tasks(iis-migration-to-ruvds): pause после failed-robocopy + ingest SMB-default finding

Temp admin (2026-05-23 09:37-18:08) начал импл iis-migration-to-ruvds,
не закончил bootstrap, упал на UNC robocopy (exit 16) и dropped tree dirty.

Session recovery:
- secrets leak fix: `.secrets/ruvds-iis.env` → `pass show ruvds-iis/full-env`
  (etap-2 discipline restored). `.secrets/` + `*.env` + `*-log.txt` + `*-size.txt`
  added to `.gitignore` чтобы не повторилось.
- root cause зафиксирован: TCP/445 closed по дефолту на fresh Win Server 2025
  Core + SMB share не создан → UNC robocopy не работает без RUVDS bootstrap.
- new concept `windows-server-2025-core-bootstrap.md` — default-blockers
  table + transfer-методов матрица (RDP-redirect / SMB / WinRM / SFTP) +
  bootstrap-чеклист 12 шагов. Recommendation = SMB inbound с source-IP
  whitelist.
- task ⚪ → 🟡 paused с concrete next-step (capacity audit, transfer-method
  confirm, RUVDS bootstrap, backup source, recreate IIS sites + conn-string
  swap, pilot kupimknigi + DNS swap).
- Open question raised: source 11 sites сумма vs RUVDS 30 GB HDD — capacity
  blocker possible (snolla одна 8.66 GB).

Не push'нуто — ждёт user grant per project-discipline Rule 4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/STATUS.md

@@ -1,5 +1,5 @@
 # Admin Task Board
-_Updated: 2026-05-22 (Сессия: MSSQL Express 2022 live (`mssql.kzntsv.site:1433`, 5 DBs, 8 prod hosts 200 OK). MinIO/imgproxy VDS stack live as standby (CMS остаётся на windows из-за hardcoded URL в closed-source DLL). board-viewer-vds-deploy ✓ (board.kzntsv.site + basicauth). **+ Portainer-migration sweep**: 12 ad-hoc stacks → Portainer-managed (canonical rule добавлен в CLAUDE.md + `portainer-stack-management-vds` concept). Skipped traefik+portainer (management plane). Decommission window-host MSSQL после 48ч soak 2026-05-24.)_
+_Updated: 2026-05-23 (Session-recovery: temp admin начал `[iis-migration-to-ruvds]` 2026-05-23 (09:37 creds в `.secrets/` plaintext, 18:01 size probe, 18:08 robocopy upal exit 16 «сетевой путь не найден»), drop'нул tree dirty. Восстановлено: creds → `pass show ruvds-iis/full-env`, `.secrets/` removed + gitignored, root-cause SMB-445 closed на fresh Win Server 2025 Core зафиксирован в [`windows-server-2025-core-bootstrap`](../.wiki/concepts/windows-server-2025-core-bootstrap.md), task ⚪ → 🟡 paused с concrete next-step. Previous session (2026-05-22): MSSQL Express 2022 live (`mssql.kzntsv.site:1433`, 5 DBs, 8 prod hosts 200 OK). MinIO/imgproxy VDS stack live as standby (CMS остаётся на windows из-за hardcoded URL в closed-source DLL). board-viewer-vds-deploy ✓ (board.kzntsv.site + basicauth). Portainer-migration sweep: 12 ad-hoc stacks → Portainer-managed.)_
 
 <!--
   Status legend:
@@ -698,13 +698,22 @@ Copy-Item C:\sites\snolla\Web.config.bak-pre-vds-cutover-20260522 C:\sites\snoll
 
 ---
 
-## ⚪ [iis-migration-to-ruvds] — Migrate 11 IIS sites from DESKTOP-NSEF0UK to RUVDS Windows Server 2025 Core
+## 🟡 [iis-migration-to-ruvds] — Migrate 11 IIS sites from DESKTOP-NSEF0UK to RUVDS Windows Server 2025 Core
 
-**Status:** ready
-**Where I stopped:** (not started — awaiting RUVDS installation complete)
-**Next action:** RDP-подключение к RUVDS, verify .NET 4.8 + IIS installed, install URL Rewrite 2.1, plan migration: (1) backup IIS sites+configs from windows-recovery-host, (2) deploy to RUVDS, (3) configure external MSSQL/MinIO connection (already on VDS), (4) DNS swap test on single low-traffic site (kupimknigi.spb.ru).
-**Branch:** n/a
+**Status:** paused
+**Where I stopped:** 2026-05-23 18:08 — failed-robocopy на fresh RUVDS (`exit 16 «сетевой путь не найден»`). Root cause зафиксирован: TCP/445 closed по дефолту на Win Server 2025 Core + SMB share не создан → UNC robocopy не работает без bootstrap RUVDS-стороны. Полный finding + transfer-методов матрица — в [`windows-server-2025-core-bootstrap`](../.wiki/concepts/windows-server-2025-core-bootstrap.md). Source size probe done: `C:\sites\snolla\` = 8.66 GB; 11 sites суммарно может быть 30-50 GB → **possible RUVDS 30 GB HDD capacity blocker** (см. Open questions).
+**Next action:** Decision требуется (user) перед continuing:
+1. **Capacity audit на source:** `Get-ChildItem C:\sites -Directory | %{ [PSCustomObject]@{Name=$_.Name; SizeGB=[math]::Round((Get-ChildItem $_.FullName -Recurse -EA SilentlyContinue | Measure-Object -Property Length -Sum).Sum / 1GB, 2)} } | Sort-Object SizeGB -Descending` — total для 11 sites. Если >25 GB → upgrade RUVDS HDD plan ИЛИ selective transfer (drop logs/cache).
+2. **Transfer-метод confirm:** recommendation = SMB inbound с source-IP whitelist (см. concept). Альтернативы (RDP-redirect / WinRM / SFTP) в concept'е, выбор на user'е.
+3. **RUVDS bootstrap:** RDP, `Install-WindowsFeature Web-Server -IncludeAllSubFeature -IncludeManagementTools`, verify .NET 4.8 (Release ≥ 528040), install URL Rewrite 2.1, open FW 80/443 + SMB-from-source. Полный чеклист — concept §Bootstrap-чеклист.
+4. **Backup source IIS state:** `appcmd list site -config > sites-backup.txt` + `applicationHost.config` copy.
+5. **Transfer + recreate IIS sites + Web.config conn-strings → `mssql.kzntsv.site,1433`** (matches `[mssql-vds-migration]`).
+6. **Pilot kupimknigi.spb.ru через hosts-file → 24h soak → DNS swap.**
+
+Полный план + Decisions log + Open questions — в [iis-migration-to-ruvds.md](iis-migration-to-ruvds.md).
+**Branch:** master
 <!-- created-by: user-decision / 2026-05-22 / trigger: RUVDS purchased -->
+<!-- paused-by: vitya / 2026-05-23 evening / session-recovery после failed-robocopy + secrets-leak fix -->
 
 ---