Rebuild Piggy's interface, and give the demo book a business to describe

Piggy answered in raw markdown, threw away every tool result it streamed,
and fought the reader's scroll on every token. The three surfaces that
made it worth having — what it read, how it reasoned, what it cost — were
all on the wire and none of them reached the screen.

The transcript is now composed of five parts under components/piggy:
answers render through streamdown, the container sticks to the bottom
without pinning the reader there, tool steps say what they read and link
to the record, and each turn carries its model and token count. Three
lifecycle bugs went with them: Stop left a permanent spinner, a truncated
stream was indistinguishable from thinking, and a failed send destroyed
the message it failed to send.

Underneath, the inference path grew timeouts, jittered retries on 429 and
5xx, tolerance of the malformed frames a 30B model emits, and an
agent_runs row per turn so chat spend is observable. The system prompt now
states that a field ending in Cents is cents — without it nemotron renders
costPerGpuHourCents: 189 as "$189 per GPU-hour", which is a 100x error on
the most scrutinised number in the room.

The demo book was arithmetically incoherent: every deal's value
contradicted its own allocation revenue by up to 3.6x, nothing had ever
closed, no customer had any paper, and the marketplace was empty. Deal
value is now derived from the allocation, the book clears 5.3% across five
blocks with one deliberately underwater, and the renewal, compliance and
agent-provenance machinery finally has rows to act on. A --clear that
deleted every obligation, SLA term and capacity request in the database
regardless of origin is scoped to the demo's own ids.

Around that: accounts have a detail page, ⌘K searches the book, Settings
can mint the API keys it always claimed to, and deploy.sh actually ships
the agent instead of silently skipping its compose profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/api/src/lib/media.ts

@@ -49,8 +49,9 @@
 import { Hono } from 'hono';
 import { createReadStream } from 'node:fs';
 import { realpath, stat } from 'node:fs/promises';
-import { join, resolve, sep } from 'node:path';
+import { dirname, join, resolve, sep } from 'node:path';
 import { Readable } from 'node:stream';
+import { fileURLToPath } from 'node:url';
 import { isLearnMediaFilename, learnMediaContentType, LEARN_MEDIA_PATH_PREFIX } from '@pig/core';
 
 /**
@@ -61,16 +62,27 @@ import { isLearnMediaFilename, learnMediaContentType, LEARN_MEDIA_PATH_PREFIX }
  * a reason to refuse to boot — an install with no videos should serve 404s and
  * work in every other respect.
  *
- * The default is relative to the working directory, which is the repository
- * root in development. The container sets it explicitly to `/app/media`, which
- * is where docker-compose bind-mounts the host directory read-only.
+ * A relative path — including the default — is resolved against the REPOSITORY
+ * ROOT, not the working directory. It used to be the working directory, and
+ * that was wrong in the one case it had to be right: `pnpm -F @pig/api dev`
+ * runs with the cwd set to `apps/api`, so the documented `PIG_MEDIA_DIR=./media`
+ * resolved to `apps/api/media`, which does not exist, and every Learn video
+ * 404'd while the poster fell back to a placeholder that looks deliberate. The
+ * container copies the tree to `/app`, so the root is `/app` there and the
+ * default lands on `/app/media` — exactly where docker-compose bind-mounts the
+ * host directory read-only, and what it sets `PIG_MEDIA_DIR` to anyway.
  */
 export const LEARN_MEDIA_DIR_ENV = 'PIG_MEDIA_DIR';
 const DEFAULT_MEDIA_DIR = './media';
 
+// apps/api/src/lib/media.ts — four levels up is the repository root.
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
+
 export function learnMediaRoot(env: NodeJS.ProcessEnv = process.env): string {
   const configured = env[LEARN_MEDIA_DIR_ENV]?.trim();
-  return resolve(configured && configured.length > 0 ? configured : DEFAULT_MEDIA_DIR);
+  // `resolve` ignores the base when the second argument is already absolute,
+  // so an absolute PIG_MEDIA_DIR is honoured untouched.
+  return resolve(REPO_ROOT, configured && configured.length > 0 ? configured : DEFAULT_MEDIA_DIR);
 }
 
 /** The mount path, exported so `app.ts` and the resolver cannot disagree. */
@@ -147,9 +159,20 @@ export function createMediaRoutes(options: { root?: string } = {}) {
        * directory is operator-populated and mounted read-only, so this was
        * hardening rather than a live hole — but it becomes real the moment the
        * directory is filled by an rsync or a tarball unpack.
+       *
+       * BOTH sides are resolved, though. Comparing a real file path against a
+       * LEXICAL root rejects the entire directory the moment the media root is
+       * itself reached through a symlink — a symlinked checkout, or a data
+       * volume under /var that is a link into /mnt — and the symptom is a
+       * blanket 404 on every video with nothing in the log to say why.
+       * Resolving the root the same way the file is resolved keeps the defence
+       * exactly as strict: the file still has to sit inside the real
+       * directory, so a link planted among the videos and pointing at
+       * /etc/passwd is still refused.
        */
+      const realRoot = await realpath(root);
       const real = await realpath(path);
-      if (real !== path && !real.startsWith(root + sep)) return c.notFound();
+      if (!real.startsWith(realRoot + sep)) return c.notFound();
       const info = await stat(real);
       if (!info.isFile()) return c.notFound();
       size = info.size;