diff --git a/evidence/vps-baseline-20260515.md b/evidence/vps-baseline-20260515.md
new file mode 100644
index 0000000..a21c2b1
--- /dev/null
+++ b/evidence/vps-baseline-20260515.md
@@ -0,0 +1,140 @@
+# VPS Baseline Discovery - 2026-05-15
+
+Owner: VPS_EXECUTOR
+Task: T4-VPS-baseline
+Mode: read-only discovery
+
+## Safety Confirmation
+
+- No service restart, reload, approval, token rotation, image change, bind mount change, Nginx route edit, or Docker compose edit was performed.
+- No secret file contents were read or captured. In particular, `.env.openclaw` and private key/certificate contents were not read.
+- The frozen `smartmotor.cloud` website content, static assets, Nginx routing files, bind mounts, images, and service state were not modified.
+
+## Control Plane Repository
+
+- Workspace: `/home/ubuntu/openclaw-control-plane`
+- Branch: `main`
+- Git status at collection time: `## main...origin/main`
+- Last commit: `9e05c877f9cc19270f2a42c9a36399065c56854b` (`Sync agent state from PC at 2026-05-15 11:32:38`)
+- No local repo modifications were present before evidence/handoff/task updates.
+
+## Host and Service Workspace
+
+- Hostname: `VM-0-13-ubuntu`
+- Kernel: `Linux 6.8.0-49-generic x86_64`
+- Timestamp: `2026-05-15T03:41:43Z`
+- `/opt/service`: not present.
+- `/opt/services`: present and used as the service workspace.
+- `/opt/services/docker-composite.yml`: not present.
+- OpenClaw compose file present: `/opt/services/docker-compose.openclaw.yml`
+
+## Docker Stack
+
+Docker versions:
+
+- Docker Engine: `27.5.1`
+- Docker Compose: `v2.32.4`
+
+Running containers:
+
+| Container | Image | Status | Ports / Exposure |
+|---|---|---|---|
+| `openclaw-gateway` | `ghcr.io/openclaw/openclaw:latest` | Up 5 days, healthy | No host port published |
+| `nginx-proxy` | `nginx:alpine` | Up 6 days | Host `80` and `443` published |
+| `gitea` | `gitea/gitea:latest` | Up 6 days | Container `3000`, host `2222->22` |
+| `confluence` | `atlassian/confluence-server:latest` | Up 6 days | Container `8090-8091` |
+| `postgres_conf` | `postgres:14` | Up 6 days, healthy | Container `5432` |
+
+Container inspect summary:
+
+- `openclaw-gateway`: `status=running`, `health=healthy`, network `services_appnet`
+- `nginx-proxy`: `status=running`, `health=none`, network `services_appnet`
+- `gitea`: `status=running`, `health=none`, network `services_appnet`
+- `confluence`: `status=running`, `health=none`, network `services_appnet`
+- `postgres_conf`: `status=running`, `health=healthy`, network `services_appnet`
+
+Network members on `services_appnet`:
+
+- `postgres_conf`: `172.19.0.2/16`
+- `gitea`: `172.19.0.3/16`
+- `confluence`: `172.19.0.4/16`
+- `nginx-proxy`: `172.19.0.5/16`
+- `openclaw-gateway`: `172.19.0.6/16`
+
+## OpenClaw Gateway
+
+Compose summary from `/opt/services/docker-compose.openclaw.yml`:
+
+- Service: `openclaw-gateway`
+- Image: `ghcr.io/openclaw/openclaw:latest`
+- Command: `node openclaw.mjs gateway --bind lan --port 18789`
+- Config bind mount: `/opt/services/openclaw-config -> /home/node/.openclaw`
+- Workspace bind mount: `/opt/services/openclaw-workspace -> /home/node/.openclaw/workspace`
+- Network: external `services_appnet`
+- Healthcheck probes `http://127.0.0.1:18789/healthz`
+
+Gateway local health probe from inside the container:
+
+- `http://127.0.0.1:18789/healthz`
+- Result: `status=200`
+- Body summary: `{"ok":true,"status":"live"}`
+
+## Nginx and Routes
+
+Nginx container summary:
+
+- Container: `nginx-proxy`
+- Image: `nginx:alpine`
+- Entrypoint: `/docker-entrypoint.sh`
+- Command: `nginx -g 'daemon off;'`
+- Published ports: host `80` and `443`
+- Bind mounts:
+  - `/opt/services/nginx/conf.d -> /etc/nginx/conf.d`
+  - `/opt/services/nginx/ssl -> /etc/nginx/ssl`
+  - `/opt/services/nginx/html -> /usr/share/nginx/html`
+
+Route/config observations:
+
+- `/opt/services/nginx/conf.d` was empty at collection time.
+- `nginx -T` inside the container produced no `server_name` or `proxy_pass` lines for `openclaw.smartmotor.cloud`.
+- Public and local TLS endpoint checks still returned:
+  - `smartmotor.cloud`: `200`
+  - `git.smartmotor.cloud`: `200`
+  - `wiki.smartmotor.cloud`: `302` to login
+  - `openclaw.smartmotor.cloud`: `200`
+
+This is a baseline observation only. No route file was modified and no reload was performed.
+
+## Gitea, Confluence, and Postgres
+
+High-level status:
+
+- `gitea`: container running on `services_appnet`, container port `3000`, host SSH port `2222`.
+- `confluence`: container running on `services_appnet`, container ports `8090-8091`.
+- `postgres_conf`: container running and healthy on `services_appnet`, container port `5432`.
+- HTTPS availability checks:
+  - `https://git.smartmotor.cloud/`: `200`
+  - `https://wiki.smartmotor.cloud/`: `302` to login
+
+## OpenClaw CLI / Approval Commands
+
+Host PATH:
+
+- `openclaw`: not found on the VPS host PATH.
+
+Gateway container:
+
+- CLI available by running `node openclaw.mjs` inside `openclaw-gateway`.
+- Version banner: `OpenClaw 2026.5.7 (unknown)`.
+- Command help confirmed available for:
+  - `openclaw devices approve [options] [requestId]`
+  - `openclaw nodes pending [options]`
+  - `openclaw nodes approve [options] <requestId>`
+
+Only `--help` was executed. No pending request was listed, no request was approved, and no token/password option was supplied.
+
+## Notes for VPS_VERIFIER
+
+- Verify the apparent Nginx route/config drift: endpoints respond, but the mounted `/etc/nginx/conf.d` is empty and `nginx -T` did not show server blocks or proxy routes.
+- Verify whether `/opt/services/docker-composite.yml` is expected to exist; the baseline found `/opt/services/docker-compose.openclaw.yml` instead.
+- Verify that absence of host PATH `openclaw` is acceptable because the CLI is available inside the Gateway container.
diff --git a/handoff/VPS_EXECUTOR.md b/handoff/VPS_EXECUTOR.md
index 7c11f13..304e121 100644
--- a/handoff/VPS_EXECUTOR.md
+++ b/handoff/VPS_EXECUTOR.md
@@ -38,4 +38,16 @@ After the Gitea control plane is synchronized, collect current VPS baseline evid
 
 ## Last Update
 
-Template created during control-plane bootstrap.
+2026-05-15 VPS baseline discovery completed for T4.
+
+- Evidence written to `evidence/vps-baseline-20260515.md`.
+- Discovery was read-only: no restart, reload, approval, token rotation, config edit, route edit, image change, bind mount change, or website content change was performed.
+- `/opt/service` was not present; `/opt/services` is the active service workspace.
+- `/opt/services/docker-composite.yml` was not present; `/opt/services/docker-compose.openclaw.yml` exists for OpenClaw Gateway.
+- `openclaw-gateway` container is running and healthy; local `/healthz` returned `200` with live status.
+- Docker stack high-level status: `nginx-proxy`, `gitea`, `confluence`, `postgres_conf`, and `openclaw-gateway` are running; `postgres_conf` and `openclaw-gateway` report healthy.
+- Host PATH does not include `openclaw`; the Gateway container CLI is available via `node openclaw.mjs`.
+- `devices approve`, `nodes pending`, and `nodes approve` help commands are available in the Gateway container. No approval command was executed beyond `--help`.
+- Baseline note for VPS_VERIFIER: HTTPS endpoints respond, but `/opt/services/nginx/conf.d` is empty and `nginx -T` did not show `server_name` or `proxy_pass` route lines. Please verify whether this reflects expected Nginx state or route/config drift.
+
+Waiting for VPS_VERIFIER review. VPS_EXECUTOR did not self-accept the work.
diff --git a/tasks/T4-VPS-baseline.md b/tasks/T4-VPS-baseline.md
index a6e3539..56cd232 100644
--- a/tasks/T4-VPS-baseline.md
+++ b/tasks/T4-VPS-baseline.md
@@ -2,7 +2,7 @@
 
 ## Status
 
-ready
+done
 
 ## Owner
 
@@ -44,3 +44,10 @@ This task is read-only only. The `smartmotor.cloud` website freeze is a hard con
 ## Acceptance
 
 VPS_VERIFIER must review the evidence before this task is accepted.
+
+## Completion Notes
+
+- VPS_EXECUTOR completed read-only baseline discovery on 2026-05-15.
+- Evidence: `evidence/vps-baseline-20260515.md`.
+- Handoff updated: `handoff/VPS_EXECUTOR.md`.
+- This task is marked `done` for executor completion only; acceptance remains pending VPS_VERIFIER review.