chats 0.5.0 → 0.6.0

data/app/views/chats/conversations/show.html.erb

@@ -1,6 +1,9 @@
-<%# The thread page: its own header around the shared thread body
-    (chats/conversations/_thread, which a floating dock window renders too —
-    see that partial for how the live thread works). %>
+<%# The thread page under `config.inbox_layout = :stacked`: its header
+    (chats/conversations/_thread_header) over the shared thread body
+    (chats/conversations/_thread, which a floating dock window and the
+    two-pane page's conversation pane render too — see that partial for how
+    the live thread works). Under the default `:split`, /messages/:id is
+    the two-pane page instead (index.html.erb). %>
 <%= chats_styles %>
 
 <%= render layout: "chats/conversations/thread",
@@ -9,67 +12,9 @@
              messages: @messages,
              more: @more_messages,
              first_unread_id: @first_unread_id,
-             counterpart: chats_counterpart
+             counterpart: chats_counterpart,
+             read_pending: @read_pending
            } do %>
-  <header class="chats-thread__header">
-    <%= link_to root_path, class: "chats-thread__back", "aria-label": t("chats.thread.back") do %>
-      <span aria-hidden="true">‹</span>
-    <% end %>
-
-    <%# The counterpart is already resolved for the title, the profile link
-        and the stack link — reuse it here instead of asking again. %>
-    <% if chats_counterpart %>
-      <%= chats_messager_avatar(chats_counterpart) %>
-    <% else %>
-      <%= chats_conversation_avatar(@conversation, chats_current_messager) %>
-    <% end %>
-
-    <div class="chats-thread__identity">
-      <%# Both arms wrap the name in .chats-thread__name: the <h1> is a flex
-          row (the badge is its second child), and only a real element can
-          carry the ellipsis. %>
-      <h1 class="chats-thread__title">
-        <% if chats_counterpart %>
-          <%= chats_messager_name(chats_counterpart, css_class: "chats-thread__name") %>
-          <%= chats_verified_badge(chats_counterpart) %>
-        <% else %>
-          <span class="chats-thread__name"><%= @conversation.title_for(chats_current_messager) %></span>
-        <% end %>
-      </h1>
-      <% if @conversation.subject_label %>
-        <p class="chats-thread__subject"><%= @conversation.subject_label %></p>
-      <% end %>
-      <%# A stacked counterpart's thread is one of many: offer the way back
-          to the whole stack (chats' filtered inbox, or the host's own
-          screen via `group_path:`). %>
-      <% if Chats.grouped_inbox?(chats_counterpart) %>
-        <p class="chats-thread__see-all">
-          <%= link_to t("chats.thread.see_all"), chats_group_path_for(chats_counterpart), class: "chats-thread__see-all-link" %>
-        </p>
-      <% end %>
-    </div>
-
-    <details class="chats-menu">
-      <summary class="chats-menu__trigger" aria-label="<%= t("chats.thread.options") %>">⋯</summary>
-      <div class="chats-menu__panel">
-        <% if @participant&.muted? %>
-          <%= button_to t("chats.thread.unmute"), unmute_conversation_path(@conversation), method: :post, class: "chats-menu__item" %>
-        <% else %>
-          <%= button_to t("chats.thread.mute"), mute_conversation_path(@conversation), method: :post, class: "chats-menu__item" %>
-        <% end %>
-        <% if @conversation.group? %>
-          <%= button_to t("chats.thread.leave"), leave_conversation_path(@conversation), method: :post, class: "chats-menu__item chats-menu__item--danger" %>
-        <% end %>
-        <%# Slot: the host's own thread actions (block, report, archive…).
-            `blockable` is false for messagers declared
-            `acts_as_messager blockable: false`, so safety affordances
-            disappear against a support desk without any class check. %>
-        <%= chats_slot :conversation_header_actions,
-              conversation: @conversation,
-              viewer: chats_current_messager,
-              counterpart: chats_counterpart,
-              blockable: chats_blockable?(chats_counterpart) %>
-      </div>
-    </details>
-  </header>
+  <%= render "chats/conversations/thread_header",
+             conversation: @conversation, participant: @participant, counterpart: chats_counterpart %>
 <% end %>

data/app/views/chats/dock/_dock.html.erb

@@ -32,9 +32,12 @@
         "chats--dock-everywhere-value": everywhere,
         "chats--dock-window-url-value": chats_routes.conversation_path("__id__", window: 1),
         "chats--dock-record-key-value": Chats::Conversation.model_name.param_key,
+        "chats--dock-badge-url-value": chats_routes.badge_conversations_path,
         "chats--dock-announcement-value": t("chats.dock.new_message_from", name: "%{name}"),
-        # Plural forms uninterpolated: the controller fills %{count} in.
-        "chats--dock-window-unread-value": I18n.t("chats.dock.window_unread").to_json,
+        # Every plural form the locale has (CLDR: zero, one, two, few, many,
+        # other), uninterpolated: the controller picks one with
+        # Intl.PluralRules and fills %{count} in.
+        "chats--dock-window-unread-value": chats_plural_forms("chats.dock.window_unread").to_json,
         action: "keydown->chats--dock#keydown " \
                 "focusin->chats--dock#engage pointerdown->chats--dock#engage wheel->chats--dock#engage " \
                 "touchstart->chats--dock#engage " \
@@ -46,7 +49,8 @@
                 "input->chats--dock#typed " \
                 "click@document->chats--dock#delegate " \
                 "turbo:before-stream-render@document->chats--dock#beforeStreamRender " \
-                "turbo:load@document->chats--dock#pageChanged turbo:render@document->chats--dock#pageChanged"
+                "turbo:load@document->chats--dock#pageChanged turbo:render@document->chats--dock#pageChanged " \
+                "turbo:frame-load@document->chats--dock#pageFrameLoaded"
       } do %>
   <%= turbo_stream_from viewer, :chats_dock %>
   <%= render "chats/dock/signal" %>
@@ -88,7 +92,8 @@
         <%= form_with url: chats_routes.conversations_path,
               method: :get,
               class: "chats-search chats-dock__search",
-              role: "search",
+              # `html:`: form_with drops attributes it doesn't know (role among them).
+              html: { role: "search" },
               data: {
                 controller: "chats--debounced-submit",
                 action: "input->chats--debounced-submit#queue search->chats--debounced-submit#queue",
@@ -106,10 +111,14 @@
       <% end %>
 
       <%# Lazy: nothing is fetched until the panel first opens; until then,
-          four still rows. The controller reloads it when the signal says. %>
+          four still rows. The controller reloads it when the signal says,
+          and when its stream may have missed a signal. `refresh: :morph`:
+          a reload morphs the rows in place, so the list keeps its scroll
+          position, and it reloads its own src, so a search stays. %>
       <%= turbo_frame_tag "chats_dock_list",
             src: chats_routes.dock_conversations_path(recent: recent),
             loading: :lazy,
+            refresh: :morph,
             target: "_top",
             class: "chats-dock__results",
             # A click here opens a window, never the page: hovering a row

data/app/views/chats/messages/_message.html.erb

@@ -15,12 +15,14 @@
      data-chats--thread-target="message"
      data-sender-key="<%= message.sender_key %>"
      data-timestamp="<%= message.created_at.iso8601 %>"
-     <%# updated-at-ms: the thread controller tracks the max across bubbles as
-         its `?since=` cursor for the stale-thread refresh — updated_at (not
-         created_at) so edits/tombstones that happened while asleep are caught
-         too. `.ceil` biases the cursor PAST this row's sub-millisecond tail,
-         so the strictly-greater server query can't re-fetch it. %>
-     data-updated-at-ms="<%= (message.updated_at.to_f * 1000).ceil %>">
+     <%# The stale-thread catch-up's cursors, to the microsecond the
+         database keeps, with the id that breaks a tie: the newest creation
+         on screen decides what is appended (`after`), the newest change
+         what is replaced (`changed`), and the oldest bubble's creation is
+         the `from` of the list of what still exists (hard deletes). %>
+     data-message-id="<%= message.id %>"
+     data-created-at-us="<%= (message.created_at.to_i * 1_000_000) + message.created_at.usec %>"
+     data-updated-at-us="<%= (message.updated_at.to_i * 1_000_000) + message.updated_at.usec %>">
 
   <% if message.system? %>
     <div class="chats-message__system<%= " chats-message__system--with-action" if message.action? %>">

data/config/importmap.rb

@@ -16,3 +16,10 @@ pin "controllers/chats/composer_controller", to: "chats/composer_controller.js"
 pin "controllers/chats/debounced_submit_controller", to: "chats/debounced_submit_controller.js"
 pin "controllers/chats/refresh_inbox_controller", to: "chats/refresh_inbox_controller.js"
 pin "controllers/chats/dock_controller", to: "chats/dock_controller.js"
+pin "controllers/chats/unread_badge_controller", to: "chats/unread_badge_controller.js"
+pin "controllers/chats/split_controller", to: "chats/split_controller.js"
+
+# Not a controller: what the inbox, thread, badge and dock controllers share
+# to catch up on broadcasts they missed. Outside controllers/ so the eager
+# loader never tries to register it.
+pin "chats/recovery", to: "chats/recovery.js"

data/config/locales/en.yml

@@ -8,6 +8,7 @@ en:
       no_results_title: "No results"
       no_results_hint: "Nothing matched “%{query}”."
       no_messages: "No messages yet"
+      select_hint: "Select a conversation"
       filtered_by: "Conversations with %{name}"
       clear_filter: "Show all conversations"
       group_count:

data/config/locales/es.yml

@@ -8,6 +8,7 @@ es:
       no_results_title: "Sin resultados"
       no_results_hint: "No hay nada que coincida con «%{query}»."
       no_messages: "Sin mensajes todavía"
+      select_hint: "Selecciona una conversación"
       filtered_by: "Conversaciones con %{name}"
       clear_filter: "Ver todas las conversaciones"
       group_count:

data/config/routes.rb

@@ -9,6 +9,9 @@ Chats::Engine.routes.draw do
     # frame. A collection route, so it is drawn before /:id and never read as
     # a conversation id.
     get :dock, on: :collection
+    # Every unread badge on the page, fresh (`chats_unread_badge` and the
+    # dock's), for a page that may have missed the badge streams.
+    get :badge, on: :collection
 
     member do
       post :read    # advance the viewer's read horizon (mark as read)

data/lib/chats/broadcasts.rb

@@ -20,9 +20,8 @@ module Chats
   #      broadcast would force per-viewer renders of per-viewer partials;
   #      a refresh makes each client re-request the page and get a correct,
   #      personalized render with morphing + scroll preservation for free.
-  #      Turbo debounces refreshes per stream and tags them with the
-  #      originating request id so the tab that caused the change skips its
-  #      own refresh. https://turbo.hotwired.dev/handbook/streams
+  #      At most one is queued per messager at a time (see
+  #      refresh_inbox_of). https://turbo.hotwired.dev/handbook/streams
   #
   #   3. The per-messager BADGE stream (`[messager, :chats_badge]`,
   #      subscribable from ANY page via the `chats_unread_badge` helper —
@@ -49,7 +48,16 @@ module Chats
   #
   # Everything uses the `_later` variants (rendering happens in background
   # jobs, never inline in the request) except `message_destroyed`, where the
-  # record is gone and can't be serialized for a job.
+  # record is gone and can't be serialized for a job. Every job is enqueued
+  # from an after_commit callback, so a broadcast never announces a write
+  # that could still roll back, and never waits in memory: once the write
+  # has committed, its broadcast is in the job queue.
+  #
+  # A broadcast can still be missed — Action Cable has no replay, and a
+  # client whose socket is down when it is sent never gets it. The client
+  # side catches up (chats/recovery.js: on reconnect, on return to a hidden
+  # page, on network-online, on a back/forward-cache restore), so every
+  # surface fed by these streams heals without polling.
   module Broadcasts
     extend ActionView::RecordIdentifier # dom_id
 
@@ -57,6 +65,10 @@ module Chats
     BADGE_PARTIAL = "chats/shared/unread_badge"
     DOCK_UPDATE_PARTIAL = "chats/dock/update"
     READ_STATE_PARTIAL = "chats/conversations/read_state"
+    # The inbox stream's whole payload. Built once, with no request id.
+    INBOX_REFRESH = %(<turbo-stream action="refresh" method="morph" scroll="preserve"></turbo-stream>)
+    # How long a queued inbox refresh stands for the writes after it.
+    INBOX_REFRESH_PENDING = 2.seconds
 
     class << self
       def message_created(message)
@@ -125,8 +137,60 @@ module Chats
         )
       end
 
+      # Straight into the job queue, NOT `broadcast_refresh_later_to`: that
+      # one first parks the refresh for half a second in an in-process
+      # timer (Turbo::Debouncer, a Concurrent::ScheduledTask) and only then
+      # enqueues the job, so a deploy or a crash inside that half second
+      # drops the refresh with nothing left to retry it.
+      #
+      # One job per messager at a time. A refresh carries no data — the
+      # client re-requests its inbox — so while one is queued and hasn't
+      # started, it covers every write that commits before it runs: a burst
+      # (five messages in a 100-person group) is one job per participant,
+      # not five. A marker in Rails.cache says one is queued; the job removes
+      # it as it STARTS, before it broadcasts, so a write that still finds
+      # the marker has committed before that broadcast, and a write after
+      # it queues the next job. Every way the marker can go wrong costs an
+      # extra job, never a missed refresh: a cache without it (null store,
+      # a per-process memory store, an eviction) just doesn't coalesce, and
+      # the marker expires after INBOX_REFRESH_PENDING, so a job lost from
+      # the queue holds nothing back for longer than that.
+      # Refreshes that still arrive close together merge on the client:
+      # Turbo runs one page refresh for refreshes within 150 ms of each
+      # other (Session#pageRefreshDebouncePeriod), and chats--refresh-inbox
+      # reruns one that landed mid-visit, which Turbo would ignore.
+      #
+      # The marker goes up BEFORE the enqueue, so another write can find it
+      # while the enqueue is still in flight and count on that refresh. An
+      # enqueue that fails is therefore tried once more, and if the queue
+      # refuses again the refresh is broadcast right here: the writes that
+      # counted on it are never left without one. The failure is reported to
+      # Rails.error, not raised: the write has committed, and the refresh is
+      # out.
+      #
+      # Only a marker that is really there means a refresh is queued. A store
+      # that can't hold it (RedisCacheStore answers nil when the write
+      # fails, any store may raise) means nothing about the queue, so this
+      # write queues its own refresh.
       def refresh_inbox_of(messager)
-        Turbo::StreamsChannel.broadcast_refresh_later_to(messager, :chats_inbox)
+        return if inbox_refresh_queued?(inbox_refresh_marker(messager))
+        return if 2.times.any? { enqueue_inbox_refresh(messager) } # once more if the first fails
+
+        refresh_inbox_now(messager)
+      end
+
+      # The job's half (Chats::InboxRefreshJob): take the marker down, then
+      # broadcast. `method: morph, scroll: preserve` ride on the tag, so the
+      # inbox morphs in place whatever the host layout's refresh meta says.
+      # No request id: one refresh may answer writes from several requests,
+      # and a tab that skipped it as "its own" would miss the others'.
+      def refresh_inbox_now(messager)
+        begin
+          Rails.cache.delete(inbox_refresh_marker(messager))
+        rescue StandardError => e
+          Rails.error.report(e, handled: true) # the marker expires on its own; the refresh goes out regardless
+        end
+        Turbo::StreamsChannel.broadcast_stream_to(messager, :chats_inbox, content: INBOX_REFRESH)
       end
 
       # The unread badges of +messager+: the nav badge (stream 3) and the
@@ -169,9 +233,40 @@ module Chats
 
       private
 
+      # Whether the queue took the job. A refusal is reported to Rails.error
+      # however the adapter says it: perform_later raises, or returns false
+      # (a callback aborted it), or a job that wasn't enqueued.
+      def enqueue_inbox_refresh(messager)
+        job = Chats::InboxRefreshJob.perform_later(messager)
+        job = nil unless job.is_a?(ActiveJob::Base) # false: a callback aborted it
+        return true if job&.successfully_enqueued?
+
+        Rails.error.report(job&.enqueue_error || ActiveJob::EnqueueError.new("Chats::InboxRefreshJob was not enqueued"),
+                           handled: true)
+        false
+      rescue StandardError => e
+        Rails.error.report(e, handled: true)
+        false
+      end
+
+      # Whether a refresh is already queued for this marker's messager: the
+      # write was refused (false) AND the marker can be read back. Anything
+      # else — this write put it up, the store answered nil or raised, the
+      # marker vanished in between — is "not that we know of".
+      def inbox_refresh_queued?(marker)
+        written = Rails.cache.write(marker, true, unless_exist: true, expires_in: INBOX_REFRESH_PENDING)
+        written == false && Rails.cache.read(marker).present?
+      rescue StandardError => e
+        Rails.error.report(e, handled: true)
+        false
+      end
+
+      def inbox_refresh_marker(messager)
+        "chats:inbox-refresh:#{Chats.messager_key(messager)}"
+      end
+
       # New activity: every active participant's inbox refreshes (including
-      # the sender's — their OTHER tabs/devices need the new ordering; the
-      # originating tab skips its own refresh via Turbo's request-id dedup),
+      # the sender's — their other tabs and devices need the new ordering),
       # and every participant except the sender gets a fresh unread badge.
       # Everyone else — the sender, and every seat on an edit or a delete —
       # gets the dock's list refresh alone.

data/lib/chats/configuration.rb

@@ -15,6 +15,7 @@ module Chats
   class Configuration
     ATTACHMENT_MODES = [false, :images, :any].freeze
     DELETION_MODES = [false, :soft, :hard].freeze
+    INBOX_LAYOUTS = %i[split stacked].freeze
 
     # --- Host integration -----------------------------------------------------
 
@@ -92,6 +93,15 @@ module Chats
     # threads.
     attr_accessor :inbox_limit
 
+    # How the inbox and a conversation share the screen. `:split` (the
+    # default): on screens at least 700px wide, /messages is two panes, the
+    # conversation list on the left and the open conversation on the right,
+    # and /messages/:id is that same page with the conversation open
+    # (LinkedIn's messaging page); narrower, the list and the thread are
+    # separate pages. `:stacked`: separate pages at every width, as before
+    # 0.6.
+    attr_reader :inbox_layout
+
     # Per-sender send throttle, enforced with Rails 8's built-in controller
     # `rate_limit` when available (feature-detected; on Rails 7.1 it's a
     # no-op). Shape: `{ to: Integer, within: ActiveSupport::Duration }`.
@@ -187,6 +197,7 @@ module Chats
       @max_attachments_per_message = 4
       @send_rate_limit = { to: 60, within: 60 } # 60 messages per minute per sender
       @inbox_limit = 200
+      @inbox_layout = :split
 
       @encrypt_messages = false
 
@@ -244,6 +255,18 @@ module Chats
       @deletion = normalized
     end
 
+    def inbox_layout=(value)
+      normalized = value.respond_to?(:to_sym) ? value.to_sym : value
+      unless INBOX_LAYOUTS.include?(normalized)
+        raise ConfigurationError, "inbox_layout must be one of #{INBOX_LAYOUTS.inspect}, got #{value.inspect}"
+      end
+
+      @inbox_layout = normalized
+    end
+
+    # Whether the inbox and the open conversation are one two-pane page.
+    def split_inbox? = inbox_layout == :split
+
     def send_rate_limit=(value)
       if value.nil?
         @send_rate_limit = nil

data/lib/chats/inbox_refresh_job.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Chats
+  # One messager's inbox refresh (Chats::Broadcasts.refresh_inbox_of): at
+  # most one queued per messager, standing for every write that commits
+  # before it starts. A messager deleted before it ran has no inbox.
+  class InboxRefreshJob < ActiveJob::Base
+    discard_on ActiveJob::DeserializationError
+
+    def perform(messager)
+      Chats::Broadcasts.refresh_inbox_now(messager)
+    end
+  end
+end

data/lib/chats/models/conversation.rb

@@ -78,6 +78,22 @@ module Chats
     # listed, like everywhere else).
     scope :with_messages, -> { where.not(last_message_id: nil) }
 
+    # Conversations a messager wrote in, and their complement. A narrower
+    # question than `with_messages`, which counts every message: a system
+    # line is the app talking ("Your ride was cancelled", which the inbox
+    # rightly lists), and a tombstone no longer says anything. These count
+    # only Chats::Message.human, what is left when both are set aside. For
+    # the readers that must not count a thread holding only "Alice joined":
+    # ops walls, moderation lists, analytics.
+    #
+    # One correlated EXISTS / NOT EXISTS, so they compose with any other
+    # scope (`alice.chats`, `inbox_for`, `about`, `unread_by`,
+    # `with_messages`) and never multiply rows:
+    #   alice.chats.with_human_messages
+    #   Chats::Conversation.about(ride).without_human_messages.count   # admin-wide
+    scope :with_human_messages, -> { where(human_messages_exist) }
+    scope :without_human_messages, -> { where.not(human_messages_exist) }
+
     # A messager's inbox: every conversation they're an active participant of
     # (not left), minus direct threads with someone they're blocked with,
     # newest activity first. THE hot query — keep it composable and indexed.
@@ -209,6 +225,20 @@ module Chats
                            .group("chats_conversations.id")
                            .count("chats_messages.id")
       end
+
+      # EXISTS (SELECT 1 FROM chats_messages WHERE conversation_id =
+      # chats_conversations.id AND kind = 'text' AND deleted_at IS NULL),
+      # built from Chats::Message.human so the two definitions can never
+      # drift, and unscoped so a Message scope the caller happens to be inside
+      # never leaks in. Public only because scope bodies run on the relation,
+      # which cannot reach a private class method.
+      def human_messages_exist # :nodoc:
+        messages = Chats::Message.arel_table
+        Chats::Message.unscoped.human
+                      .where(messages[:conversation_id].eq(arel_table[:id]))
+                      .select(Arel.sql("1"))
+                      .arel.exists
+      end
     end
 
     # --- Predicates & lookups -------------------------------------------------
@@ -348,6 +378,14 @@ module Chats
       messages.create!(kind: "system", body: body, action: action)
     end
 
+    # The newest thing a messager wrote here (see `.with_human_messages`), or
+    # nil when none did. Unlike +last_message+ it skips system lines and
+    # tombstones, and it is a query, not the denormalized pointer: one per
+    # call. For a list, batch it with Chats::Message.last_human_in(conversations).
+    def last_human_message
+      messages.human.recent_first.first
+    end
+
     # --- Read state -----------------------------------------------------------
 
     def unread_count_for(messager)

data/lib/chats/models/message.rb

@@ -81,6 +81,77 @@ module Chats
     scope :oldest_first, -> { order(created_at: :asc, id: :asc) }
     scope :visible, -> { where(deleted_at: nil) }
 
+    # What messagers wrote: text messages that still stand. "Human" is the
+    # gem's word for a text message, written by a messager, person or not
+    # (a bot's or a headless desk's message counts), as opposed to a system
+    # line ("Alice joined", "Your ride was cancelled"), which is the app
+    # talking. A tombstone no longer says anything. A photo with no caption
+    # is still a text message and still counts. The inbox does NOT read through this,
+    # on purpose — see README "Real conversations vs system-only threads".
+    scope :human, -> { where(kind: "text").visible }
+
+    # The newest human message of each given conversation, at most one row
+    # per conversation, in ONE query: the batch twin of
+    # Conversation#last_human_message for lists (admin walls, moderation
+    # queues). +conversations+ is a page of records, ids, a single record, or
+    # a Chats::Conversation relation — an unloaded relation is read as a
+    # subquery, never loaded first, and without its `includes`/`preload`/
+    # `eager_load` (they load records; a subquery has none to load). So a
+    # relation that FILTERS on an associated table must join it explicitly
+    # (`joins` / `left_joins`): `includes(:x).references(:x).where(x: …)`
+    # loses the join and raises. Or pass the loaded page, or its ids.
+    #
+    # The result is a relation, so the columns can be narrowed:
+    #
+    #   Chats::Message.last_human_in(conversations)
+    #                 .select(:id, :conversation_id, :created_at)
+    #                 .index_by(&:conversation_id)          # { id => message }
+    #
+    # A conversation nobody wrote in has no row. ROW_NUMBER works on every
+    # supported adapter (PostgreSQL, SQLite and MySQL 8), the same ranking
+    # Chats::Inbox uses for its stacks. The ranked subquery is built unscoped,
+    # so neither a scope it is called on nor a `.select` chained onto the
+    # result leaks into it.
+    scope :last_human_in, lambda { |conversations|
+      ids = Chats::Message.conversation_ids_in(conversations)
+      next none if ids.is_a?(Array) && ids.empty?
+
+      ranking = "ROW_NUMBER() OVER (PARTITION BY chats_messages.conversation_id " \
+                "ORDER BY chats_messages.created_at DESC, chats_messages.id DESC) AS human_rank"
+      ranked = Chats::Message.unscoped.human.where(conversation_id: ids)
+                             .select(Arel.sql("chats_messages.id"), Arel.sql(ranking))
+      newest = Chats::Message.unscoped.from(ranked, :ranked_messages)
+                             .where(Arel.sql("ranked_messages.human_rank = 1"))
+                             .select(Arel.sql("ranked_messages.id"))
+      where(id: newest)
+    }
+
+    # The conversation ids +last_human_in+ ranks within: an Array for records
+    # and ids (a loaded relation included, read from memory), a subquery for
+    # an unloaded relation, as a derived table because MySQL rejects LIMIT
+    # directly inside IN, and a page is usually limited.
+    #
+    # A LIMITed or OFFSET page is its own query, word for word (its select
+    # list, DISTINCT and ORDER BY decide WHICH rows it holds, and PostgreSQL
+    # refuses a DISTINCT whose ORDER BY left the select list), so it must
+    # expose an `id` column, as the default select list does. Any other
+    # relation is just a set of ids: narrowed to `id`, unordered (the inbox's
+    # ORDER BY COALESCE(…) next to DISTINCT id is another refusal).
+    def self.conversation_ids_in(conversations) # :nodoc:
+      unless conversations.is_a?(ActiveRecord::Relation)
+        return Array(conversations).map { |c| c.is_a?(Chats::Conversation) ? c.id : c }
+      end
+      unless conversations.klass <= Chats::Conversation
+        raise ArgumentError, "expected Chats::Conversation records, ids or a relation of them, " \
+                             "got a #{conversations.klass.name} relation"
+      end
+      return conversations.map(&:id) if conversations.loaded?
+
+      page = conversations.except(:includes, :preload, :eager_load)
+      page = page.reselect(page.arel_table[:id]).reorder(nil) unless page.limit_value || page.offset_value
+      Chats::Conversation.unscoped.from(page, :conversation_page).select(Arel.sql("conversation_page.id"))
+    end
+
     # Keyset (cursor) pagination for infinite scroll-up. OFFSET pagination
     # drifts when new messages arrive mid-scroll; anchoring on the oldest
     # loaded message can't skip or duplicate. `(created_at, id)` because
@@ -93,17 +164,35 @@ module Chats
     }
 
     # Catch-up scopes for ConversationsController#refresh (the stale-thread
-    # recovery path — see the thread controller's refresh trigger). `since`
-    # is the newest `updated_at` the client has rendered:
-    #   created_since — messages that arrived while the tab was asleep
-    #                   (appended);
-    #   updated_since — messages the client HAS rendered that changed since
-    #                   (edits, soft-delete tombstones — replaced in place).
-    # `updated_since` excludes fresh rows so nothing renders twice — a Turbo
-    # append of an existing dom_id would otherwise also MOVE that bubble to
-    # the end (Turbo removes-then-appends on id collision).
+    # recovery path — see the thread controller's catch-up), on the client's
+    # two cursors. Each is a moment, to the microsecond, up to which the
+    # client KNOWS it has everything (a complete render, or a catch-up that
+    # succeeded — never a live bubble, which can arrive past one it missed),
+    # with the ids it has on screen from that moment on:
+    #   created_after(at, seen:)   — created at or after that moment and not
+    #                                on screen: appended;
+    #   created_through(at, seen:) — the complement: what the client has;
+    #   updated_after(at, seen:)   — changed after that moment, or at it and
+    #                                not among the ones seen in that version.
+    # Replacements are created_through(after).updated_after(changed): changes
+    # to what is on screen, never a second copy of what is appended — a Turbo
+    # append of an existing dom_id would MOVE that bubble to the end. Two
+    # cursors, because one can't answer both: a message created at 10:15 and
+    # missed is older than a 10:20 edit that did arrive.
     # Pattern from Basecamp's Campfire (Rooms::RefreshesController):
     # https://github.com/basecamp/once-campfire
+    scope :created_after, lambda { |at, seen: []|
+      where(arel_table[:created_at].gteq(at)).where.not(id: seen)
+    }
+    scope :created_through, lambda { |at, seen: []|
+      where(arel_table[:created_at].lt(at)).or(where(id: seen))
+    }
+    scope :updated_after, lambda { |at, seen: []|
+      where(arel_table[:updated_at].gt(at)).or(where(updated_at: at).where.not(id: seen))
+    }
+    # The one-cursor catch-up of bubbles ejected before they carried the
+    # cursors above (`data-updated-at-ms` alone, rounded up): what was
+    # created after it, and what was rendered by then and changed since.
     scope :created_since, ->(time) { where("chats_messages.created_at > ?", time) }
     scope :updated_since, lambda { |time|
       where("chats_messages.updated_at > ?", time).where("chats_messages.created_at <= ?", time)

data/lib/chats/models/reaction.rb

@@ -27,6 +27,15 @@ module Chats
     # Rails behavior: https://guides.rubyonrails.org/active_record_callbacks.html#using-both-after-create-commit-and-after-update-commit
     after_commit :broadcast_change, on: %i[create destroy]
 
+    # A reaction changes how its message renders, so it moves the message's
+    # updated_at: that is what a thread catching up on missed broadcasts asks
+    # for (Message.updated_after). update_columns, not touch: the
+    # broadcast above already re-renders the bubble, and touch would run the
+    # message's own update callbacks and broadcast it a second time. Not when
+    # the message itself is being destroyed and takes its reactions with it.
+    after_create :stamp_message
+    after_destroy :stamp_message, unless: :destroyed_by_association
+
     # Add the reaction if absent, remove it if present (the universal
     # tap-to-toggle semantic). Returns the created reaction, or false when
     # toggled off. Race-safe: a concurrent double-tap resolves through the
@@ -68,6 +77,10 @@ module Chats
       errors.add(:reactor, :not_a_participant) unless message.conversation.participant?(reactor)
     end
 
+    def stamp_message
+      message.update_columns(updated_at: Time.current)
+    end
+
     def broadcast_change
       Chats::Broadcasts.message_updated(message) unless message.destroyed?
     end