Update Current state: 1.2.0:4 built + sideloaded (avg. watts first-class field)

AGENTS.md

@@ -105,11 +105,11 @@ Canonical publish path for this project: `~/.proof-of-work/publish.sh` (builds,
 
 ## Current state
 
-Latest version is **1.2.0:3** — **P3 hardening**: closes the login timing oracle (`verifyPasswordOrDummy` — unknown email now spends one bcrypt too) and enforces `exerciseId` ownership on all workout-write routes + both program routes via the shared `lib/exerciseOwnership.ts` (see Conventions). **Built + sideloaded** to the StartOS box (`immense-voyage.local`, 2026-06-15, on `master`) as `proof-of-work_x86_64.s9pk` (80M, git `f540a47`). Verified before build: tsc clean (app + packaging), lint clean (only pre-existing warnings), **221 tests pass**, `next build` succeeds. Registry empty, **publishing parked** (sideload-only via `make install`).
+Latest version is **1.2.0:4** — **avg. watts is now a first-class set field**: promotes average watts (assault bike / rower / ski erg) from a free-text `customMetrics` JSON entry to a real nullable `SetLog.watts` column, written through every set path (create / PATCH / add-sets / import-save / account-import) and shown everywhere as "Avg. watts" with a numeric input. This is the **first schema change in the 1.2.0 line**: the column is added by the boot-time additive `ALTER` in `docker_entrypoint.sh` (guarded, idempotent); legacy watts in `customMetrics` stays readable and migrates to the column on next save (no data migration). Internal token/column is `watts` (matches the existing assault-bike `inputFields` token + legacy `customMetrics` key → zero exercise migration); only ever *displayed* as "Avg. watts". **Built + sideloaded** to the StartOS box (`immense-voyage.local`, 2026-06-16, on `master`) as `proof-of-work_x86_64.s9pk` (80M, git `390aaf5`). Verified before build: tsc clean (app + packaging), lint clean (only pre-existing warnings), **223 tests pass**, `next build` succeeds. Registry empty, **publishing parked** (sideload-only via `make install`).
 
-Also shipped this session: **1.2.0:2** — iOS Safari login/signup first-tap retry (`lib/retryAction.ts`; see Conventions). Prior: **1.2.0:1** — Next 15 / React 19 upgrade. No schema/data change in any of the three.
+Recent prior ships (1.2.0 line): **1.2.0:3** — P3 hardening (login timing oracle + `exerciseId` ownership). **1.2.0:2** — iOS Safari login/signup first-tap retry (`lib/retryAction.ts`). **1.2.0:1** — Next 15 / React 19 upgrade. (1.2.0:1–3 had no schema/data change.)
 
-**Pending on-box check (one pass covers all):** confirm 1.2.0:3 boots clean in StartOS → Logs (entrypoint logs `launching … as nextjs`, app writes `/data` as uid 1001, no permission errors — also clears the long-standing 1.1.0:9 non-root check), **and** the Safari first-tap proof from 1.2.0:2 — log in from Safari on iPhone/iPad and confirm the *first* Sign In tap works. If it still occasionally fails, grab the Web Inspector error (iPad→Mac): `-1005` confirms the retry is right; anything else points at a proxy↔container keep-alive mismatch.
+**Pending on-box check:** confirm 1.2.0:4 boots clean in StartOS → Logs — on the existing-data upgrade path the entrypoint logs `adding missing column SetLog.watts` (one-shot; no-op thereafter), no permission errors — and that logging an Assault Bike set with Avg. watts saves and displays as `157 W`. Still also pending from earlier ships: the 1.2.0:3 non-root boot (entrypoint logs `launching … as nextjs`, app writes `/data` as uid 1001 — also clears the long-standing 1.1.0:9 non-root check), **and** the 1.2.0:2 Safari first-tap proof (log in from Safari on iPhone/iPad; first Sign In tap works — `-1005` in Web Inspector confirms the retry path, anything else points at a proxy↔container keep-alive mismatch).
 
 Working: workout logging, programs (manual + AI), multi-user, curated library, full AI subsystem (5 providers, multi-config, background generation, history detail, cost/duration, Ollama auto-detect, infinite-scroll exercise history).