tasks(vds-migration): decompose umbrella → 3 child tasks

- mssql-vds-migration ⚪: Express edition, BACKUP/RESTORE method, mssql.kzntsv.site:1433
- minio-imgproxy-vds-migration ⚪: MinIO upgrade 2020→latest, mc mirror, includes imgproxy+nginx
- iis-cutover-to-vds-services 🔵: atomic web.config repoint (1 file → 11 hosts), blocked on both migrations
- umbrella mssql-minio-migration-to-vds 🟢: decomposed (kept for history)

Discovery: 5 prod DBs ≤ 968 MB (Express OK), .ldf logs 12 GB → SHRINKFILE
pre-cutover. VDS: 79 GB free, 5.8 GB RAM avail. ownCloud capped 1G.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/STATUS.md

@@ -1,5 +1,5 @@
 # Admin Task Board
-_Updated: 2026-05-22 (owncloud-vds-deploy 🟢 — 25 044 объектов / 26 GB live, все 6 large-file холдауты залиты VDS-side curl loopback'ом; 60s upload-timeout finding закреплён в [`ocis-on-vds-deploy-recipe`](../.wiki/concepts/ocis-on-vds-deploy-recipe.md) §Gotcha 5)_
+_Updated: 2026-05-22 (mssql-minio-migration-to-vds декомпозирована → 3 child tasks: `mssql-vds-migration` ⚪ + `minio-imgproxy-vds-migration` ⚪ + `iis-cutover-to-vds-services` 🔵. Discovery: 5 prod DBs все ≤ 968 MB <10 GB Express OK; .ldf logs 12 GB → SHRINKFILE pre-cutover; MinIO 3 GB + image 2020 (CVE) → upgrade + `mc mirror`; imgproxy stack едет вместе. **IIS cutover — финальный шаг ради которого всё затевалось**: 11 CMS hosts через snolla catch-all = atomic edit одного web.config. VDS: 79 GB disk free, 5.8 GB RAM available, ownCloud mem_limit 1G applied.)_
 
 <!--
   Status legend:
@@ -517,13 +517,49 @@ User confirmed close by inspection: "Close review as no-new-findings (Recommende
 
 ---
 
-## ⚪ [mssql-minio-migration-to-vds] — Фаза 2 CMS backup. Перенести MSSQL контейнер + MinIO с windows-recovery-host на vds-kzntsv. Achieves target RPO 1ч через интеграцию с существующим `vds-backup-rsync-kreknin` pipeline (tx log backups каждые 60 мин в существующий rsync→kreknin). Снимает SPOF с домашней машины для критических CMS-данных.
+## 🟢 [mssql-minio-migration-to-vds] — декомпозирована 2026-05-22 на две независимые таски
 
-После завершения — списать `cms-stopgap-backup-daily` cron на windows-host.
+**Closed:** 2026-05-22 — Discovery prep сессия (windows-side docker ps + sizes + VDS docker ps + stats) выявила что MSSQL и MinIO имеют разные мигратные паттерны (BACKUP/RESTORE vs `mc mirror`), разные окна простоя, разные rollback, разный risk profile (Express edition limit check vs MinIO 5-year upgrade). User decided: split на две таски.
+
+**Children:**
+- `mssql-vds-migration` ⚪ — MSSQL only, Express edition prod, SHRINKFILE-cleanup → BACKUP/RESTORE → traefik TCP `mssql.kzntsv.site:1433`.
+- `minio-imgproxy-vds-migration` ⚪ — MinIO upgrade `2020-07-13` → latest + imgproxy + imgproxy-nginx, `mc mirror`, traefik HTTPS `minio.vds.kzntsv.site` (+ console subdomain).
+
+Original umbrella `.tasks/mssql-minio-migration-to-vds.md` сохранён для history (acceptance/decisions/risks merged в children).
+**Branch:** n/a
+
+---
+
+## ⚪ [mssql-vds-migration] — Перенести MSSQL с windows-recovery-host на vds-kzntsv. Express edition (prod, 10 GB/DB limit OK для всех 5 prod DBs), `mssql.kzntsv.site:1433` через traefik TCP passthrough.
+
+Method: BACKUP DATABASE WITH COMPRESSION, COPY_ONLY → scp → RESTORE на VDS. Кросс-edition (Developer→Express). Pre-cutover SHRINKFILE на .ldf срежет 12 GB logs (warning: ломает log-chain до следующего FULL — приемлемо в migration window).
 
 **Status:** ready
 **Where I stopped:** (not started)
-**Next action:** См. `mssql-minio-migration-to-vds.md` — full acceptance (8 items) + risks + open questions. Major task (1-2 недели realistic). Разбить на sub-phases: (a) MSSQL container deploy на VDS + restore from backup, (b) connection string change + smoke 8 hosts, (c) MinIO migration через `mc mirror`, (d) backup pipeline integration в `/opt/stacks/backup/scripts/run.sh`. **Pre-cutover benchmark обязателен** (admin assets UI / search / catalogs) — WAN latency 10-30ms vs localhost. Spawn'd by [resilience-roadmap-design] workshop pass 1 2026-05-21.
+**Next action:** См. `mssql-vds-migration.md` — full acceptance (9 items) + risks + open questions. Sub-phases: (1) SHRINKFILE cleanup на source, (2) BACKUP 5 DBs → scp → RESTORE на VDS, (3) traefik TCP entrypoint :1433 + ufw, (4) DNS A `mssql.kzntsv.site`, (5) CMS connection-string repoint + smoke 8 hosts, (6) backup pipeline integration (mssql_dump_full daily + mssql_tx_log_backup hourly → достигает RPO 1ч), (7) source decommission после 48ч uptime. **Pre-cutover benchmark обязателен** (WAN 10-30ms vs localhost). После first VDS backup-pipeline run — списать [cms-stopgap-backup-daily]. Spawn'd by [mssql-minio-migration-to-vds] decomposition 2026-05-22.
+**Branch:** n/a
+
+---
+
+## ⚪ [minio-imgproxy-vds-migration] — Перенести MinIO + imgproxy + imgproxy-nginx с windows-recovery-host на vds-kzntsv. Заодно **upgrade MinIO** `RELEASE.2020-07-13` (5 лет, CVE) → `minio/minio:latest`. `minio.vds.kzntsv.site` + `minio-console.vds.kzntsv.site` через traefik HTTPS.
+
+Method: snapshot bind-mount source (rollback insurance) → empty new MinIO на VDS → `mc mirror old→new` → fallback `aws s3 sync` если format-compat ломается → repoint CMS endpoints + imgproxy через internal `shared-dbs` network (`http://minio:9000`).
+
+**Status:** ready
+**Where I stopped:** (not started)
+**Next action:** См. `minio-imgproxy-vds-migration.md` — full acceptance (9 items) + risks + open questions. Sub-phases: (1) snapshot source bind-mount, (2) deploy stack на VDS (minio + imgproxy + imgproxy-nginx, networks proxy+shared-dbs), (3) traefik HTTPS routes + LE certs + DNS A-records, (4) `mc mirror` per-bucket with verify, (5) repoint CMS image endpoints + smoke 8 sites, (6) backup pipeline integration (minio_mirror daily — recommend rsync over mc mirror для simplicity), (7) source decommission после 48ч. **Open compat risk:** xl.meta format gap 5 лет — dry-run `mc mirror --dry-run` сначала, fallback plan B (same old image на VDS, upgrade later). Spawn'd by [mssql-minio-migration-to-vds] decomposition 2026-05-22.
+**Branch:** n/a
+
+---
+
+## ⚪ [iis-cutover-to-vds-services] — **Финальный cutover** IIS на windows-recovery-host: repoint CMS conn-strings с `localhost,1433` → `mssql.kzntsv.site,1433` + `localhost:9000` → `minio.vds.kzntsv.site`. Это **то ради чего всё затевалось** — миграции MSSQL/MinIO бесполезны без этого шага.
+
+Atomic edit: один `C:\sites\snolla\web.config` обслуживает 11 CMS-хостов через traefik catch-all (`*:8089`) + `stostayer.old\web.config` (local-only). `iisreset` → 11 хостов мигрируют разом. Rollback = revert backup.
+
+**Status:** blocked (waiting on `mssql-vds-migration` + `minio-imgproxy-vds-migration`)
+**Where I stopped:** (not started)
+**Next action:** См. `iis-cutover-to-vds-services.md` — full acceptance (11 items). Sub-phases: (1) audit config locations (`Get-ChildItem -Recurse C:\sites -Include web.config,appsettings.*.json | Select-String 'localhost,1433|localhost:9000'`) → mapping site→DB→endpoint, (2) pre-cutover benchmark (admin/assets/getList + search + каталоги) → baseline, (3) backup web.config'ов, (4) edit conn-strings (`localhost,1433` → `mssql.kzntsv.site,1433;TrustServerCertificate=true`), (5) edit MinIO/imgproxy endpoints (audit-driven), (6) iisreset + smoke 8 hosts, (7) post-cutover benchmark <2x degradation gate, (8) MinIO write smoke (admin upload → mc ls verify + imgproxy render), (9) 48ч soak, (10) decommission source containers + списать `cms-stopgap-backup-daily`. **Open risk:** если MinIO/imgproxy URLs hardcoded в скомпилированных DLL — fallback: оставить `imgproxy-nginx` на windows-host, transparent proxy на VDS MinIO. Spawn'd by user-poke 2026-05-22 («IIS перенастроить!»).
+**Blocker:** mssql-vds-migration + minio-imgproxy-vds-migration
 **Branch:** n/a
 
 ---