Rebuild Piggy's interface, and give the demo book a business to describe

Piggy answered in raw markdown, threw away every tool result it streamed,
and fought the reader's scroll on every token. The three surfaces that
made it worth having — what it read, how it reasoned, what it cost — were
all on the wire and none of them reached the screen.

The transcript is now composed of five parts under components/piggy:
answers render through streamdown, the container sticks to the bottom
without pinning the reader there, tool steps say what they read and link
to the record, and each turn carries its model and token count. Three
lifecycle bugs went with them: Stop left a permanent spinner, a truncated
stream was indistinguishable from thinking, and a failed send destroyed
the message it failed to send.

Underneath, the inference path grew timeouts, jittered retries on 429 and
5xx, tolerance of the malformed frames a 30B model emits, and an
agent_runs row per turn so chat spend is observable. The system prompt now
states that a field ending in Cents is cents — without it nemotron renders
costPerGpuHourCents: 189 as "$189 per GPU-hour", which is a 100x error on
the most scrutinised number in the room.

The demo book was arithmetically incoherent: every deal's value
contradicted its own allocation revenue by up to 3.6x, nothing had ever
closed, no customer had any paper, and the marketplace was empty. Deal
value is now derived from the allocation, the book clears 5.3% across five
blocks with one deliberately underwater, and the renewal, compliance and
agent-provenance machinery finally has rows to act on. A --clear that
deleted every obligation, SLA term and capacity request in the database
regardless of origin is scoped to the demo's own ids.

Around that: accounts have a detail page, ⌘K searches the book, Settings
can mint the API keys it always claimed to, and deploy.sh actually ships
the agent instead of silently skipping its compose profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -246,6 +246,10 @@ before you can attach to it. Full deployment notes, including the reverse
 proxy, the release poller and rollback semantics, are in
 [`deploy/README.md`](./deploy/README.md).
 
+That starts the CRM without the agent, which is the default. Turning Piggy on is
+a switch in `.env` and a run of `scripts/deploy.sh` — see
+[Turning Piggy on](./deploy/README.md#turning-piggy-on).
+
 ### Every environment variable
 
 Read from `apps/api/src/lib/config.ts` (API), `apps/piggy/src/config.ts`
@@ -297,16 +301,26 @@ In production you must additionally set **either** `SUPABASE_URL` **or**
 
 The API and the Piggy container read overlapping but distinct sets.
 
+**Every one of these is read once, at boot.** None of Piggy's settings is
+admin-selectable at runtime: `apps/piggy` reads `process.env` when the process
+starts and never consults `platform_settings`, so changing the model or a budget
+means editing `.env` and restarting the container.
+
 | Variable | Default | Read by | Notes |
 |---|---|---|---|
-| `PIGGY_ENABLED` | `false` | API | Gates the chat surface |
-| **`PIGGY_INFERENCE_API_KEY`** | — | Piggy | Required by the Piggy process. The model credential never reaches the API container |
+| `PIGGY_ENABLED` | `false` | API, `deploy.sh` | Gates the chat surface, and tells `scripts/deploy.sh` to ship the `piggy` Compose profile with the app |
+| **`PIGGY_INFERENCE_API_KEY`** | — | Piggy | Required by the Piggy process. Missing, it exits at boot and crash-loops. The model credential never reaches the API container |
 | `PIGGY_INFERENCE_BASE` | `https://api.pinference.ai/api/v1` | both | OpenAI-compatible |
-| `PIGGY_MODEL` | `nvidia/nemotron-3-nano-30b-a3b` | both | Admin-selectable at runtime too |
+| `PIGGY_MODEL` | `nvidia/nemotron-3-nano-30b-a3b` | both | The API reads it to display; Piggy reads it to call |
 | `PIGGY_LEASE_SECONDS` | `300` | both | Queue lease duration |
-| `PIGGY_POLL_INTERVAL_MS` | `2000` | Piggy | |
-| `PIGGY_MAX_TOKENS` | `1024` | Piggy | |
-| `PIGGY_WORKER_ID` | `hostname:pid` | Piggy | |
+| `PIGGY_POLL_INTERVAL_MS` | `2000` | Piggy | How often an idle worker looks for a task |
+| `PIGGY_MAX_TOKENS` | `1024` | Piggy | Per queued task |
+| `PIGGY_CHAT_MAX_TOKENS` | `2048` | Piggy | Per interactive answer. Separate from the queue's budget because chat tools return aggregates the answer has to quote, and 1024 truncated mid-table |
+| `PIGGY_MAX_TURNS` | `4` | Piggy | Model calls per chat turn, tool round trips included |
+| `PIGGY_REASONING_EFFORT` | `none` | Piggy | `none`, `low`, `medium`, `high`. Reasoning tokens bill like any other and the chat panel is on every page; raise it to debug, not in normal operation |
+| `PIGGY_PRICE_INPUT_CENTS_PER_MTOK` | `5` | Piggy | Cents per million tokens, which keeps the recorded cost of a run exact in integers. Must be changed with the model — a stale price still looks like a measurement |
+| `PIGGY_PRICE_OUTPUT_CENTS_PER_MTOK` | `20` | Piggy | As above |
+| `PIGGY_WORKER_ID` | `hostname:pid` | Piggy | Lease identity. Only set it if you run two workers |
 | `PIGGY_INTERNAL_URL` | unset | API | `http://piggy:8931` under Compose |
 | **`PIGGY_INTERNAL_TOKEN`** | — | both | Min 32 chars; required by the Piggy process. Never put it in a query string |
 | `PIGGY_CHAT_HOST` | `127.0.0.1` | Piggy | |
@@ -440,18 +454,28 @@ degraded view of the other. There are two distinct surfaces.
   with a shared internal bearer token. Chat is **read-only**: seven tools
   (`pig_get_record`, `pig_get_account_lifecycle` and five page-scoped
   summaries), each of which aggregates first and returns at most a handful of
-  exemplar rows, because interactive chat runs at 1024 max tokens across at
+  exemplar rows, because interactive chat runs at 2048 max tokens across at
   most four turns. Ambient coding tools are rejected before inference by an
   explicit boundary check.
 
 Piggy is off by default. `PIGGY_ENABLED` defaults to `false` and the Compose
 service sits behind `profiles: ['piggy']`, so a default `docker compose up`
-starts the CRM without it:
+starts the CRM without it. Turning it on is three values in `.env` —
+`PIGGY_ENABLED=true`, `PIGGY_INFERENCE_API_KEY` and a 32-character
+`PIGGY_INTERNAL_TOKEN` — and then a deploy:
 
 ```bash
-docker compose -p pig --profile piggy up -d --build
+bash scripts/deploy.sh
 ```
 
+`deploy.sh` reads `PIGGY_ENABLED` itself and adds the profile to the pull, the
+build, the `up` and the rollback, so the agent is upgraded with the app and
+never left behind on an older image. Starting it by hand
+(`docker compose -p pig --profile piggy up -d --build`) works, but every later
+deploy that does not know about it leaves old agent code running against a
+newly migrated schema — so put the switch in `.env` instead. See
+[`deploy/README.md`](./deploy/README.md#turning-piggy-on).
+
 ### The MCP server — for the agent you already use
 
 `apps/mcp` speaks **stdio** and holds an API key. It calls the same HTTP API a
@@ -548,10 +572,11 @@ layer. Every read returns the whole book. This is why read capabilities are
 platform-wide rather than per-team, and it is the thing to build before PIG
 serves a company where that is not acceptable.
 
-**`.env.example` is incomplete.** `POSTGRES_PASSWORD` and
-`PIG_SETTINGS_ENCRYPTION_KEY` are both load-bearing and both missing from it;
-the table above is authoritative. `ANTHROPIC_API_KEY` is declared in the API
-config and read by nothing.
+**`ANTHROPIC_API_KEY` is declared in the API config and read by nothing.** The
+rest of `.env.example` is now complete: `POSTGRES_PASSWORD` and
+`PIG_SETTINGS_ENCRYPTION_KEY` were both load-bearing and both missing from it,
+which made the documented `cp .env.example .env` fail at the first compose
+command.
 
 **Not started at all:** email or calendar ingestion, forecasting, quota and
 attainment, invoicing or billing reconciliation, a public API beyond what the