Rebuild Piggy's interface, and give the demo book a business to describe

Piggy answered in raw markdown, threw away every tool result it streamed,
and fought the reader's scroll on every token. The three surfaces that
made it worth having — what it read, how it reasoned, what it cost — were
all on the wire and none of them reached the screen.

The transcript is now composed of five parts under components/piggy:
answers render through streamdown, the container sticks to the bottom
without pinning the reader there, tool steps say what they read and link
to the record, and each turn carries its model and token count. Three
lifecycle bugs went with them: Stop left a permanent spinner, a truncated
stream was indistinguishable from thinking, and a failed send destroyed
the message it failed to send.

Underneath, the inference path grew timeouts, jittered retries on 429 and
5xx, tolerance of the malformed frames a 30B model emits, and an
agent_runs row per turn so chat spend is observable. The system prompt now
states that a field ending in Cents is cents — without it nemotron renders
costPerGpuHourCents: 189 as "$189 per GPU-hour", which is a 100x error on
the most scrutinised number in the room.

The demo book was arithmetically incoherent: every deal's value
contradicted its own allocation revenue by up to 3.6x, nothing had ever
closed, no customer had any paper, and the marketplace was empty. Deal
value is now derived from the allocation, the book clears 5.3% across five
blocks with one deliberately underwater, and the renewal, compliance and
agent-provenance machinery finally has rows to act on. A --clear that
deleted every obligation, SLA term and capacity request in the database
regardless of origin is scoped to the demo's own ids.

Around that: accounts have a detail page, ⌘K searches the book, Settings
can mint the API keys it always claimed to, and deploy.sh actually ships
the agent instead of silently skipping its compose profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/autodeploy.sh

@@ -12,8 +12,10 @@
 #
 #   1. Ask the registry for the newest release-* tag.
 #   2. Compare that tag's manifest digest with the digest of the image the
-#      running app container was started from. Equal -> exit 0, silently. This
-#      is the normal case and it happens every five minutes.
+#      running app container was started from — and the piggy container's too,
+#      when Piggy is enabled, because it is the same image and a Piggy left
+#      behind runs old code against a migrated schema. All equal -> exit 0,
+#      silently. This is the normal case and it happens every five minutes.
 #   3. Otherwise check the working tree out at that tag — the compose file and
 #      the migrations must come from the same commit as the image — and hand
 #      over to scripts/deploy.sh with PIG_IMAGE set.
@@ -118,18 +120,58 @@ REMOTE_DIGEST=$(curl -sSI --max-time 30 "${AUTH_ARGS[@]}" "${MANIFEST_ACCEPT[@]}
 # Compare digests, not tags. A tag can be moved; a digest is the content. This
 # also means a re-pushed tag redeploys, which is what you want the one time it
 # matters.
-RUNNING_DIGEST=""
-RUNNING_CID=$(docker compose -p pig ps -q app 2>/dev/null | head -n1 || true)
-if [ -n "$RUNNING_CID" ]; then
-  RUNNING_IMAGE=$(docker inspect -f '{{.Image}}' "$RUNNING_CID" 2>/dev/null || true)
-  if [ -n "$RUNNING_IMAGE" ]; then
-    RUNNING_DIGEST=$(docker image inspect "$RUNNING_IMAGE" \
-      --format '{{range .RepoDigests}}{{println .}}{{end}}' 2>/dev/null \
-      | sed -n "s|^$IMAGE_NAME@||p" | head -n1 || true)
-  fi
-fi
 
-if [ "$RUNNING_DIGEST" = "$REMOTE_DIGEST" ]; then
+# Read one key out of the deployed .env WITHOUT sourcing it: sourcing an
+# environment file executes it, and this one holds every secret the deployment
+# has. The same helper as scripts/deploy.sh, for the same reason.
+env_value() {
+  [ -f .env ] || return 0
+  sed -n "s/^[[:space:]]*$1=//p" .env | tail -n1 | sed -e 's/^"\(.*\)"$/\1/' -e "s/^'\(.*\)'\$/\1/"
+}
+
+# The words the API accepts, from `envBoolean` in apps/api/src/lib/config.ts.
+is_true() {
+  # Whitespace and a trailing inline comment are both dropped by compose before
+  # a container sees the value; read it the same way deploy.sh does.
+  local value=${1%%[[:space:]]#*}
+  case "$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')" in
+    1 | true | yes | on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# The piggy service is profile-gated, and compose skips a profile-gated service
+# silently — with no profile, `ps -q piggy` prints nothing at all unless that
+# container happens to be running already. Without this, a Piggy left on an
+# older image is invisible here: the app matches the newest tag, this reports
+# "up to date" every five minutes, and the agent runs last month's code.
+COMPOSE_PROFILES=''
+if is_true "$(env_value PIGGY_ENABLED)"; then
+  COMPOSE_PROFILES='piggy'
+fi
+export COMPOSE_PROFILES
+
+# The registry digest of the image a running container was started from, or the
+# empty string when there is no such container.
+running_digest() {
+  local cid image
+  cid=$(docker compose -p pig ps -q "$1" 2>/dev/null | head -n1 || true)
+  [ -n "$cid" ] || return 0
+  image=$(docker inspect -f '{{.Image}}' "$cid" 2>/dev/null || true)
+  [ -n "$image" ] || return 0
+  docker image inspect "$image" --format '{{range .RepoDigests}}{{println .}}{{end}}' 2>/dev/null \
+    | sed -n "s|^$IMAGE_NAME@||p" | head -n1 || true
+}
+
+RUNNING_DIGEST=$(running_digest app)
+PIGGY_DIGEST=''
+[ -z "$COMPOSE_PROFILES" ] || PIGGY_DIGEST=$(running_digest piggy)
+
+# Both halves of the release, or neither. app and piggy are the same image
+# running two commands, so a piggy behind the app is a deploy that only half
+# happened — and it is the half that writes to the database.
+if [ "$RUNNING_DIGEST" = "$REMOTE_DIGEST" ] \
+  && { [ -z "$COMPOSE_PROFILES" ] || [ "$PIGGY_DIGEST" = "$REMOTE_DIGEST" ]; }; then
   log "up to date at $LATEST_TAG ($REMOTE_DIGEST)"
   exit 0
 fi
@@ -142,6 +184,7 @@ fi
 
 log "deploying $LATEST_TAG"
 log "  running: ${RUNNING_DIGEST:-<none>}"
+[ -z "$COMPOSE_PROFILES" ] || log "  piggy:   ${PIGGY_DIGEST:-<none>}"
 log "  wanted:  $REMOTE_DIGEST"
 
 # ---------------------------------------------------------------- deploy
@@ -177,6 +220,9 @@ else
     log "THE FAILING RELEASE IS STILL LIVE — deploy.sh did not roll back (it"
     log "either judged the fault external to the release, had no previous image,"
     log "or the restored image did not come up). Check the site NOW."
+    log "One exit-3 case leaves the CRM serving normally: Piggy enabled but not"
+    log "coming up, usually a missing PIGGY_INFERENCE_API_KEY. The log above says"
+    log "which it was."
   else
     log "deploy.sh rolls the app back on a failed health, auth or public-marker"
     log "gate, so the previous release should still be serving — verify that first."