Make Piggy part of the product rather than a guest in it

Piggy arrived as a chat panel bolted onto a CRM and then grew a workspace
around it. The layout was already right — the audit found the approval card
to be the best-designed object in the repo, and the account page's empty
panels less finished than anything in the workspace. What was wrong was
vocabulary: nobody had written the small things down, so both halves kept
inventing them.

Piggy was drawn with five different marks — a pig in the dock, a sparkle in
the sidebar and again on the model picker, a speech bubble on the Ask
buttons, and a stock robot glyph on every assistant message, which is the
one people look at most. There is now one mark. The composer, which is the
first control in the product since sign-in lands on /piggy, was the only
un-adapted shadcn field left: 6px radius against a 12px Send button it sat
8px from. A stat tile had been reinvented six times at three numeral scales,
and the same uppercase micro-label existed in five variants, two of them one
tab apart in the same rail. There were 63 hand-written font sizes: not a
scale, sixty-three opinions.

Underneath that, the focus ring was invisible. The global rule used
ring-accent, which Tailwind deliberately aliases onto the hover tint, so the
ring measured 1.01:1 against the light canvas — no visible focus indicator
anywhere in the product, for any accent, in either theme. It is ring-brand
now and measures 17:1. The warning, positive and info tones were darkened
until each clears 4.5:1 on a card, on inset and on its own chip, and the
light canvas moved to 98% so a card lifts without leaning on its shadow.

The mobile work is the part worth reading. A landscape phone gave the
transcript 28% of the viewport and a keyboard-up phone 16%, against a 45%
floor — and the fixed tab bar painted over the composer, covering the safety
sentence and half the Send button, because two source comments asserted the
bar stood down on short viewports and it never had. Both fixed and measured
by hit-testing rather than by screenshot. The composer itself was 64px tall
for a blank second line nobody typed, because the auto-resize effect sizes
to scrollHeight and scrollHeight counts rows — a CSS height could not win
against an inline style, so the attribute was the honest lever.

Verified across both themes driven through the app's own control: no
horizontal overflow on 15 routes at four viewports, 672 stat values that fit,
297 labels at exactly 11px/500, Escape returning focus to its opener rather
than the body on every overlay, and a rejected write no longer reporting
"Succeeded" with a green check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/piggy/test/config.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { loadPiggyConfig, loadPiggyTurnLimits } from '../src/config';
+import { loadPiggyConfig, loadPiggyStallLimits, loadPiggyTurnLimits } from '../src/config';
 
 const minimum = {
   DATABASE_URL: 'postgres://pig:pig@localhost:54330/pig',
@@ -65,6 +65,43 @@ test('the ceilings can be read without the rest of the environment', () => {
   );
 });
 
+test('a turn has two deadlines for silence, and they are not one flat deadline', () => {
+  const config = loadPiggyConfig(minimum);
+  assert.equal(config.PIGGY_CHAT_FIRST_PROGRESS_TIMEOUT_MS, 60_000);
+  assert.equal(config.PIGGY_CHAT_IDLE_TIMEOUT_MS, 45_000);
+  // Read on their own too: the chat server is handed a socket and a token.
+  assert.deepEqual(loadPiggyStallLimits({}), { firstProgressMs: 60_000, idleMs: 45_000 });
+  assert.deepEqual(
+    loadPiggyStallLimits({
+      PIGGY_CHAT_FIRST_PROGRESS_TIMEOUT_MS: '1500',
+      PIGGY_CHAT_IDLE_TIMEOUT_MS: '900',
+    }),
+    { firstProgressMs: 1_500, idleMs: 900 },
+  );
+
+  // The idle window is the shorter of the two on purpose. Getting started
+  // covers connecting, the endpoint's queue and a slow model's first token;
+  // once a turn is under way the gaps are milliseconds, so a long silence
+  // mid-answer is a dead socket rather than a thoughtful one. Neither bounds
+  // the turn's total duration, which is the whole design: the idle clock
+  // restarts on every event.
+  assert.ok(
+    loadPiggyStallLimits({}).idleMs < loadPiggyStallLimits({}).firstProgressMs,
+    'the idle window should not need to be as generous as getting started',
+  );
+
+  // A deadline of zero would stall every turn before it began, so it is a
+  // configuration error rather than a very impatient deployment.
+  assert.throws(
+    () => loadPiggyStallLimits({ PIGGY_CHAT_IDLE_TIMEOUT_MS: '0' }),
+    /PIGGY_CHAT_IDLE_TIMEOUT_MS/,
+  );
+  assert.throws(
+    () => loadPiggyStallLimits({ PIGGY_CHAT_FIRST_PROGRESS_TIMEOUT_MS: 'patience' }),
+    /PIGGY_CHAT_FIRST_PROGRESS_TIMEOUT_MS/,
+  );
+});
+
 test('reasoning stays off by default', () => {
   // Reasoning tokens are billed like any other and nemotron-nano's are
   // verbose. The knob exists for debugging, not for the default deployment.