Record phase 6 sync results and the updated deploy steps in the plan

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plan.md

@@ -288,7 +288,10 @@ the fork, so do it first.
    step 7); the server's `.gitmodules` points at it over SSH.
 3. Bring this repo's flake up to date (it's still on `nixos-25.05`) only if the
    exporter gets packaged here.
-4. Ask the user to add a sops secret `plebleader.env` for incineroar, holding
+4. **Done 2026-11-09** (`systems/brenise.dev/incineroar/plebleader.env` in
+   nix-pleb, dotenv format, encrypted from this repo's `.env` without
+   decrypting anything; wired up on the `plebleader` branch).
+   Ask the user to add a sops secret `plebleader.env` for incineroar, holding
    `BL_CLIENT_ID` and `BL_CLIENT_SECRET`. These are the same OAuth app as
    plebsaber.stream; check that its registered callback URLs include the one
    used for seeding. Agents never decrypt it.
@@ -800,6 +803,34 @@ the BL score, and confirm the improvement display and the ArcViewer replay.
 
 ### Phase 6: Ongoing sync
 
+**Built 2026-11-09, not deployed yet.** `node scripts/archive/cli.ts sync
+[--ratings] [--no-ss-replays]` (this repo `d182fd8`), packaged as the
+flake's `plebleader-archive`. Tested against the local archive: the token
+refresh rotated the chain (now valid until about 2026-11-23), and with the
+newest BL and SS score files set aside, the run fetched exactly those two
+back, byte-identical, and re-snapshotted the BL leaderboard. What differs
+from the steps below:
+
+- Main account only; both legacy accounts are frozen. The incremental
+  window starts a day before the newest archived score (BL `timepost`, SS
+  `timeSet`), computed from the archive rather than `state.json`. Replays and
+  score stats are retried for every score in the window, not only new ones.
+- New BL hashes get a refreshed leaderboard snapshot; new SS-only hashes get
+  one if they have none. Map zips cover every hash in the window.
+- Ratings drift: Sundays by the machine's clock, or `--ratings`.
+- Each run writes a `sync` section to `state.json` (new score ids, maps
+  without a zip). `exportScores` no longer resets `newestTimepost` to 0 on an
+  empty window.
+- Step 8: the importer runs in full after every sync (about 10 s), as a
+  second `ExecStart` of `plebleader-sync`; no `--since` flag.
+- **Importer fix** (server `dd94772`): the archive keeps an old best after
+  its improvement is synced. The importer now takes only the newest score
+  per leaderboard and removes rows superseded since the last import. Before
+  this, the second score would have broken the
+  `(PlayerId, LeaderboardId, ValidContexts)` unique index. Tested on a
+  scratch copy with a fake improved score: added, old one removed, and back
+  again once the fake was deleted.
+
 The `sync` subcommand runs once a day from a systemd timer on incineroar:
 `OnCalendar=*-*-* 17:00:00 America/Los_Angeles` with `Persistent=true`, so a
 run missed while the machine was off happens at the next boot. By 5 pm the
@@ -840,7 +871,13 @@ the local zip.
 
 ### Phase 7: NixOS deployment on incineroar
 
-**Built 2026-11-09, not switched yet.** nix-pleb branch `plebleader`
+**Built 2026-11-09, not switched yet.** Phase 6 added a second commit on the
+branch: the `plebleader.env` sops secret, `plebleader-sync` (sync, then the
+importer) and its timer, and lock bumps for `plebsaber-stream` (`d182fd8`)
+and `plebleader-server` (`dd94772`). The `plebsaber-stream` bump also
+rebuilds beldum's site, with no change to the site code.
+
+nix-pleb branch `plebleader`
 (`2ada4b7`, in the worktree `~/ops/nix-pleb-plebleader`, based on `main`
 `981f9e7`) adds the inputs `plebleader-server` (server `0481759`) and
 `plebleader-website` (`8d540642`), both following `nixpkgs-unstable`, plus to
@@ -879,11 +916,19 @@ To deploy (the user does this):
    this is a copy):
    `doas cp -a ~/ops/beatsaber/plebsaber.stream/.data/plebleader/archive /var/lib/plebleader/`,
    then `doas chown -R plebleader:plebleader /var/lib/plebleader/archive` and
-   `doas chmod -R g+rX,o-rwx /var/lib/plebleader/archive`. Keep the token chain
-   (`.data/plebleader/auth`) where it is until phase 6 moves the sync.
-3. `doas systemctl start plebleader-import`, then open
-   `https://incineroar.brenise.dev:4442/u/pleb` and a replay.
-4. Afterwards, remove the worktree with `git worktree remove ../nix-pleb-plebleader`.
+   `doas chmod -R g+rX,o-rwx /var/lib/plebleader/archive`.
+3. Move the sync's token chain. **Before 2026-11-23**, or it expires and
+   needs `auth login` again:
+   `doas install -d -o plebleader -g plebleader -m 0700 /var/lib/plebleader/auth`
+   and
+   `doas install -o plebleader -g plebleader -m 0600 ~/ops/beatsaber/plebsaber.stream/.data/plebleader/auth/beatleader_tokens.json /var/lib/plebleader/auth/`,
+   then delete the local copy. From then on, never run `sync` or
+   `auth refresh` locally: the refresh token rotates, and whichever side
+   refreshes second breaks.
+4. `doas systemctl start plebleader-sync` (sync, then import), then open
+   `https://incineroar.brenise.dev:4442/u/pleb` and a replay. Check
+   `journalctl -u plebleader-sync` and `systemctl list-timers plebleader-sync`.
+5. Afterwards, remove the worktree with `git worktree remove ../nix-pleb-plebleader`.
 
 - Packages: `buildDotnetModule` for the fork (generate `deps.json` with
   `nix build .#…passthru.fetch-deps`), `buildNpmPackage` for the website (start