diff --git a/.tasks/STATUS.md b/.tasks/STATUS.md
index 127426b..6b33582 100644
--- a/.tasks/STATUS.md
+++ b/.tasks/STATUS.md
@@ -1,13 +1,14 @@
 # Admin Task Board
-_Updated: 2026-05-25 (`books-vds-backup-daily-kreknin` 🟢 closed — 4-я daily backup pipeline на kreknin, теперь покрыта `books VDS` 89.253.255.133 (host4g.ru). Phone-side ntfy ✓ + email ✓ verified by user 2026-05-25. Также fix вики: `concepts/books-ssh-access.md` → `vds-kzntsv-ssh-access.md` (был misnamed — врал что books живёт на vds-kzntsv), `entities/books-vds.md` создан с factsheet'ом. Promised follow-up: новая ⚪ таска `books-vds-stacks-to-portainer` — мигрировать SSH-compose стеки (ES/mongo/minio/books-db/proxy-chain) под Portainer-managed.)_
+_Updated: 2026-05-25 (session start — `books-vds-stacks-to-portainer` поднят 🔴 active. Endpoint 6 = stostayer VDS — НЕ наш, scope не расширяем. Auto-push grant active.)_
 
-## ⚪ [books-vds-stacks-to-portainer] — migrate SSH-compose стеки на books VDS под Portainer-managed (pattern parallel VDS-infra retro-migration 2026-05-22). Targets: books-db, mongo, minio, elasticsearch, proxy-chain. Skip traefik + portainer (management plane).
+## 🔴 [books-vds-stacks-to-portainer] — migrate SSH-compose стеки на books VDS под Portainer-managed (pattern parallel VDS-infra retro-migration 2026-05-22). Targets: books-db, mongo, minio, elasticsearch, proxy-chain, **imgproxy** (added Phase 0 2026-05-25). Skip traefik + portainer (management plane).
 
-**Status:** ready
-**Where I stopped:** (not started — promised by user 2026-05-25 после `books-vds-backup-daily-kreknin` 🟢)
-**Next action:** см. [books-vds-stacks-to-portainer.md](books-vds-stacks-to-portainer.md). Phase 0 — read each stack's `/usr/docker/<svc>/docker-compose.yml` + `.env`, document env + binds.
+**Status:** active
+**Where I stopped:** Phase 0 done 2026-05-25 — probed 6 compose files + Portainer API. No env_file, all bind volumes, PAT works, endpoint 1 = books VDS (6 Portainer-managed already), endpoint 6 = stostayer (not ours). imgproxy added to scope.
+**Next action:** Phase 1 — adapter migration script `scripts/books-vds-portainer-migrate.sh` (clone-adapt of VDS-infra version в `.wiki/concepts/portainer-stack-management-vds.md`). Diff: URL → `portainer.kzntsv.site`, endpoint=1, dir prefix `/usr/docker/`, auth via `X-API-Key` header (PAT works, no JWT fallback needed).
 **Branch:** master
 <!-- created-by: claude / 2026-05-25 / trigger: user-requested follow-up after books-vds-backup-daily-kreknin -->
+<!-- activated: vitya / 2026-05-25 / session start -->
 
 ## 🟢 [books-vds-backup-daily-kreknin] — closed 2026-05-25 — daily backup books VDS (89.253.255.133, host4g.ru, CentOS 7) → kreknin в 06:00 MSK. DB dumps (mariadb/mongo×2) + ES snapshot via REST → rsync 4.87GB → ntfy/email (phone+inbox ✓). ES path.repo bootstrap + snapshot repo `kreknin` registered. См. [books-vds-backup-daily-kreknin.md](books-vds-backup-daily-kreknin.md).
 
diff --git a/.tasks/books-vds-stacks-to-portainer.md b/.tasks/books-vds-stacks-to-portainer.md
index 6422ce6..d688a26 100644
--- a/.tasks/books-vds-stacks-to-portainer.md
+++ b/.tasks/books-vds-stacks-to-portainer.md
@@ -10,11 +10,12 @@ Migrate SSH-compose стеки на books VDS (`89.253.255.133`) в Portainer-ma
 
 | Stack | Current dir | Adapt notes |
 |---|---|---|
-| `books-db` (MariaDB 10.6.4) | `/usr/docker/books-db/` | bind `./data` → absolutize. MYSQL_ROOT_PASSWORD env (передать через Portainer API env array). |
-| `mongo` (shared) | `/usr/docker/mongo/` | bind `./data/{db,configdb}` → absolutize. MONGO_INITDB_ROOT_* env. |
-| `minio` | `/usr/docker/minio/` | bind `./data` → absolutize. MINIO_ROOT_USER/PASSWORD env. |
-| `elasticsearch` | `/usr/docker/elasticsearch/` | bind `./data` + `./snapshots` (added 2026-05-25 для backup) → absolutize. path.repo env preserved. |
-| `proxy-chain` | `/usr/docker/proxy-chain/` | bind `./config` → absolutize. |
+| `books-db` (MariaDB latest) | `/usr/docker/books-db/` | bind `./data` → absolutize. Env inline (no env_file). |
+| `mongo` (shared, 4.2) | `/usr/docker/mongo/` | bind `./data/{db,configdb}` → absolutize. Env inline. |
+| `minio` (2020-07-13) | `/usr/docker/minio/` | bind `./data` → absolutize. Env inline. |
+| `elasticsearch` (7.10.0) | `/usr/docker/elasticsearch/` | bind `./data` + `./snapshots` (added 2026-05-25 для backup) → absolutize. path.repo env preserved. |
+| `proxy-chain` | `/usr/docker/proxy-chain/` | bind `./config` → absolutize. Internal-only (no traefik). |
+| `imgproxy` (2 containers: imgproxy + imgproxy-nginx) | `/usr/docker/imgproxy/` | added 2026-05-25 (Phase 0 discovery). Binds `./nginx/cache` + `./nginx/nginx.conf` → absolutize. Secrets inline. |
 
 **Skip (management plane):**
 - `traefik` — `/usr/docker/traefik/` — recreate ломает access всему остальному.
@@ -22,7 +23,7 @@ Migrate SSH-compose стеки на books VDS (`89.253.255.133`) в Portainer-ma
 
 ## Acceptance
 
-- 5 стеков (books-db, mongo, minio, elasticsearch, proxy-chain) появляются в `GET /api/stacks` под endpoint 1 (наряду с книгами `books-{api,web,scheduler,ntfy,ops-mcp}` + `chrome`).
+- 6 стеков (books-db, mongo, minio, elasticsearch, proxy-chain, imgproxy) появляются в `GET /api/stacks` под endpoint 1 (наряду с книгами `books-{api,web,scheduler,ntfy,ops-mcp}` + `chrome`).
 - Контейнеры работают, бинды смонтированы, data preserved (named volumes + binds через migration).
 - Smoke: каждый стек проходит health check соответствующий своему типу:
   - books-db: `docker exec books-db mariadb -uroot -p... -e 'SELECT 1'` → `1`
@@ -37,11 +38,13 @@ Migrate SSH-compose стеки на books VDS (`89.253.255.133`) в Portainer-ma
 
 - 2026-05-25: создана по запросу user'а после успешного `books-vds-backup-daily-kreknin`. Promised after backup pipeline live.
 - 2026-05-25: pattern reuse — `.wiki/concepts/portainer-stack-management-vds.md` migration script adaptable. Diff for books VDS: PORTAINER_URL, endpoint ID = 1, stack dirs `/usr/docker/<svc>/` instead of `/opt/stacks/<svc>/`. PAT в pass под `books-vds/full-env BOOKS_PORTAINER_API_KEY` (may need fallback to JWT if 401).
+- 2026-05-25 (session start): user confirmed **Endpoint 6 = stostayer VDS, НЕ наш** → scope не расширяем, Q1 closed. Auto-push grant active на сессию.
+- 2026-05-25 (Phase 0): SSH probe 5 target compose. Findings: (1) **no env_file** anywhere — inline env stays в stackFileContent, отдельный API env array не нужен; (2) **no surprise named volumes** — all bind, Q2 close to resolved; (3) mongo container image lost tag (digest-only) — fresh `mongo:4.2` pull при Portainer create acceptable; (4) Portainer API list endpoint 1 = 6 stacks (books-* + chrome), endpoint 6 = stostayer 8 stacks (confirmed not ours); (5) **discovered 6th stack:** `/usr/docker/imgproxy/` — `imgproxy` + `imgproxy-nginx` 2-container compose serving `imgproxy.kzntsv.site`, was missing from entity wiki. User confirmed → added to scope.
 
 ## Open questions
 
-- [ ] **Endpoint 6** в books Portainer — stostayer VDS? Что мы за него отвечаем? Если **да** — после books-vds migration extend этой таски на stostayer. Если **нет** — отдельный вопрос, не блокер.
-- [ ] **Volume preservation strategy** — `docker compose down` без `-v` preserves named volumes + binds. Verify для каждого стека что нет surprise named volumes которые могут эфемериться.
+- [x] ~~**Endpoint 6** в books Portainer — stostayer VDS?~~ Resolved 2026-05-25: stostayer **не наш**, scope не расширяем.
+- [x] ~~**Volume preservation strategy**~~ Resolved 2026-05-25 (Phase 0 probe): все 6 target стеков — bind-only, no named volumes. `docker compose down` без `-v` preserves binds (paths остаются на disk).
 - [ ] **CI implications** — деплой books-* stacks уже Portainer-managed. After migration of mongo/minio/etc — никаких изменений в CI не нужно (deploy.yml только books-api/web/scheduler, не infra). Confirm.
 - [ ] **ES snapshot path.repo edit preservation** — текущий `/usr/docker/elasticsearch/docker-compose.yml` имеет path.repo + snapshots bind (added 2026-05-25). Migration must preserve. Backup в `docker-compose.yml.bak-pre-snapshots-2026-05-25` есть для reference.
 
@@ -61,11 +64,12 @@ Migrate SSH-compose стеки на books VDS (`89.253.255.133`) в Portainer-ma
 2. Build adapter script `scripts/books-vds-portainer-migrate.sh` (clone-and-adapt of VDS-infra version, see [[.wiki/concepts/portainer-stack-management-vds]] § Migration script).
 
 **Phase 2 — per-stack migrate (one at a time, verify between):**
-1. proxy-chain (lowest blast radius)
-2. minio (read-mostly, books-api retries OK)
-3. mongo (shared) — books-api + books-task-runner retry-tolerant? **VERIFY first**
-4. books-db (MariaDB) — books-api uses connection-pool, brief downtime survivable
-5. elasticsearch — currently unused (per user), zero impact
+1. **proxy-chain** (lowest blast radius — no traefik exposure)
+2. **imgproxy** (2-container compose, serves `imgproxy.kzntsv.site` — drive-by added 2026-05-25)
+3. **minio** (read-mostly, books-api retries OK)
+4. **mongo** (shared) — books-api + books-task-runner retry-tolerant? **VERIFY first**
+5. **books-db** (MariaDB) — books-api uses connection-pool, brief downtime survivable
+6. **elasticsearch** — currently unused (per user), zero impact
 
 **Phase 3 — wiki + close:**
 1. Document в `.wiki/concepts/portainer-stack-management-books-vds.md` (or extend existing).
diff --git a/.wiki/entities/books-vds.md b/.wiki/entities/books-vds.md
index 09f18ca..20dafd8 100644
--- a/.wiki/entities/books-vds.md
+++ b/.wiki/entities/books-vds.md
@@ -54,7 +54,8 @@ Single root partition, нет отдельной `/data`. Docker hub data под
 | `/usr/docker/elasticsearch/` | elasticsearch | `./data` + `./snapshots` (added 2026-05-25) |
 | `/usr/docker/traefik/` | traefik | `./letsencrypt` (acme.json) + `./data/traefik.yml` |
 | `/usr/docker/portainer/` | portainer | named volume `portainer_data` |
-| `/usr/docker/proxy-chain/` | proxy-chain | upstream HTTP-proxy chain |
+| `/usr/docker/proxy-chain/` | proxy-chain | `./config` (upstream HTTP-proxy chain) |
+| `/usr/docker/imgproxy/` | imgproxy + imgproxy-nginx | `./nginx/cache` + `./nginx/nginx.conf` (serves `imgproxy.kzntsv.site`, S3 backend via minio) |
 
 **TODO**: мигрировать максимум SSH-managed контейнеров под Portainer (отдельная таска после backup-pipeline live). Cause: разделённое управление обламывает CI (Portainer-only deploy.yml) и debugging.