//! One place decides how a wall-clock instant is written into a prompt.
//!
//! The rendered form is part of the request bytes: two renderers that disagree by a format
//! string would make the same observation two different prefixes. An instant the host cannot
//! name is not rendered as a time at all - epoch zero as `1970-01-01T00:00:00Z` would be a claim
//! about when something happened, which is the one thing a stamp exists to state.

/// An instant as it reaches the model: UTC, second precision, `Z`.
#[must_use]
pub fn format_instant(ms: i64) -> String {
    if ms <= 0 {
        return "time unknown".into();
    }
    match chrono::DateTime::from_timestamp_millis(ms) {
        Some(stamp) => stamp.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
        None => "time unknown".into(),
    }
}