@frockbot/plugin-shell 0.3.7 → 0.3.9

package/src/client/index.test.ts

@@ -26,6 +26,10 @@ const {
   shellClientPlugin,
 } = await import("./index.js");
 import type { FrockBotWebData } from "../shared.js";
+import {
+  UNCERTAIN_ADMISSION_MAX_ATTEMPTS_V1,
+  UNREACHABLE_BOT_MESSAGE_V1,
+} from "./uncertain-admission.js";
 import type { Ref } from "vue";
 
 const originalLocalStorage = Object.getOwnPropertyDescriptor(
@@ -1627,6 +1631,79 @@ describe("active durable Turn projection", () => {
     });
   });
 
+  test("a running Turn's partial text fills the bubble it will settle into", () => {
+    const state: Pick<
+      FrockBotWebData,
+      "messages" | "activeRunId" | "activeRun"
+    > = { messages: [] };
+
+    projectDurableRuns(
+      state,
+      [],
+      [
+        {
+          runId: "run-9",
+          input: "Explain",
+          events: [],
+          status: "running",
+          partialText: "Because it",
+        },
+      ],
+    );
+    expect(state.messages[1]).toMatchObject({
+      text: "Because it",
+      status: "streaming",
+    });
+
+    // One bubble: the settled answer replaces the partial one in place.
+    projectDurableRuns(
+      state,
+      [],
+      [
+        {
+          runId: "run-9",
+          input: "Explain",
+          events: [],
+          status: "completed",
+          responseText: "Because it is.",
+        },
+      ],
+    );
+    expect(state.messages).toHaveLength(2);
+    expect(state.messages[1]).toMatchObject({
+      text: "Because it is.",
+      status: "completed",
+    });
+  });
+
+  test("a Turn that has already delivered a send streams nothing beside it", () => {
+    const state: Pick<
+      FrockBotWebData,
+      "messages" | "activeRunId" | "activeRun"
+    > = { messages: [] };
+
+    projectDurableRuns(
+      state,
+      [],
+      [
+        {
+          runId: "run-10",
+          input: "Explain",
+          events: [
+            {
+              type: "send/to-user",
+              payload: { type: "text", text: "Here you go." },
+            },
+          ],
+          status: "running",
+          partialText: "private scratch space",
+        },
+      ],
+    );
+    expect(state.messages[1]).toMatchObject({ text: "", status: "streaming" });
+    expect(state.messages[1]?.sends).toHaveLength(1);
+  });
+
   test("projects reconciliation-required recovery state", () => {
     const reconciliation: Pick<
       FrockBotWebData,
@@ -2152,6 +2229,134 @@ describe("uncertain Turn admission", () => {
     });
   });
 
+  test("refuses a send the server answered 4xx, keeping the draft and the thread clean", async () => {
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: { location: { href: "https://app.example/?bot=primary" } },
+    });
+    let provided: Ref<FrockBotWebData> | undefined;
+    let lookups = 0;
+    const tooLong =
+      "Your message is too long. Keep it under 32,000 characters.";
+    await shellClientPlugin({
+      transport: {
+        // What the transport throws for a 413: the answer was read, so the
+        // status rides on the error beside the sentence the person should see.
+        turn: () =>
+          Promise.reject(Object.assign(new Error(tooLong), { status: 413 })),
+        lookupRun: () => {
+          lookups += 1;
+          return Promise.resolve(undefined);
+        },
+        fenceRunAdmission: () => Promise.resolve(undefined),
+      },
+      slot: () => () => {},
+      inject: () => {
+        throw new Error("unexpected client provider injection");
+      },
+      provide: (_key, value) => {
+        provided = value as Ref<FrockBotWebData>;
+        return () => {};
+      },
+    });
+    if (!provided) throw new Error("shell data was not provided");
+    provided.value.activeBotId = "primary";
+    provided.value.composerContext = "primary";
+
+    const result = await provided.value.sendPrompt("x".repeat(120_000));
+
+    // A refusal, so the composer keeps the draft — and the thread shows
+    // neither the message that was never sent nor a placeholder about it.
+    expect(result).toEqual({ accepted: false, error: tooLong });
+    expect(provided.value.error).toBe(tooLong);
+    expect(provided.value.messages).toEqual([]);
+    expect(provided.value.activeRun).toBeUndefined();
+    expect(provided.value.activeRunId).toBeUndefined();
+    expect(provided.value.runningRunId).toBeUndefined();
+    // Nothing to reconcile: the Turn was refused, not lost.
+    expect(lookups).toBe(0);
+  });
+
+  test("settles an unreachable backend after the retry bound, under the message it reports on", async () => {
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: { location: { href: "https://app.example/?bot=primary" } },
+    });
+    // The bound is spent by waiting, and this test is about how the wait ends
+    // rather than about how long each one is.
+    const originalSetTimeout = globalThis.setTimeout;
+    Object.defineProperty(globalThis, "setTimeout", {
+      configurable: true,
+      writable: true,
+      value: ((callback: () => void) => {
+        queueMicrotask(callback);
+        return 0 as unknown as ReturnType<typeof originalSetTimeout>;
+      }) as unknown as typeof originalSetTimeout,
+    });
+    let provided: Ref<FrockBotWebData> | undefined;
+    let lookups = 0;
+    try {
+      await shellClientPlugin({
+        transport: {
+          // No status: the answer never arrived, so admission is genuinely
+          // unknown and reconciliation is right to start.
+          turn: () => Promise.reject(new TypeError("Failed to fetch")),
+          lookupRun: () => {
+            lookups += 1;
+            return Promise.reject(new TypeError("Failed to fetch"));
+          },
+          fenceRunAdmission: () =>
+            Promise.reject(new TypeError("Failed to fetch")),
+        },
+        slot: () => () => {},
+        inject: () => {
+          throw new Error("unexpected client provider injection");
+        },
+        provide: (_key, value) => {
+          provided = value as Ref<FrockBotWebData>;
+          return () => {};
+        },
+      });
+      if (!provided) throw new Error("shell data was not provided");
+      provided.value.activeBotId = "primary";
+      provided.value.composerContext = "primary";
+
+      const result = await provided.value.sendPrompt("are you there");
+
+      expect(lookups).toBe(UNCERTAIN_ADMISSION_MAX_ATTEMPTS_V1);
+      expect(result).toEqual({
+        accepted: false,
+        error: UNREACHABLE_BOT_MESSAGE_V1,
+      });
+      const [user, placeholder] = provided.value.messages;
+      expect(user).toMatchObject({ role: "user", text: "are you there" });
+      expect(placeholder).toMatchObject({
+        role: "assistant",
+        text: UNREACHABLE_BOT_MESSAGE_V1,
+        status: "error",
+        retry: "resend",
+      });
+      // Strictly after the message it reports on, so the thread's ordering by
+      // time cannot lift it above that message.
+      expect((placeholder?.at ?? "") > (user?.at ?? "")).toBe(true);
+      // Nothing is running any more, so no Stop stands for it, and the banner
+      // stops saying the client is still checking. It does not repeat the
+      // bubble's sentence either: the bubble is the report, and it is the one
+      // carrying the Retry.
+      expect(provided.value.error).toBeUndefined();
+      expect(provided.value.settingsError).toBeUndefined();
+      expect(provided.value.activeRun).toBeUndefined();
+      expect(provided.value.activeRunId).toBeUndefined();
+      expect(provided.value.runningRunId).toBeUndefined();
+    } finally {
+      Object.defineProperty(globalThis, "setTimeout", {
+        configurable: true,
+        writable: true,
+        value: originalSetTimeout,
+      });
+    }
+  });
+
   test("detaches a rejected Turn without starting a stale observer after Bot switch", async () => {
     Object.defineProperty(globalThis, "window", {
       configurable: true,

package/src/client/index.ts

@@ -62,6 +62,12 @@ import {
   decodeApprovalDecisionReceiptV1,
   decodeApprovalListViewV1,
 } from "../approvals.js";
+import {
+  isCertainSendRefusalV1,
+  momentAfterV1,
+  uncertainAdmissionDelayMsV1,
+  UNREACHABLE_BOT_MESSAGE_V1,
+} from "./uncertain-admission.js";
 import {
   decodeTaskListViewV1,
   decodeTaskViewV1,
@@ -277,10 +283,16 @@ function turnRefusalCopyV1(reason: ClientTurnRefusalReasonV1): string {
  * model's own assistant text is scratch space and the thread does not draw it
  * (issue 153): drawing both is how a one-word reply arrived twice, once as the
  * model's text and once as the bubble that was actually delivered.
+ *
+ * A running Turn has no `responseText` yet — that is written only at
+ * settlement — so it draws the words it has written so far. They occupy the
+ * same bubble the settled answer will, and the same send gate applies to
+ * both: a Turn that has already delivered a bubble streams nothing into a
+ * second one.
  */
 function visibleAssistantText(run: ClientRun, fallback = ""): string {
   if (sendsFrom(run.events).length > 0) return "";
-  return run.responseText ?? fallback;
+  return run.responseText ?? run.partialText ?? fallback;
 }
 
 function isTerminalRun(run: ClientRun): boolean {
@@ -976,7 +988,7 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
     botId: string,
     runId: string,
     signal: AbortSignal,
-  ): Promise<"admitted" | "not-admitted" | "detached"> {
+  ): Promise<"admitted" | "not-admitted" | "detached" | "unreachable"> {
     web.value.activeRun = {
       runId,
       status: "running",
@@ -986,7 +998,6 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
     if (!ctx.transport.lookupRun || !ctx.transport.fenceRunAdmission) {
       return "detached";
     }
-    let delayMs = 250;
     let reconciliationError: string | undefined;
     const clearReconciliationError = () => {
       if (web.value.settingsError === reconciliationError) {
@@ -994,7 +1005,7 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
       }
       reconciliationError = undefined;
     };
-    while (!signal.aborted) {
+    for (let attempt = 1; !signal.aborted; attempt += 1) {
       try {
         const observed = await observeWhileAttached(
           ctx.transport.lookupRun(botId, runId),
@@ -1024,8 +1035,16 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
         } Retrying…`;
         web.value.settingsError = reconciliationError;
       }
+      const delayMs = uncertainAdmissionDelayMsV1(attempt);
+      // The bound is spent. Asking again would only keep a placeholder
+      // spinning over a backend this tab cannot reach, so the caller settles
+      // the Turn and says so in the thread.
+      if (delayMs === undefined) {
+        clearReconciliationError();
+        web.value.activeRun = undefined;
+        return "unreachable";
+      }
       await waitForRunLookup(delayMs, signal);
-      delayMs = Math.min(delayMs * 2, 5_000);
     }
     return "detached";
   }
@@ -2534,14 +2553,39 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
           web.value.error = refusal;
           return { accepted: false, error: refusal };
         }
+        // Every other 4xx is a refusal too, and the answer already says why —
+        // a message over the size limit is answered 413 with the sentence the
+        // person needs. Only 5xx and a lost connection leave admission in
+        // doubt, so anything else here is settled: no optimistic bubbles, no
+        // "checking" placeholder, no reconciliation, and the composer gets the
+        // draft back rather than the thread pretending it was sent.
+        if (isCertainSendRefusalV1(error)) {
+          removeMessages(web.value.messages, pendingRunId);
+          const refusal =
+            error instanceof Error && error.message
+              ? error.message
+              : "That message didn't go through. Try sending it again.";
+          web.value.error = refusal;
+          return { accepted: false, error: refusal };
+        }
         const aborted =
           error instanceof DOMException && error.name === "AbortError";
+        // Strictly after the message it reports on. The thread orders by time,
+        // and the durable projection gives the user's line the run's later
+        // `admittedAt`, so a placeholder carrying the moment the send began
+        // sorted above the message it belongs to.
+        const placeholderAt = momentAfterV1(
+          web.value.messages.find(
+            (message) =>
+              message.runId === pendingRunId && message.role === "user",
+          )?.at ?? optimisticAt,
+        );
         replaceMessage(web.value.messages, pendingRunId, {
           id: `${pendingRunId}:assistant`,
           runId: pendingRunId,
           role: "assistant",
           text: "Checking whether your message went through…",
-          at: optimisticAt,
+          at: placeholderAt,
           status: "interrupted",
           tools: [],
           sends: [],
@@ -2554,7 +2598,8 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
         }
         const observer = new AbortController();
         admissionObserver = observer;
-        let disposition: "admitted" | "not-admitted" | "detached";
+        let disposition:
+          "admitted" | "not-admitted" | "detached" | "unreachable";
         try {
           disposition = await reconcileUncertainAdmission(
             botId,
@@ -2564,13 +2609,40 @@ export const shellClientPlugin: ClientPlugin = (ctx) => {
         } finally {
           if (admissionObserver === observer) admissionObserver = undefined;
         }
+        // The reconciliation ran out of attempts: this tab cannot reach the
+        // backend at all. That is the app's own failure and it says so, in
+        // place of the placeholder, with the Retry the person would otherwise
+        // have to improvise — and with the Turn no longer running, so Stop
+        // stops standing for a Turn nobody is executing.
+        if (disposition === "unreachable") {
+          replaceMessage(web.value.messages, pendingRunId, {
+            id: `${pendingRunId}:assistant`,
+            runId: pendingRunId,
+            role: "assistant",
+            text: UNREACHABLE_BOT_MESSAGE_V1,
+            at: placeholderAt,
+            status: "error",
+            retry: "resend",
+            tools: [],
+            sends: [],
+          });
+          // The bubble is the report, and it is the one carrying the Retry.
+          // Saying the same sentence again in the banner above it is what the
+          // thread already looked like when it was broken — the same string
+          // three times over — so the banner is cleared rather than set.
+          web.value.error = undefined;
+          web.value.activeRun = undefined;
+          web.value.activeRunId = undefined;
+          web.value.runningRunId = undefined;
+          return { accepted: false, error: UNREACHABLE_BOT_MESSAGE_V1 };
+        }
         if (disposition === "not-admitted") {
           replaceMessage(web.value.messages, pendingRunId, {
             id: `${pendingRunId}:assistant`,
             runId: pendingRunId,
             role: "assistant",
             text: "Your message didn't go through. Try sending it again.",
-            at: optimisticAt,
+            at: placeholderAt,
             status: "error",
             tools: [],
             sends: [],

package/src/client/styles.css

@@ -301,6 +301,28 @@
   font-size: var(--frock-text-xs);
 }
 
+/*
+ * The way back from an ending the thread cannot recover on its own: the client
+ * gave up reaching the Bot, and the draft it handed back is one click from
+ * being sent again.
+ */
+.message-retry {
+  align-self: flex-start;
+  margin-top: 4px;
+  padding: 4px 10px;
+  border: 1px solid var(--frock-danger-border);
+  border-radius: var(--frock-radius-control);
+  color: var(--frock-danger-text);
+  background: transparent;
+  font-size: var(--frock-text-xs);
+  cursor: pointer;
+}
+
+.message-retry:disabled {
+  opacity: 0.6;
+  cursor: default;
+}
+
 /*
  * An assistant Turn is its avatar and, beside it, one column holding
  * everything the Turn produced. The row has exactly two children: bubbles,
@@ -720,6 +742,18 @@
   gap: 6px;
 }
 
+/* Only ever on screen near the limit, so it sits under the text it counts. */
+.composer-counter {
+  margin: 0;
+  align-self: flex-end;
+  color: var(--frock-text-muted);
+  font-size: var(--frock-text-xs);
+}
+
+.composer-counter-over {
+  color: var(--frock-danger-text);
+}
+
 .skill-chips {
   display: flex;
   margin: 0;

package/src/client/turn-limits.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from "bun:test";
+import {
+  TURN_TEXT_COUNTER_FROM_V1,
+  TURN_TEXT_MAX_CHARACTERS_V1,
+  turnTextCounterVisibleV1,
+  turnTextRemainingV1,
+  turnTextTooLongV1,
+} from "./turn-limits.js";
+
+describe("the composer's copy of the send limit", () => {
+  test("mirrors the number the send route refuses on", () => {
+    // The gateway's `TURN_TEXT_MAX_CHARACTERS_V1`. Pinned here because the two
+    // are only equal by intent: the client cannot import the Worker's module.
+    expect(TURN_TEXT_MAX_CHARACTERS_V1).toBe(32_000);
+  });
+
+  test("is quiet until the budget is nearly spent", () => {
+    expect(turnTextCounterVisibleV1("a short message")).toBe(false);
+    expect(
+      turnTextCounterVisibleV1("x".repeat(TURN_TEXT_COUNTER_FROM_V1)),
+    ).toBe(true);
+  });
+
+  test("counts down, then counts the overflow", () => {
+    expect(turnTextRemainingV1("x".repeat(TURN_TEXT_MAX_CHARACTERS_V1))).toBe(
+      0,
+    );
+    expect(
+      turnTextRemainingV1("x".repeat(TURN_TEXT_MAX_CHARACTERS_V1 + 5)),
+    ).toBe(-5);
+  });
+
+  test("refuses only past the limit, never at it", () => {
+    expect(turnTextTooLongV1("x".repeat(TURN_TEXT_MAX_CHARACTERS_V1))).toBe(
+      false,
+    );
+    expect(turnTextTooLongV1("x".repeat(TURN_TEXT_MAX_CHARACTERS_V1 + 1))).toBe(
+      true,
+    );
+  });
+});

package/src/client/turn-limits.ts

@@ -0,0 +1,40 @@
+/**
+ * The composer's copy of the send route's size rule.
+ *
+ * The gateway refuses an oversized Turn with 413 before it ever reaches a Bot
+ * (`TURN_TEXT_MAX_CHARACTERS_V1` in the Cloudflare application's
+ * `request-body.ts`). A refusal the person could have seen coming is a bad
+ * refusal, so the composer enforces the same number: it counts down as the
+ * limit comes into reach and refuses to send past it, and the server's rule
+ * stays the authority for anything that reaches it another way.
+ *
+ * One constant rather than a literal at each use, because a limit written
+ * twice is a limit that drifts.
+ */
+export const TURN_TEXT_MAX_CHARACTERS_V1 = 32_000;
+
+/**
+ * Where the counter appears.
+ *
+ * A character count beside a half-written sentence is noise; it is only news
+ * as the budget runs out. The last tenth is where a person can still act on
+ * it — trim a paragraph, split the message — before the send button closes.
+ */
+export const TURN_TEXT_COUNTER_FROM_V1 = Math.floor(
+  TURN_TEXT_MAX_CHARACTERS_V1 * 0.9,
+);
+
+/** How much of the budget is left; negative once the draft is over it. */
+export function turnTextRemainingV1(text: string): number {
+  return TURN_TEXT_MAX_CHARACTERS_V1 - text.length;
+}
+
+/** True once the draft is longer than the send route would accept. */
+export function turnTextTooLongV1(text: string): boolean {
+  return turnTextRemainingV1(text) < 0;
+}
+
+/** True once the count is worth showing. */
+export function turnTextCounterVisibleV1(text: string): boolean {
+  return text.length >= TURN_TEXT_COUNTER_FROM_V1;
+}

package/src/client/uncertain-admission.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "bun:test";
+import {
+  isCertainSendRefusalV1,
+  momentAfterV1,
+  uncertainAdmissionDelayMsV1,
+  UNCERTAIN_ADMISSION_MAX_ATTEMPTS_V1,
+  UNREACHABLE_BOT_MESSAGE_V1,
+} from "./uncertain-admission.js";
+
+describe("telling a refusal from a doubt", () => {
+  test("a 4xx is certain and a 5xx is not", () => {
+    const refused = Object.assign(new Error("Your message is too long."), {
+      status: 413,
+    });
+    const failed = Object.assign(new Error("Agent request failed"), {
+      status: 500,
+    });
+    expect(isCertainSendRefusalV1(refused)).toBe(true);
+    expect(isCertainSendRefusalV1(failed)).toBe(false);
+  });
+
+  test("an error with no status is a doubt", () => {
+    // What a dropped connection throws: no answer was read, so nothing about
+    // the send is settled.
+    expect(isCertainSendRefusalV1(new TypeError("Failed to fetch"))).toBe(
+      false,
+    );
+    expect(isCertainSendRefusalV1(undefined)).toBe(false);
+    expect(isCertainSendRefusalV1({ status: "413" })).toBe(false);
+  });
+});
+
+describe("the admission retry bound", () => {
+  test("backs off and then stops asking", () => {
+    const delays = Array.from(
+      { length: UNCERTAIN_ADMISSION_MAX_ATTEMPTS_V1 },
+      (_unused, index) => uncertainAdmissionDelayMsV1(index + 1),
+    );
+    // Five waits between six attempts, doubling; the sixth attempt is the last
+    // one, so it is followed by no wait at all.
+    expect(delays).toEqual([250, 500, 1_000, 2_000, 4_000, undefined]);
+  });
+
+  test("never waits past the ceiling", () => {
+    expect(uncertainAdmissionDelayMsV1(1)).toBe(250);
+    for (let attempt = 1; attempt <= 20; attempt += 1) {
+      const delay = uncertainAdmissionDelayMsV1(attempt);
+      if (delay === undefined) continue;
+      expect(delay).toBeLessThanOrEqual(5_000);
+    }
+  });
+
+  test("the terminal copy names the app's own failure", () => {
+    expect(UNREACHABLE_BOT_MESSAGE_V1).toContain("Couldn't reach the Bot");
+  });
+});
+
+describe("placing a line after the one it reports on", () => {
+  test("is strictly later, and stays sortable as a string", () => {
+    const at = "2026-09-01T00:01:00.000Z";
+    const after = momentAfterV1(at);
+    expect(after > at).toBe(true);
+    expect(after).toBe("2026-09-01T00:01:00.001Z");
+  });
+
+  test("leaves a timestamp it cannot read alone", () => {
+    expect(momentAfterV1("not a time")).toBe("not a time");
+  });
+});

package/src/client/uncertain-admission.ts

@@ -0,0 +1,78 @@
+/**
+ * What a send means when the answer was not a Turn.
+ *
+ * There are two of those and they are not alike. A 4xx is the server having
+ * read the request and decided against it: the Turn does not exist, will not
+ * exist, and the answer says why. Everything else — a 5xx, a socket that
+ * closed, a browser that lost the network — leaves admission genuinely
+ * unknown, and only that case is worth reconciling.
+ *
+ * Telling them apart is the whole point. Treating a 413 as unknown drew the
+ * person's oversized draft into the thread as though it had been sent, then
+ * polled for a run that was never admitted.
+ */
+
+/**
+ * True when the transport's error carries a 4xx: a refusal, not a doubt.
+ *
+ * Duck-typed on `status` rather than on an error class, because the transport
+ * is an interface with more than one implementation and a plain `Error` with a
+ * status is all any of them can be relied on to throw.
+ */
+export function isCertainSendRefusalV1(error: unknown): boolean {
+  if (typeof error !== "object" || error === null) return false;
+  if (!("status" in error)) return false;
+  const status = error.status;
+  return typeof status === "number" && status >= 400 && status < 500;
+}
+
+/**
+ * How many times admission reconciliation asks before it stops asking.
+ *
+ * A bound rather than an ever-retrying loop: a backend the tab cannot reach
+ * does not become reachable by being asked a thousand times, and the person
+ * watching a placeholder deserves an answer inside a few seconds. Six attempts
+ * over the schedule below spans roughly eight seconds, which covers a Worker
+ * cold start and a brief network blip without outliving anybody's patience.
+ */
+export const UNCERTAIN_ADMISSION_MAX_ATTEMPTS_V1 = 6;
+
+const FIRST_DELAY_MS_V1 = 250;
+const MAX_DELAY_MS_V1 = 5_000;
+
+/**
+ * How long to wait before attempt `attempt + 1`, or `undefined` once the bound
+ * is spent and the client should settle instead of asking again.
+ */
+export function uncertainAdmissionDelayMsV1(
+  attempt: number,
+): number | undefined {
+  if (attempt >= UNCERTAIN_ADMISSION_MAX_ATTEMPTS_V1) return undefined;
+  return Math.min(FIRST_DELAY_MS_V1 * 2 ** (attempt - 1), MAX_DELAY_MS_V1);
+}
+
+/**
+ * What the thread says when the client gave up reaching the backend.
+ *
+ * Naming the app's own failure, because nothing else in the product did: every
+ * other line blames the message or the Bot, and a person whose wifi dropped
+ * was told their message "didn't go through" as though the Bot had refused it.
+ */
+export const UNREACHABLE_BOT_MESSAGE_V1 =
+  "Couldn't reach the Bot. Check your connection and try again.";
+
+/**
+ * A timestamp one millisecond after `at`.
+ *
+ * The thread sorts by time, so a line that belongs under another needs a time
+ * of its own: the placeholder used to carry the moment the send *began*, which
+ * put it above the message it was reporting on the instant the durable
+ * projection gave that message its later `admittedAt`.
+ */
+export function momentAfterV1(at: string): string {
+  const moment = new Date(at).getTime();
+  // An unparsable timestamp is not worth inventing an order for; the thread's
+  // insertion order still holds the line where it was put.
+  if (!Number.isFinite(moment)) return at;
+  return new Date(moment + 1).toISOString();
+}