chats 0.4.2 → 0.5.1

data/lib/chats/broadcasts.rb

@@ -4,7 +4,7 @@ require "action_view/record_identifier"
 
 module Chats
   # ALL of the gem's real-time fan-out, in one file — read this and you know
-  # the entire live behavior. Three streams exist:
+  # the entire live behavior. Four streams exist:
   #
   #   1. The CONVERSATION stream (`turbo_stream_from @conversation` on the
   #      thread page): surgical message append/replace/remove, the read-state
@@ -20,9 +20,8 @@ module Chats
   #      broadcast would force per-viewer renders of per-viewer partials;
   #      a refresh makes each client re-request the page and get a correct,
   #      personalized render with morphing + scroll preservation for free.
-  #      Turbo debounces refreshes per stream and tags them with the
-  #      originating request id so the tab that caused the change skips its
-  #      own refresh. https://turbo.hotwired.dev/handbook/streams
+  #      At most one is queued per messager at a time (see
+  #      refresh_inbox_of). https://turbo.hotwired.dev/handbook/streams
   #
   #   3. The per-messager BADGE stream (`[messager, :chats_badge]`,
   #      subscribable from ANY page via the `chats_unread_badge` helper —
@@ -30,15 +29,46 @@ module Chats
   #      Deliberately separate from the inbox stream — if badges rode on it,
   #      every page embedding a badge would full-refresh on every message.
   #
+  #   4. The per-messager DOCK stream (`[messager, :chats_dock]`, subscribed
+  #      by the messaging dock — `chats_dock`). One render per participant
+  #      per event (chats/dock/_update), carrying up to two things:
+  #        * the dock's BADGES, with the same count as stream 3, whenever the
+  #          badge moves (a message for them, a read of theirs);
+  #        * the SIGNAL (chats/dock/_signal), replaced so the dock's
+  #          controller sees it connect: reload the recent list, and — for a
+  #          new message the participant should hear about — which
+  #          conversation it was, from whom, how much is unread there, and
+  #          that its window may pop open. Senders and edits/deletes get the
+  #          signal too (their lists reorder), never the pop-up.
+  #      The hint names a conversation only to a participant who can SEE it
+  #      (`messager.chats`: blocks and `inbox_scope` applied) — the dock's
+  #      own list and window endpoints refuse anything else, and the stream
+  #      must not tell them what those hide. No polling, no Action Cable
+  #      channel of our own.
+  #
   # Everything uses the `_later` variants (rendering happens in background
   # jobs, never inline in the request) except `message_destroyed`, where the
-  # record is gone and can't be serialized for a job.
+  # record is gone and can't be serialized for a job. Every job is enqueued
+  # from an after_commit callback, so a broadcast never announces a write
+  # that could still roll back, and never waits in memory: once the write
+  # has committed, its broadcast is in the job queue.
+  #
+  # A broadcast can still be missed — Action Cable has no replay, and a
+  # client whose socket is down when it is sent never gets it. The client
+  # side catches up (chats/recovery.js: on reconnect, on return to a hidden
+  # page, on network-online, on a back/forward-cache restore), so every
+  # surface fed by these streams heals without polling.
   module Broadcasts
     extend ActionView::RecordIdentifier # dom_id
 
     MESSAGE_PARTIAL = "chats/messages/message"
     BADGE_PARTIAL = "chats/shared/unread_badge"
+    DOCK_UPDATE_PARTIAL = "chats/dock/update"
     READ_STATE_PARTIAL = "chats/conversations/read_state"
+    # The inbox stream's whole payload. Built once, with no request id.
+    INBOX_REFRESH = %(<turbo-stream action="refresh" method="morph" scroll="preserve"></turbo-stream>)
+    # How long a queued inbox refresh stands for the writes after it.
+    INBOX_REFRESH_PENDING = 2.seconds
 
     class << self
       def message_created(message)
@@ -51,7 +81,7 @@ module Chats
           locals: { message: message }
         )
 
-        fan_out_inboxes(conversation, skip_badge_for: message.sender)
+        fan_out_inboxes(conversation, skip_badge_for: message.sender, message: message)
       end
 
       def message_updated(message)
@@ -107,11 +137,73 @@ module Chats
         )
       end
 
+      # Straight into the job queue, NOT `broadcast_refresh_later_to`: that
+      # one first parks the refresh for half a second in an in-process
+      # timer (Turbo::Debouncer, a Concurrent::ScheduledTask) and only then
+      # enqueues the job, so a deploy or a crash inside that half second
+      # drops the refresh with nothing left to retry it.
+      #
+      # One job per messager at a time. A refresh carries no data — the
+      # client re-requests its inbox — so while one is queued and hasn't
+      # started, it covers every write that commits before it runs: a burst
+      # (five messages in a 100-person group) is one job per participant,
+      # not five. A marker in Rails.cache says one is queued; the job removes
+      # it as it STARTS, before it broadcasts, so a write that still finds
+      # the marker has committed before that broadcast, and a write after
+      # it queues the next job. Every way the marker can go wrong costs an
+      # extra job, never a missed refresh: a cache without it (null store,
+      # a per-process memory store, an eviction) just doesn't coalesce, and
+      # the marker expires after INBOX_REFRESH_PENDING, so a job lost from
+      # the queue holds nothing back for longer than that.
+      # Refreshes that still arrive close together merge on the client:
+      # Turbo runs one page refresh for refreshes within 150 ms of each
+      # other (Session#pageRefreshDebouncePeriod), and chats--refresh-inbox
+      # reruns one that landed mid-visit, which Turbo would ignore.
+      #
+      # The marker goes up BEFORE the enqueue, so another write can find it
+      # while the enqueue is still in flight and count on that refresh. An
+      # enqueue that fails is therefore tried once more, and if the queue
+      # refuses again the refresh is broadcast right here: the writes that
+      # counted on it are never left without one. The failure is reported to
+      # Rails.error, not raised: the write has committed, and the refresh is
+      # out.
+      #
+      # Only a marker that is really there means a refresh is queued. A store
+      # that can't hold it (RedisCacheStore answers nil when the write
+      # fails, any store may raise) means nothing about the queue, so this
+      # write queues its own refresh.
       def refresh_inbox_of(messager)
-        Turbo::StreamsChannel.broadcast_refresh_later_to(messager, :chats_inbox)
+        return if inbox_refresh_queued?(inbox_refresh_marker(messager))
+        return if 2.times.any? { enqueue_inbox_refresh(messager) } # once more if the first fails
+
+        refresh_inbox_now(messager)
+      end
+
+      # The job's half (Chats::InboxRefreshJob): take the marker down, then
+      # broadcast. `method: morph, scroll: preserve` ride on the tag, so the
+      # inbox morphs in place whatever the host layout's refresh meta says.
+      # No request id: one refresh may answer writes from several requests,
+      # and a tab that skipped it as "its own" would miss the others'.
+      def refresh_inbox_now(messager)
+        begin
+          Rails.cache.delete(inbox_refresh_marker(messager))
+        rescue StandardError => e
+          Rails.error.report(e, handled: true) # the marker expires on its own; the refresh goes out regardless
+        end
+        Turbo::StreamsChannel.broadcast_stream_to(messager, :chats_inbox, content: INBOX_REFRESH)
       end
 
-      def update_badge_of(messager)
+      # The unread badges of +messager+: the nav badge (stream 3) and the
+      # dock's (stream 4), with the signal that tells the dock what changed.
+      # +conversation+ and +message+ say what happened (both nil for a
+      # read); +participant+ is the messager's seat there.
+      def update_badge_of(messager, conversation: nil, message: nil, participant: nil)
+        # Counted at broadcast-enqueue time: the badge is advisory UI; a
+        # count that's seconds stale self-heals on the next event. The SAME
+        # count the page renders (`chats_unread_badge`), so what the inbox
+        # scope hides never lights the badge. Counted once for both.
+        count = messager.unread_chats_count
+
         # REPLACE, not update: the partial renders the whole badge element
         # (its id included) — an `update` would nest it inside the existing
         # element and duplicate the id. Replace keeps it idempotent.
@@ -119,29 +211,98 @@ module Chats
           messager, :chats_badge,
           target: "chats_unread_badge",
           partial: BADGE_PARTIAL,
-          # Counted at broadcast-enqueue time: the badge is advisory UI; a
-          # count that's seconds stale self-heals on the next event. The
-          # SAME count the page renders (`chats_unread_badge`), so what the
-          # inbox scope hides never lights the badge.
-          locals: { count: messager.unread_chats_count }
+          locals: { count: count }
+        )
+
+        update_dock_of(messager, count: count, conversation: conversation, message: message, participant: participant)
+      end
+
+      # The dock's update (stream 4): the badges when +count+ is given, and
+      # the signal. A conversation the messager cannot see is never named:
+      # its badge count is still truthful, the signal is simply not sent.
+      def update_dock_of(messager, count: nil, conversation: nil, message: nil, participant: nil)
+        signal = dock_signal(messager, conversation, message, participant)
+        return if count.nil? && signal.nil?
+
+        Turbo::StreamsChannel.broadcast_render_later_to(
+          messager, :chats_dock,
+          partial: DOCK_UPDATE_PARTIAL,
+          locals: { count: count, signal: signal }
         )
       end
 
       private
 
+      # Whether the queue took the job. A refusal is reported to Rails.error
+      # however the adapter says it: perform_later raises, or returns false
+      # (a callback aborted it), or a job that wasn't enqueued.
+      def enqueue_inbox_refresh(messager)
+        job = Chats::InboxRefreshJob.perform_later(messager)
+        job = nil unless job.is_a?(ActiveJob::Base) # false: a callback aborted it
+        return true if job&.successfully_enqueued?
+
+        Rails.error.report(job&.enqueue_error || ActiveJob::EnqueueError.new("Chats::InboxRefreshJob was not enqueued"),
+                           handled: true)
+        false
+      rescue StandardError => e
+        Rails.error.report(e, handled: true)
+        false
+      end
+
+      # Whether a refresh is already queued for this marker's messager: the
+      # write was refused (false) AND the marker can be read back. Anything
+      # else — this write put it up, the store answered nil or raised, the
+      # marker vanished in between — is "not that we know of".
+      def inbox_refresh_queued?(marker)
+        written = Rails.cache.write(marker, true, unless_exist: true, expires_in: INBOX_REFRESH_PENDING)
+        written == false && Rails.cache.read(marker).present?
+      rescue StandardError => e
+        Rails.error.report(e, handled: true)
+        false
+      end
+
+      def inbox_refresh_marker(messager)
+        "chats:inbox-refresh:#{Chats.messager_key(messager)}"
+      end
+
       # New activity: every active participant's inbox refreshes (including
-      # the sender's — their OTHER tabs/devices need the new ordering; the
-      # originating tab skips its own refresh via Turbo's request-id dedup),
+      # the sender's — their other tabs and devices need the new ordering),
       # and every participant except the sender gets a fresh unread badge.
-      def fan_out_inboxes(conversation, skip_badge_for: nil, badges: true)
+      # Everyone else — the sender, and every seat on an edit or a delete —
+      # gets the dock's list refresh alone.
+      def fan_out_inboxes(conversation, skip_badge_for: nil, badges: true, message: nil)
         conversation.participants.active.includes(:messager).each do |participant|
           messager = participant.messager
           next if messager.nil?
 
           refresh_inbox_of(messager)
-          update_badge_of(messager) if badges && messager != skip_badge_for
+          if badges && messager != skip_badge_for
+            update_badge_of(messager, conversation: conversation, message: message, participant: participant)
+          else
+            update_dock_of(messager, conversation: conversation)
+          end
         end
       end
+
+      # What the dock is told, or nil for nothing at all. A read (no
+      # conversation) only reloads the list. A conversation the messager
+      # can't see (blocked, scoped out) is never named. A new message the
+      # participant would be notified about (Participant#notifiable_for?:
+      # not theirs, not muted, not a headless seat) may pop its window and
+      # be announced, with who it is from and how much is unread there.
+      def dock_signal(messager, conversation, message, participant)
+        return {} if conversation.nil?
+        return nil unless messager.chats.exists?(conversation.id)
+
+        signal = { conversation_id: conversation.id }
+        return signal unless message && participant&.notifiable_for?(message)
+
+        signal.merge(
+          notify: true,
+          sender_name: message.sender ? Chats.display_name_for(message.sender) : conversation.title_for(messager),
+          unread_count: participant.unread_count
+        )
+      end
     end
   end
 end

data/lib/chats/inbox.rb

@@ -8,9 +8,11 @@ module Chats
   #   Chats::Inbox.for(alice)                       # rows, newest activity first
   #   Chats::Inbox.for(alice, query: "madrid")      # the search box
   #   Chats::Inbox.for(alice, with: support_desk)   # one stack's contents
+  #   Chats::Inbox.for(alice, limit: 10)            # the messaging dock's recent list
   #
   # Rows are `Chats::Conversation | Chats::InboxGroup`, sorted by last
-  # activity descending. Grouping happens HERE and nowhere else.
+  # activity descending. Grouping happens HERE and nowhere else, and so does
+  # the rule that a conversation with no messages is never listed.
   #
   # == Why `inbox_limit` bounds ROWS, not conversations
   #
@@ -26,24 +28,30 @@ module Chats
   class Inbox
     include Enumerable
 
-    attr_reader :viewer, :query, :with
+    attr_reader :viewer, :query, :with, :limit
 
     class << self
       # The inbox for +viewer+. Returns a Chats::Inbox, which enumerates its
       # rows (`to_a` for a plain Array).
-      def for(viewer, query: nil, with: nil)
-        new(viewer, query: query, with: with)
+      def for(viewer, query: nil, with: nil, limit: nil)
+        new(viewer, query: query, with: with, limit: limit)
       end
     end
 
-    def initialize(viewer, query: nil, with: nil)
+    # +limit+ is how many ROWS come back (`config.inbox_limit` by default).
+    # A smaller one is a smaller query, not a slice of the big one — except
+    # while searching, which still looks through the whole `inbox_limit`
+    # window (a match is no less a match for being the eleventh most
+    # recent conversation) and then returns at most +limit+ hits.
+    def initialize(viewer, query: nil, with: nil, limit: nil)
       @viewer = viewer
       @query = query.to_s.strip.presence
       @with = with
+      @limit = Integer(limit || Chats.config.inbox_limit).clamp(1, Chats.config.inbox_limit)
     end
 
     # Conversation | InboxGroup rows, newest activity first, at most
-    # `config.inbox_limit` of them.
+    # +limit+ of them.
     def rows
       @rows ||= build_rows
     end
@@ -111,16 +119,30 @@ module Chats
 
     private
 
-    def limit
-      Chats.config.inbox_limit
+    # How many conversations each leg of the query loads: the row limit, or
+    # the whole inbox window while a search filters it in Ruby.
+    def window
+      query ? Chats.config.inbox_limit : limit
     end
 
     # The viewer's own inbox relation (`Messager#chats`: `inbox_for` with
     # `config.inbox_scope` applied, and whatever the host's model adds on
     # top), memoized so it is built ONCE per inbox however many legs the
     # row query is split into (the stack aggregates build their own).
+    #
+    # Only conversations with at least one message (Conversation.
+    # with_messages, system messages and tombstones included): one that was
+    # opened and never used is not listed — not as a row, not in a
+    # stack, not in search, not in the `?with=` view. It still OPENS, because
+    # authorization reads `viewer.chats`, not this.
     def base_relation
-      @base_relation ||= viewer.chats.includes(:last_message, :subject, participants: :messager)
+      @base_relation ||= listed(viewer.chats).includes(:last_message, :subject, participants: :messager)
+    end
+
+    # What a list may show of +relation+. The one place the rule lives, so
+    # the rows and the stack totals can never disagree about it.
+    def listed(relation)
+      relation.with_messages
     end
 
     # The polymorphic types worth splitting out. Empty when nothing stacks
@@ -140,15 +162,15 @@ module Chats
 
     def load_conversations
       if filtered?
-        @ungrouped_relation = filter_to_counterpart(base_relation).limit(limit)
+        @ungrouped_relation = filter_to_counterpart(base_relation).limit(window)
         @stacked = []
       elsif grouped_types.empty?
-        @ungrouped_relation = base_relation.limit(limit)
+        @ungrouped_relation = base_relation.limit(window)
         @stacked = []
       else
         stacked = Chats::Conversation.direct.where(id: stacked_seats)
-        @ungrouped_relation = base_relation.where.not(id: stacked).limit(limit)
-        recent = base_relation.direct.where(id: stacked_seats).except(:includes).select(:id).limit(limit)
+        @ungrouped_relation = base_relation.where.not(id: stacked).limit(window)
+        recent = base_relation.direct.where(id: stacked_seats).except(:includes).select(:id).limit(window)
         # Preserve the recent search window, plus the freshest conversation
         # of each counterpart. A busy stack cannot consume another stack's
         # row; at most twice the row limit is materialized.
@@ -183,7 +205,7 @@ module Chats
                                                       messager_id: viewer.id })
                             .select("chats_conversations.id, #{activity} AS activity_at", ranking)
       Chats::Conversation.from(ranked, :ranked_stacks).where("stack_rank = 1")
-                         .order(Arel.sql("activity_at DESC, id DESC")).limit(limit).select(:id)
+                         .order(Arel.sql("activity_at DESC, id DESC")).limit(window).select(:id)
     end
 
     # Only the direct threads shared with one counterpart. Direct only, by
@@ -210,7 +232,8 @@ module Chats
         (stacks[Chats.messager_key(counterpart)] ||= [counterpart, []]).last << conversation
       end
 
-      rows.concat(stacks.each_value.map { |messager, members| build_group(messager, members) })
+      totals = stack_totals(stacks.each_value.map(&:first))
+      rows.concat(stacks.each_value.map { |messager, members| build_group(messager, members, totals) })
       sort_rows(rows).first(limit)
     end
 
@@ -226,33 +249,48 @@ module Chats
       end
     end
 
-    def build_group(messager, members)
-      totals = stack_totals(messager)
+    def build_group(messager, members, totals)
+      key = stack_key(messager.class.polymorphic_name, messager.id)
 
       Chats::InboxGroup.new(
         messager: messager,
         conversations: sort_rows(members),
-        unread_count: totals[:unread],
-        open_count: totals[:open]
+        unread_count: totals[:unread].fetch(key, 0),
+        open_count: totals[:open].fetch(key, 0)
       )
     end
 
-    # What a stacked row says about the WHOLE stack, in two indexed
-    # aggregates — independent of how deep the stack is, and of how much of
-    # it we loaded.
-    def stack_totals(messager)
-      scope = viewer.chats.reorder(nil).direct.where(
-        id: Chats::Participant.select(:conversation_id).where(
-          messager_type: messager.class.polymorphic_name, messager_id: messager.id
-        )
-      )
+    # What each stacked row says about its WHOLE stack, for every stack at
+    # once: two grouped aggregates, however many stacks the inbox shows and
+    # however deep each one runs — never per stack, never by loading one.
+    # Grouped by the counterpart's seat; the type and id lists may pair up
+    # a few seats that aren't stacks here, and those rows are simply never
+    # read back.
+    def stack_totals(messagers)
+      return { open: {}, unread: {} } if messagers.empty?
+
+      types = messagers.map { |messager| messager.class.polymorphic_name }.uniq
+      seats = listed(viewer.chats).reorder(nil).direct
+                                  .joins("INNER JOIN chats_participants stack_seats " \
+                                         "ON stack_seats.conversation_id = chats_conversations.id")
+                                  .where(stack_seats: { messager_type: types, messager_id: messagers.map(&:id) })
+                                  .group("stack_seats.messager_type", "stack_seats.messager_id")
 
       {
-        open: scope.distinct.count,
-        unread: scope.unread_by(viewer).reorder(nil).count("chats_messages.id")
+        open: keyed(seats.distinct.count("chats_conversations.id")),
+        unread: keyed(seats.unread_by(viewer).count("chats_messages.id"))
       }
     end
 
+    def keyed(counts)
+      counts.transform_keys { |(type, id)| stack_key(type, id) }
+    end
+
+    # uuid and bigint keys alike: the database may hand ids back as strings.
+    def stack_key(type, id)
+      [type, id.to_s]
+    end
+
     # The other party of a DIRECT conversation, when their class asked to be
     # stacked (`acts_as_messager inbox: :grouped`). Read from the preloaded
     # participants — no extra query per row.

data/lib/chats/inbox_refresh_job.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Chats
+  # One messager's inbox refresh (Chats::Broadcasts.refresh_inbox_of): at
+  # most one queued per messager, standing for every write that commits
+  # before it starts. A messager deleted before it ran has no inbox.
+  class InboxRefreshJob < ActiveJob::Base
+    discard_on ActiveJob::DeserializationError
+
+    def perform(messager)
+      Chats::Broadcasts.refresh_inbox_now(messager)
+    end
+  end
+end

data/lib/chats/models/concerns/messager.rb

@@ -184,6 +184,12 @@ module Chats
     # read it, so a conversation the scope hides is hidden everywhere. Until
     # 0.4.1 the badge counted through the raw `inbox_for` relation and could
     # light up for a conversation the inbox would never show.
+    #
+    # It is also the AUTHORIZATION relation (every engine lookup is
+    # `viewer.chats.find(id)`), which is why it includes conversations
+    # with no messages yet: the thread you just opened must open. The
+    # lists narrow it with `Chats::Conversation.with_messages` (see
+    # Chats::Inbox); `chats.with_messages` is what your own lists want too.
     def chats
       relation = Chats::Conversation.inbox_for(self)
       Chats.config.inbox_scope.call(relation, self) || relation
@@ -193,8 +199,10 @@ module Chats
     # badge counts conversations, not messages — 47 unread messages in one
     # thread is still "1 thing to deal with").
     def unread_chats_count
-      # reorder(nil): the inbox scope orders by a COALESCE expression, which
-      # PostgreSQL rejects inside a COUNT(DISTINCT …) aggregate.
+      # No `with_messages` needed to agree with the inbox: `unread_by` joins
+      # the messages, so a conversation with no messages can never be
+      # counted. reorder(nil): the inbox scope orders by a COALESCE
+      # expression, which PostgreSQL rejects inside a COUNT(DISTINCT …).
       chats.unread_by(self).reorder(nil).distinct.count
     end
 

data/lib/chats/models/conversation.rb

@@ -59,6 +59,41 @@ module Chats
       order(Arel.sql("COALESCE(chats_conversations.last_message_at, chats_conversations.created_at) DESC"))
     }
 
+    # Conversations that have at least one message, system messages and
+    # tombstones included (`last_message_id` set). Not "a person wrote here":
+    # a conversation holding only a system note, or only a deleted message,
+    # has messages. A conversation exists from the moment it is OPENED
+    # (`chat_with`, the Message button), and nobody wants an inbox full of
+    # the threads they opened and never used — "No messages yet" rows. So
+    # every LIST the gem renders (the inbox, its stacks, search, the
+    # `?with=` view, the dock's recent list) reads through this scope, while
+    # the authorization relation (`Messager#chats`) does NOT: an empty
+    # conversation still opens when addressed directly, which is how its
+    # first message gets written.
+    #
+    # Free, because the denormalized pointer already says it: a conversation
+    # has a last message exactly when it has messages (the pointer is set on
+    # every create and healed on every hard delete; a soft-deleted tombstone
+    # is still a message, so a thread whose only message was deleted stays
+    # listed, like everywhere else).
+    scope :with_messages, -> { where.not(last_message_id: nil) }
+
+    # Conversations a messager wrote in, and their complement. A narrower
+    # question than `with_messages`, which counts every message: a system
+    # line is the app talking ("Your ride was cancelled", which the inbox
+    # rightly lists), and a tombstone no longer says anything. These count
+    # only Chats::Message.human, what is left when both are set aside. For
+    # the readers that must not count a thread holding only "Alice joined":
+    # ops walls, moderation lists, analytics.
+    #
+    # One correlated EXISTS / NOT EXISTS, so they compose with any other
+    # scope (`alice.chats`, `inbox_for`, `about`, `unread_by`,
+    # `with_messages`) and never multiply rows:
+    #   alice.chats.with_human_messages
+    #   Chats::Conversation.about(ride).without_human_messages.count   # admin-wide
+    scope :with_human_messages, -> { where(human_messages_exist) }
+    scope :without_human_messages, -> { where.not(human_messages_exist) }
+
     # A messager's inbox: every conversation they're an active participant of
     # (not left), minus direct threads with someone they're blocked with,
     # newest activity first. THE hot query — keep it composable and indexed.
@@ -190,6 +225,20 @@ module Chats
                            .group("chats_conversations.id")
                            .count("chats_messages.id")
       end
+
+      # EXISTS (SELECT 1 FROM chats_messages WHERE conversation_id =
+      # chats_conversations.id AND kind = 'text' AND deleted_at IS NULL),
+      # built from Chats::Message.human so the two definitions can never
+      # drift, and unscoped so a Message scope the caller happens to be inside
+      # never leaks in. Public only because scope bodies run on the relation,
+      # which cannot reach a private class method.
+      def human_messages_exist # :nodoc:
+        messages = Chats::Message.arel_table
+        Chats::Message.unscoped.human
+                      .where(messages[:conversation_id].eq(arel_table[:id]))
+                      .select(Arel.sql("1"))
+                      .arel.exists
+      end
     end
 
     # --- Predicates & lookups -------------------------------------------------
@@ -329,6 +378,14 @@ module Chats
       messages.create!(kind: "system", body: body, action: action)
     end
 
+    # The newest thing a messager wrote here (see `.with_human_messages`), or
+    # nil when none did. Unlike +last_message+ it skips system lines and
+    # tombstones, and it is a query, not the denormalized pointer: one per
+    # call. For a list, batch it with Chats::Message.last_human_in(conversations).
+    def last_human_message
+      messages.human.recent_first.first
+    end
+
     # --- Read state -----------------------------------------------------------
 
     def unread_count_for(messager)