docs: P4 deployed — stack live under podman-stack-bike-tinder.service, nightly import+read+backup armed, in-container requests fix, sidecar pending one-time tailnet auth

docs/PLAN.md

@@ -63,11 +63,14 @@ Glenn's approved design (2026-11-10):
 
 **Status: BUILT → VERIFIED → LIVE (2026-11-11).** Rail: hunt gallery capture + full-catalog backfill — 639/640 state items carry `imgs[]` (612 with 2+ photos); the 1 remainder is a photo-less ad at source ("no photo found", retried and confirmed) → app shows the placeholder, by design. App: Torres on a fresh clone (`~/dev/bike-tinder-b1-build`, commits `3b64635..036a511`, report `~/dev/bike-tinder-b1/TORRES-B1-REPORT.md`); live tree + live DB untouched during the build. Verification: selfcheck 31/31 both sides; `fe_walk_b1` headless §11 walk 390/390 (Alex re-ran green with a fresh setup). **Live integration (2026-11-11, ~00:40 AST):** pre-B1 backups `~/dev/bike-tinder-b1/preb1-live-*.sqlite3` + `preb1-files/`; 11 files deployed; service restarted; `POST /api/import` idempotent (`new:0`); live DB now 639/640 with galleries, 612 multi-photo (sample id 430 Indian Sport Scout n=8; `/img/430?i=1` → 302). Live gesture proof: side-tap flip `?i=0 ↔ ?i=1`, center-tap viewer with segments, screenshot `~/dev/bike-tinder-b1/b1-live-9453.png`. Glenn's ledger intact (248 swipes / 279 events carried). `dev` + `main` merged (`49466fb`); live tree commit `3a399e1`.
 
-## Phase 4 — Deploy + automate
+## Phase 4 — Deploy + automate (stack deployed 2026-11-12; phone check pending)
 
-- Podman compose stack at `/var/mnt/DATA/podman-stacks/bike-tinder/` + systemd unit (`Delegate=yes`) + in-stack Tailscale sidecar serving `https://biketinder.tailf35a34.ts.net`; PWA install on Glenn's phone
-- Enable the new `bike-tinder-import` Hermes cron (08:30 daily, post-hunt; script-only, zero LLM; parked until deploy); DB backup routine
-- Runbook in DESIGN.md; announce + handover note
+- ✅ Podman compose stack at `/var/mnt/DATA/podman-stacks/bike-tinder/` (release checkout) + systemd unit `podman-stack-bike-tinder.service` (`Delegate=yes`; verified to survive gateway/desktop restarts and re-raise after `systemctl --user restart`) + in-stack Tailscale sidecar (userspace mode) targeting `https://biketinder.tailf35a34.ts.net` — **awaiting Glenn's one-time tailnet authorization**
+- ✅ `bike-tinder-import` Hermes cron live (08:30 daily, post-hunt): import → live agent read → sqlite backup (14-deep); silent on success (three clean live runs on deploy day)
+- ✅ DB + image mirror migrated intact into the stack volume; backup drill produced its first files
+- ✅ Deploy fix (found on first in-container agent call): `requests` was missing from requirements — the host venv had it incidentally, the slim image did not
+- ✅ Runbook in DESIGN.md (deploy/rollback/logs/import gates/backup-restore/phone checklist)
+- ⏳ PWA install + first phone swipe (after sidecar auth); full reboot test
 - **Exit criteria:** survives a reboot; refreshes overnight unattended; installable and used from the phone.
 
 ## Non-goals (v1)