Document current state and roadmap

- AGENTS.md: add Current state section; record Gitea origin; scrub the
  dev password example to a placeholder and the deploy host to a config
  reference.
- Add ROADMAP.md for longer-term backlog and deferred decisions.

AGENTS.md

@@ -12,9 +12,9 @@ Kid-friendly soccer training tracker PWA for one player ("Gunner"), packaged as
 
 Run from repo root unless noted.
 
-- **Run (dev)**: `npm run dev` (node --watch) or `npm start` — listens on `PG_PORT` (default 3000). Local: `PG_PORT=3344 PG_PASSWORD=gunner npm start`. Default dev password is `gunner` (logs a warning).
+- **Run (dev)**: `npm run dev` (node --watch) or `npm start` — listens on `PG_PORT` (default 3000). Local: `PG_PORT=3344 PG_PASSWORD=<dev-password> npm start`. If `PG_PASSWORD` is unset, the app uses a built-in dev fallback and logs a warning — set it explicitly.
 - **Seed defaults**: `npm run seed` (only seeds an empty DB).
-- **Tests**: none configured — TODO. Verify manually: boot against a temp DB and hit the API, e.g. `PG_DATA_DIR=/tmp/pg PG_PORT=3399 PG_PASSWORD=gunner node src/server.js` then `curl`/login. No single-test runner — TODO.
+- **Tests**: none configured — TODO. Verify manually: boot against a temp DB and hit the API, e.g. `PG_DATA_DIR=/tmp/pg PG_PORT=3399 PG_PASSWORD=<dev-password> node src/server.js` then `curl`/login. No single-test runner — TODO.
 - **Lint (root)**: none configured — TODO.
 - **Typecheck + format (s9pk)**: `cd s9pk && npm run check` (tsc --noEmit) and `npm run prettier`.
 - **Build .s9pk**: `cd s9pk && npm ci && make` (vendors the app, builds the image, packs `premier-gunner_x86_64.s9pk`).
@@ -40,7 +40,7 @@ Run from repo root unless noted.
 ## Conventions
 
 - Commits: imperative subject; body only when the "why" isn't obvious; **author is the user, no AI attribution**. No `Co-Authored-By`/"Generated with" trailers.
-- Remote: self-hosted **Gitea**, not GitHub — do not add a GitHub remote. (Repo currently has **no remote**; branch is `master`.)
+- Remote: self-hosted **Gitea**, not GitHub — `origin` is configured in `.git/config` (an SSH URL; keep it out of tracked files). Do not add a GitHub remote. Branch is `master`; push after committing.
 - Match existing file conventions; small reviewable diffs; comments explain *why*.
 - Verify browser-observable changes before shipping (run it, check no console errors).
 
@@ -65,3 +65,13 @@ Run from repo root unless noted.
 - `start-cli` (and `make install`) needs a git repo with at least one commit — it stamps the build with the git hash.
 - `make install` picks the newest `*.s9pk` by mtime; with x86-only there's just one.
 - Migrations key off a flag row in the `settings` table (e.g. `migr_records_scores`); pick a new flag name per migration.
+
+## Current state
+
+Live on StartOS (deploy host set in `~/.startos/config.yaml` `host:`, not in this repo) at **v0.1.6:0**; `make install` deploys and the PWA self-updates via the in-app banner. Pushed to self-hosted Gitea (`origin`).
+
+- **Working**: daily logging, weekly planning, goals + thermometer, dashboard (streak calendar, radar, line/series charts, records), personal-best records (auto + manual set), per-session notes, EPA Max/Weighted Speed, tap-to-type number fields, full category/metric management in Settings, "Set Login Password" action.
+- **In progress**: none — all requested features are built, committed, and deployed.
+- **Decided, not yet done**: reconcile in-app password change with the StartOS action (env wins on restart); optional "log another" for a second same-category session in a day. See `ROADMAP.md`.
+- **Known issues**: changing the password from the app's own Settings reverts on restart under StartOS — use the action.
+- **Next steps**: (1) set a real login password via the "Set Login Password" action; (2) confirm speed unit (`mph` vs `km/h`); (3) decide whether to add a "log another" same-category session.

ROADMAP.md

@@ -0,0 +1,26 @@
+# ROADMAP
+
+Longer-term backlog and deferred decisions. Near-term status lives in `AGENTS.md` → Current state; package-specific follow-ups live in `s9pk/TODO.md`.
+
+## Phase 3 — AI coach (deferred, not started)
+
+- Integrate the DGX Spark LLM box (Qwen3.6 35B, OpenAI-compatible endpoint) as a training coach.
+- Login-time training suggestions based on recent activity and goals.
+- Per-category drill ideas on demand.
+- Config via env-var names (endpoint URL, model); no keys in the repo.
+
+## Product backlog
+
+- **"Log another"**: allow multiple sessions of the same category in one day (the category pill currently edits the existing entry instead of creating a second).
+- **Speed units**: option for `km/h` in addition to `mph`.
+- **Per-metric direction**: expose a "higher is better / lower is better" toggle in the Settings metric editor (today it is set only via seed/migration; needed for new lower-is-better metrics like time or strokes).
+
+## Platform / packaging
+
+- **Password UX under StartOS**: make the in-app Settings password change agree with the "Set Login Password" action — hide the in-app field on StartOS, or write changes through to `store.json`.
+- **Packaging hygiene**: the vendored `s9pk/app/` is gitignored, so the package `gitHash` does not reflect app-source changes; revisit before publishing to a registry.
+- **Other arches**: build aarch64/riscv64 only if a target host needs them (currently x86_64-only).
+
+## Ops
+
+- `origin` is configured on self-hosted Gitea (SSH, in `.git/config`); push after committing.