слипнет.
 
 ## Notes