@k2b/cloud 0.40.0 → 0.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -67,10 +67,12 @@
     "./ai": "./src/ai/index.ts",
     "./ai/admin": "./src/ai/admin.ts",
     "./ai/browser": "./src/ai/browser.ts",
+    "./ai/question-text": "./src/ai/question-text.ts",
     "./ai/live": "./src/ai/live.ts",
     "./ai/live-events": "./src/ai/live-events.ts",
     "./ai/runtime": "./src/ai/runtime.ts",
     "./ai/solid": "./src/ai/solid.ts",
+    "./ai/testing": "./src/ai/testing.ts",
     "./ai/tools": "./src/ai/runtime-tools.ts",
     "./ai/ui": "./src/ai/ui.tsx",
     "./account/ui": "./src/account/ui.ts",
@@ -112,8 +114,8 @@
     "@tabler/icons": "3.48.0",
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.18.0",
-    "@k2b/ssr": "0.18.0",
-    "@k2b/ui": "0.30.0",
+    "@k2b/ssr": "0.19.0",
+    "@k2b/ui": "0.31.0",
     "@k2b/stdlib": "0.30.0",
     "@k2b/sync": "7.0.0",
     "@nats-io/jetstream": "3.4.0",
@@ -121,6 +123,7 @@
     "@modelcontextprotocol/sdk": "1.32.1",
     "bun-plugin-tailwind": "0.1.2",
     "hono-openapi": "1.3.3",
+    "entities": "8.0.0",
     "htmlparser2": "12.0.0",
     "jose": "6.2.12",
     "katex": "0.18.9",

package/src/_internal/capability-sentences.ts

@@ -465,7 +465,8 @@ const slotText = (slot: CapabilitySlot, context: CapabilitySlotSentenceContext,
     }
     case "person": {
       const total = slot.total ?? slot.people.length;
-      if (mode === "button") return total === 1 ? (slot.people[0]!.name ?? slot.people[0]!.address ?? "") : t.people({ count: total });
+      if (mode === "button")
+        return total === 1 ? plain(slot.people[0]!.name ?? slot.people[0]!.address ?? "", 24, "middle") : t.people({ count: total });
       const shown = mode === "full" ? slot.people : slot.people.slice(0, 3);
       const list = shown.map((person) =>
         mode === "chip" ? plain(person.name ?? person.address ?? "", 40, "middle") : capabilityPersonText(person),

package/src/_internal/define-app.ts

@@ -84,15 +84,16 @@ import { appRuntimeMetadata, buildMetadata } from "./build-metadata";
 import { compileCapabilities, invokeCompiledCapability, reviewCompiledCapability, serializeCapabilityProviderResult } from "./capabilities";
 import { cliPluginRoutePrefixes, createCliPluginRoutes, validateAppCliModules } from "./cli-plugins";
 import { FONT_PRELOAD_LINKS } from "./font-preloads";
-import { createHeartbeat } from "./heartbeat";
+import { createHeartbeat, createRegistryMembership } from "./heartbeat";
 import { compileHelp } from "./help";
 import { createPageResponses } from "./page-responses";
 import { configurePostgresApplicationName } from "./postgres-application-name";
 import { getProcessSync, startProcessSync } from "./process-sync";
 import { APP_READINESS_PATH, appReadinessResponse } from "./readiness";
-import { appRegistry, type CapabilityRegistryRecord, capabilityRegistry } from "./registry";
+import { appInstanceRegistry, appMembershipLock, appRegistry, type CapabilityRegistryRecord, capabilityRegistry } from "./registry";
 import { canonicalRoute, isOwnAppPath } from "./registry-validation";
 import { ensureRuntimeWatcher, getCurrentRuntime, registeredCoreRelease, stopRuntimeWatcher } from "./runtime-watcher";
+import { runSetupExclusively } from "./setup-lock";
 import { publicFileVersion, servePublicAsset, sharedStylesheetVersion, versionedPublicHref } from "./static-assets";
 import { createStatusPreservingSsrHandler } from "./status-preserving-ssr";
 import { WEB_VITALS_ASSET_HREF } from "./web-vitals-asset";
@@ -686,9 +687,16 @@ export const defineApp = <
         cliModules: cliModules.length > 0 ? cliModules : undefined,
       };
 
+      // Both shared entries follow one process membership; creating it touches no Sync resources.
+      const membership = createRegistryMembership(meta.id, {
+        registry: appInstanceRegistry,
+        lock: appMembershipLock,
+        startedAt: entry.startedAt,
+      });
       // Heartbeat
       const heartbeat = createHeartbeat(meta.id, entry, {
         registry: appRegistry(),
+        membership,
         beforeWrite: async () => {
           if (compiledHelp) await registerHelp(compiledHelp.corpus);
           if (appSkills && skillsManifestHash) await registerAppSkills(meta.id, appSkills, skillsManifestHash);
@@ -717,6 +725,7 @@ export const defineApp = <
         ? createHeartbeat(meta.id, capabilityEntry, {
             key: `capabilities/${meta.id}`,
             registry: capabilityRegistry(),
+            membership,
             onError: (error) =>
               log.error("Capability registry heartbeat failed", {
                 appId: meta.id,
@@ -997,7 +1006,8 @@ export const defineApp = <
 
       if (!startOpts.skipSetup && startOpts.lifecycle?.setup) {
         log.info(`Setup: ${meta.id}`);
-        await startOpts.lifecycle.setup(cloudCtx);
+        const setup = startOpts.lifecycle.setup;
+        await runSetupExclusively(meta.id, () => setup(cloudCtx));
       }
       if (meta.id === "core") await startOutbox();
 

package/src/_internal/heartbeat.ts

@@ -1,6 +1,8 @@
 /** Keep an app discoverable even when the ephemeral registry is recreated. */
 
-import { APP_REGISTRY_TTL_MS } from "./registry";
+import { createHash, randomBytes } from "node:crypto";
+import { hostname } from "node:os";
+import { APP_REGISTRY_TTL_MS, type AppInstanceRecord, appInstancePrefix } from "./registry";
 
 const HEARTBEAT_INTERVAL_MS = 60_000;
 const HEARTBEAT_WRITE_TIMEOUT_MS = 10_000;
@@ -15,8 +17,171 @@ type HeartbeatRegistry<T> = {
   delete: (input: { key: string }) => Promise<unknown>;
 };
 
+type SnapshotRegistry<T> = {
+  snapshot: (input: { prefix: string }) => Promise<{ entries: { key: string; value: T }[] }>;
+};
+
+type MembershipRegistry = HeartbeatRegistry<AppInstanceRecord> & SnapshotRegistry<AppInstanceRecord>;
+
+type SharedEntry = {
+  read: () => Promise<{ value: unknown } | undefined>;
+  write: () => Promise<unknown>;
+  remove: () => Promise<unknown>;
+  prepare: (() => Promise<void>) | undefined;
+};
+
+const entryDigest = (value: unknown): string => createHash("sha256").update(JSON.stringify(value)).digest("base64url");
+
+type MembershipLock = {
+  withLock: <T>(
+    input: { resource: string; ttlMs?: number; signal?: AbortSignal },
+    fn: (lock: { expiresAt: Date }) => Promise<T>,
+  ) => Promise<T | null>;
+};
+
+/** One process membership shared by its app and capability heartbeats. Getters stay lazy until use. */
+export const createRegistryMembership = (
+  appId: string,
+  options: {
+    registry: () => MembershipRegistry;
+    lock: () => MembershipLock;
+    instanceId?: string;
+    hostname?: string;
+    startedAt?: number;
+    writeTimeoutMs?: number;
+  },
+) => {
+  const instanceId = options.instanceId ?? randomBytes(12).toString("base64url");
+  const prefix = appInstancePrefix(appId);
+  const key = `${prefix}${instanceId}`;
+  const value: AppInstanceRecord = {
+    appId,
+    instanceId,
+    hostname: options.hostname ?? hostname(),
+    startedAt: options.startedAt ?? Date.now(),
+    entries: {},
+  };
+  const writeTimeoutMs = options.writeTimeoutMs ?? HEARTBEAT_WRITE_TIMEOUT_MS;
+  if (!Number.isFinite(writeTimeoutMs) || writeTimeoutMs <= 0) throw new RangeError("Membership write timeout must be positive and finite");
+  let left = false;
+  const sharedEntries = new Map<string, SharedEntry>();
+
+  // Prepare idempotent dependent data outside the lock to preserve its bounded lease.
+  const prepareShared = async (sharedKey: string): Promise<void> => {
+    for (const [key, { prepare }] of sharedEntries) {
+      if (key !== sharedKey) await prepare?.();
+    }
+  };
+
+  const locked = async (write: (lock: { expiresAt: Date }) => Promise<void>): Promise<void> => {
+    const result = await options
+      .lock()
+      .withLock({ resource: appId, ttlMs: writeTimeoutMs, signal: AbortSignal.timeout(writeTimeoutMs) }, async (lock) => {
+        await write(lock);
+        return true;
+      });
+    if (result === null) throw new Error(`Registry membership lock unavailable for app ${appId}`);
+  };
+  const upsert = () => options.registry().upsert({ key, value });
+  const publishShared = async (): Promise<void> => {
+    if (left) return;
+    await upsert();
+    // Never mix entries from different processes: the capability catalog rejects mismatched manifests.
+    for (const { write } of sharedEntries.values()) {
+      if (left) return;
+      await write();
+    }
+  };
+
+  return {
+    join: async (sharedKey: string, sharedValue: unknown, entry: SharedEntry): Promise<void> => {
+      left = false;
+      await prepareShared(sharedKey);
+      await locked(async () => {
+        value.entries[sharedKey] = entryDigest(sharedValue);
+        sharedEntries.set(sharedKey, entry);
+        await publishShared();
+      });
+    },
+    publish: async (sharedKey: string): Promise<void> => {
+      if (left) return;
+      await prepareShared(sharedKey);
+      await locked(async () => {
+        if (left) return;
+        await publishShared();
+      });
+    },
+    adopt: async (sharedKey: string): Promise<void> => {
+      if (left) return;
+      // A live process started after this one covers stored state when all read keys it declares match.
+      // Ignore keys it never registered, but heal split pairs when both keys are declared.
+      // Start order is total (instance id breaks ties), so two live replicas never take turns.
+      const startedLater = (other: AppInstanceRecord): boolean =>
+        other.startedAt > value.startedAt || (other.startedAt === value.startedAt && other.instanceId > value.instanceId);
+      const needsRepublish = async (): Promise<boolean> => {
+        const stored = await Promise.all(
+          [...sharedEntries].map(async ([key, { read }]) => {
+            const entry = await read();
+            return { key, digest: entry ? entryDigest(entry.value) : undefined };
+          }),
+        );
+        if (stored.some(({ digest }) => digest === undefined)) return false;
+        if (stored.every(({ key, digest }) => digest === value.entries[key])) return false;
+        const snapshot = await options.registry().snapshot({ prefix });
+        return !snapshot.entries.some(
+          ({ value }) =>
+            startedLater(value) &&
+            stored.some(({ key }) => key in value.entries) &&
+            stored.every(({ key, digest }) => !(key in value.entries) || value.entries[key] === digest),
+        );
+      };
+      if (!(await needsRepublish())) return;
+      await prepareShared(sharedKey);
+      await locked(async (lock) => {
+        if (left) return;
+        const stillNeedsRepublish = await needsRepublish();
+        if (left || !stillNeedsRepublish) return;
+        if (Date.now() > lock.expiresAt.getTime() - writeTimeoutMs / 2) {
+          throw new Error("membership lease expired during adoption; shared entry left to its TTL");
+        }
+        await publishShared();
+      });
+    },
+    renew: async (): Promise<void> => {
+      if (left) return;
+      if (!(await options.registry().touch({ key }))) {
+        await locked(async () => {
+          if (!left) await upsert();
+        });
+      }
+    },
+    leave: async (): Promise<void> => {
+      left = true;
+      // A failed delete must never lead to shared removal: leave routing to its TTL.
+      // Repeat the delete even after leaving, to remove a late registration write.
+      await options.registry().delete({ key });
+      await locked(async (lock) => {
+        const snapshot = await options.registry().snapshot({ prefix });
+        // Ephemeral has no conditional delete, so the remaining lease bounds the removal window.
+        // A delete that NATS applies only after the lease expired can still remove a newer
+        // replica's entry; that replica restores it on its next refresh (at most 60 s).
+        if (Date.now() > lock.expiresAt.getTime() - writeTimeoutMs / 2) {
+          throw new Error("membership lease expired during stop; shared entry left to its TTL");
+        }
+        if (!snapshot.entries.some((entry) => entry.key !== key)) {
+          for (const { remove } of sharedEntries.values()) {
+            if (Date.now() > lock.expiresAt.getTime() - writeTimeoutMs / 2) {
+              throw new Error("membership lease expired during stop; shared entry left to its TTL");
+            }
+            await remove();
+          }
+        }
+      });
+    },
+  };
+};
+
 type HeartbeatOptions<T> = {
-  registry: HeartbeatRegistry<T>;
   key?: string;
   /** Publish dependent data before advertising or renewing the app. */
   beforeWrite?: () => Promise<void>;
@@ -26,7 +191,10 @@ type HeartbeatOptions<T> = {
   writeTimeoutMs?: number;
   onError?: (error: unknown) => void;
   onStale?: (error: unknown) => void;
-};
+} & (
+  | { registry: HeartbeatRegistry<T>; membership?: undefined }
+  | { registry: HeartbeatRegistry<T> & SnapshotRegistry<T>; membership: ReturnType<typeof createRegistryMembership> }
+);
 
 export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOptions<T>) => {
   const intervalMs = options.intervalMs ?? HEARTBEAT_INTERVAL_MS;
@@ -44,6 +212,7 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
   let timer: Timer | null = null;
   let inFlight: Promise<void> | null = null;
   let running = false;
+  let needsMembershipCleanup = false;
   let lastSuccessAt = 0;
   let staleReported = false;
   const key = options.key ?? `apps/${appId}`;
@@ -54,31 +223,49 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
     staleReported = false;
   };
 
+  const remove = () => (options.membership ? options.membership.leave() : registry.delete({ key }));
+  const upsert = () => registry.upsert({ key, value: entry });
+
   const register = async (): Promise<void> => {
     await options.beforeWrite?.();
-    await registry.upsert({ key, value: entry });
+    if (options.membership) {
+      const registry = options.registry;
+      await options.membership.join(key, entry, {
+        read: async () => (await registry.snapshot({ prefix: key })).entries.find((candidate) => candidate.key === key),
+        write: upsert,
+        remove: () => registry.delete({ key }),
+        prepare: options.beforeWrite,
+      });
+    } else await upsert();
     noteSuccess();
   };
 
   const refresh = async (): Promise<void> => {
     // Touch renews the existing entry (and emits a registry invalidation).
     // Avoid rebuilding the manifest here. A missing entry is repaired
-    // immediately, preserving restart-free registry recovery.
+    // immediately, preserving restart-free registry recovery. The newest live
+    // publisher wins; an entry whose publisher left is replaced by this one.
     await options.beforeWrite?.();
+    await options.membership?.renew();
     const touched = await registry.touch({ key });
-    if (!touched) await registry.upsert({ key, value: entry });
+    if (!touched) {
+      if (options.membership) await options.membership.publish(key);
+      else await upsert();
+    } else if (options.membership) {
+      await options.membership.adopt(key);
+    }
     noteSuccess();
   };
 
   const writeWithTimeout = async (write: Promise<void>): Promise<void> => {
     let timer: Timer | null = null;
     let timedOut = false;
-    void write
-      .then(async () => {
-        // A write that completed after its timeout must not resurrect a stopped app.
-        if (timedOut && !running) await registry.delete({ key }).catch(() => false);
-      })
-      .catch(() => undefined);
+    // A write that settled after its timeout must not resurrect a stopped app. A failed
+    // operation may still have landed earlier steps, such as the liveness key.
+    const removeLateWrite = async () => {
+      if (timedOut && !running) await remove().catch(() => false);
+    };
+    void write.then(removeLateWrite, removeLateWrite).catch(() => undefined);
     try {
       await Promise.race([
         write,
@@ -140,6 +327,7 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
         return;
       }
       running = true;
+      needsMembershipCleanup = options.membership !== undefined;
       const operation = writeWithTimeout(register());
       inFlight = operation;
       try {
@@ -153,7 +341,7 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
       schedule(intervalMs);
     },
     stop: async () => {
-      if (!running) return;
+      if (!running && !needsMembershipCleanup) return;
       running = false;
       if (timer) clearTimeout(timer);
       timer = null;
@@ -165,7 +353,8 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
         // still required so a stopped app cannot remain discoverable.
       }
       inFlight = null;
-      await registry.delete({ key });
+      await remove();
+      needsMembershipCleanup = false;
     },
   };
 };

package/src/_internal/registry.ts

@@ -1,4 +1,5 @@
-import type { EphemeralConfig } from "@k2b/sync";
+import { createHash } from "node:crypto";
+import type { EphemeralConfig, MutexConfig } from "@k2b/sync";
 import type { AppAppearanceColor } from "../contracts/app";
 import type { CapabilityManifest, CapabilityPresentationCatalog } from "../contracts/capabilities";
 import { fileProviderIssues } from "../contracts/file-provider";
@@ -45,6 +46,32 @@ export const CAPABILITY_REGISTRY_CONFIG = {
 } as const satisfies EphemeralConfig;
 
 export const APP_REGISTRY_PREFIX = "apps/";
+export const APP_INSTANCE_PREFIX = "instances/";
+
+// Fit Sync's 96-byte name limit for every app id that fits apps/<id>; appId stays in the record value.
+export const appInstancePrefix = (appId: string): string => {
+  const segment = createHash("sha256").update(appId).digest("base64url").slice(0, 16);
+  return `${APP_INSTANCE_PREFIX}${segment}/`;
+};
+
+export type AppInstanceRecord = {
+  appId: string;
+  instanceId: string;
+  hostname: string;
+  startedAt: number;
+  entries: Record<string, string>;
+};
+
+// The id and owner are a cross-version contract: all replicas must use the same lock.
+// TTL and retry are local budgets; Sync's drift identity is [id, owner, replicas].
+export const APP_MEMBERSHIP_LOCK_CONFIG = {
+  id: "cloud-app-membership",
+  owner: REGISTRY_OWNER,
+  retry: { delayMs: 200, maxAttempts: 50 },
+} as const satisfies MutexConfig;
+
+export const appInstanceRegistry = lazySync((sync) => sync.ephemeral<AppInstanceRecord>(APP_REGISTRY_CONFIG));
+export const appMembershipLock = lazySync((sync) => sync.mutex(APP_MEMBERSHIP_LOCK_CONFIG));
 
 export type CapabilityRegistryRecord = { appId: string; manifest: CapabilityManifest; presentation?: CapabilityPresentationCatalog };
 

package/src/_internal/setup-lock.ts

@@ -0,0 +1,103 @@
+import type { Mutex } from "@k2b/sync";
+import { expBackoff } from "@k2b/sync/retry";
+import { logger } from "../services/logging";
+import { lazySync, waitForNats } from "./process-sync";
+
+const SETUP_LEASE_MS = 60_000;
+const setupMutex = lazySync((sync) => sync.mutex({ id: "app-setup", owner: "cloud", ttlMs: SETUP_LEASE_MS, retry: { maxAttempts: 1 } }));
+
+const scheduleRenewal = (renew: () => Promise<void> | undefined, intervalMs: number): (() => void) => {
+  const timer = setInterval(() => void renew(), intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+};
+
+/** Internal seam for testing lease timing without NATS or wall-clock waits. */
+export const runExclusive = async ({
+  mutex,
+  resource,
+  run,
+  leaseMs = SETUP_LEASE_MS,
+  sleep = Bun.sleep,
+  now = Date.now,
+  schedule = scheduleRenewal,
+  log = logger("setup"),
+}: {
+  mutex: Pick<Mutex, "ready" | "acquire" | "extend" | "release">;
+  resource: string;
+  run: () => Promise<void>;
+  leaseMs?: number;
+  sleep?: (ms: number) => Promise<unknown>;
+  now?: () => number;
+  schedule?: typeof scheduleRenewal;
+  log?: Pick<ReturnType<typeof logger>, "info" | "warn" | "error">;
+}): Promise<void> => {
+  const startedAt = now();
+  const nats = { application: resource };
+  await waitForNats(() => mutex.ready(), nats);
+  let lastWaitLog = Number.NEGATIVE_INFINITY;
+  let attempt = 1;
+  let lock = await waitForNats(() => mutex.acquire({ resource }), nats);
+  while (!lock) {
+    if (now() - lastWaitLog >= 30_000) {
+      lastWaitLog = now();
+      log.info("waiting for setup on another replica", { appId: resource, waitedMs: now() - startedAt });
+    }
+    await sleep(Math.min(2_000, expBackoff(attempt++, { baseMs: 250, maxMs: 2_000, jitter: 0.2 })));
+    lock = await waitForNats(() => mutex.acquire({ resource }), nats);
+  }
+
+  const lease = lock;
+  let lost = false;
+  let running = true;
+  let confirmedExpiresAt = lease.expiresAt.getTime();
+  let renewing: Promise<void> | undefined;
+  const checkExpiry = () => {
+    if (running && now() >= confirmedExpiresAt) lost = true;
+  };
+  const cancelRenewal = schedule(() => {
+    // Check even when an earlier extend is still in flight or the event loop was delayed.
+    checkExpiry();
+    if (renewing || lost) return;
+    renewing = (async () => {
+      try {
+        const extended = await mutex.extend(lease);
+        // extend mutates the handle; check the previous confirmed expiry first.
+        checkExpiry();
+        if (extended) confirmedExpiresAt = lease.expiresAt.getTime();
+        else lost = true;
+      } catch (error) {
+        log.warn("setup lease renewal failed", { appId: resource, error });
+        checkExpiry();
+      }
+    })().finally(() => {
+      renewing = undefined;
+    });
+    return renewing;
+  }, leaseMs / 3);
+
+  try {
+    try {
+      await run();
+    } finally {
+      checkExpiry();
+      running = false;
+      cancelRenewal();
+      // Do not race a release against an unfinished renewal.
+      await renewing;
+      if (lost) {
+        log.error("setup lease lost; another replica may have run setup concurrently; restarting so setup reruns", { appId: resource });
+      }
+    }
+    if (lost) throw new Error(`Setup lease lost for application "${resource}"`);
+  } finally {
+    try {
+      if (!(await mutex.release(lease))) log.warn("setup lease release failed; it will expire", { appId: resource });
+    } catch (error) {
+      log.warn("setup lease release failed; it will expire", { appId: resource, error });
+    }
+  }
+};
+
+export const runSetupExclusively = (appId: string, setup: () => Promise<void>): Promise<void> =>
+  runExclusive({ mutex: setupMutex(), resource: appId, run: setup });

package/src/ai/chat/action-card.ts

@@ -1,10 +1,12 @@
 import {
   type CapabilitySentencePart,
   capabilityAskReasonText,
+  capabilityPersonText,
   capabilityQuestionText,
   capabilityReceiptParts,
   capabilityReviewSentence,
   capabilityReviewSentenceParts,
+  capabilitySentenceParts,
   capabilitySentenceText,
 } from "../../_internal/capability-sentences";
 import type {
@@ -55,11 +57,13 @@ export type ActionPreviewModel =
       locale: string;
       timeZone: string;
       preview?: CapabilityPreview;
-      consequences: { text: ActionText; mark?: "added" | "removed" }[];
+      /** Original slots for plain rule sentences, retaining people’s addresses. */
+      slots?: CapabilityActionCallReview["slots"];
+      consequences: { text: ActionText; plain: string; mark?: "added" | "removed" }[];
       /** The rule sentence of a `rule` preview, with its chips. */
       when?: ActionText;
       /** Each `may` line of a `rule` preview. */
-      may?: { text: ActionText; mark?: "added" | "removed" }[];
+      may?: { text: ActionText; plain: string; mark?: "added" | "removed" }[];
     }
   | { kind: "legacy"; rows: AiLegacyReviewRow[]; markdown?: string; input?: unknown };
 
@@ -96,6 +100,16 @@ export type ActionCard = {
   hasCheck: boolean;
   /** The receipt text of an old review's success summary. */
   summary?: string;
+  /**
+   * For plain text: every value a new review's slots stand for (each person with address, title, text, time, count),
+   * also in consequences and rule lines, and whether the app left people out. Plain text that does not show each value
+   * whole is incomplete.
+   */
+  slotValues?: {
+    values: string[];
+    times: { text: string; start: string; end?: string; format: "date" | "date-time" }[];
+    unlisted: boolean;
+  };
 };
 
 const REASON_LOOK: Record<CapabilityAskReason, Omit<ActionReason, "code" | "text">> = {
@@ -174,6 +188,19 @@ export const actionPlainText = (text: ActionText): string =>
     })
     .join("");
 
+/** The short template, else the action sentence, read as the card's chips without person addresses or title quotes. */
+export const reviewShortText = (review: CapabilityActionCallReview, context: ActionCardContext): string =>
+  actionPlainText(
+    partsText(
+      capabilitySentenceParts(review.sentence.short ?? review.sentence.action, review.slots, {
+        locale: review.locale,
+        timeZone: context.timeZone,
+      }),
+      review.locale,
+      context.app,
+    ),
+  );
+
 const firstLink = (links: readonly CapabilitySemanticLink[] | undefined, rels: CapabilitySemanticLink["rel"][]) =>
   rels.map((rel) => links?.find((link) => link.rel === rel)?.href).find(Boolean);
 
@@ -192,6 +219,34 @@ const firstObjectHref = (review: CapabilityActionCallReview): string | undefined
     .map((slot) => ((slot.kind === "object" || slot.kind === "place") && slot.ref ? cloudResourceHref(slot.ref) : undefined))
     .find(Boolean);
 
+const slotValues = (slots: CapabilitySlot[], context: { locale: string; timeZone: string }) => ({
+  values: slots.flatMap((slot) =>
+    slot.kind === "person"
+      ? slot.people.map(capabilityPersonText)
+      : slot.kind === "object" || slot.kind === "place"
+        ? [slot.title]
+        : slot.kind === "text"
+          ? [slot.value]
+          : slot.kind === "count"
+            ? [capabilitySentenceText("{value}", { value: slot }, context)]
+            : [],
+  ),
+  // A time is shown whole as its words, or as typed rows that hold its start and end with at least its precision.
+  times: slots.flatMap((slot) =>
+    slot.kind === "time"
+      ? [
+          {
+            text: capabilitySentenceText("{value}", { value: slot }, context),
+            start: slot.start,
+            ...(slot.end ? { end: slot.end } : {}),
+            format: slot.format,
+          },
+        ]
+      : [],
+  ),
+  unlisted: slots.some((slot) => slot.kind === "person" && (slot.total ?? slot.people.length) > slot.people.length),
+});
+
 export const reviewActionCard = (review: CapabilityActionCallReview, context: ActionCardContext): ActionCard => {
   const locale = review.locale;
   const tz = { timeZone: context.timeZone };
@@ -206,6 +261,7 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
     );
   const consequence = (entry: CapabilityConsequence) => ({
     text: sentence(entry.text, entry.slots),
+    plain: capabilitySentenceText(entry.text, entry.slots ?? review.slots, { locale, timeZone: context.timeZone }),
     ...(entry.mark ? { mark: entry.mark } : {}),
   });
   const code = review.ask ?? "app_asks";
@@ -224,6 +280,7 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
             locale,
             timeZone: context.timeZone,
             ...(preview ? { preview } : {}),
+            slots: review.slots,
             consequences: (review.consequences ?? []).map(consequence),
             ...(preview?.kind === "rule"
               ? { when: sentence(preview.when.text, preview.when.slots), may: preview.may.map(consequence) }
@@ -255,6 +312,14 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
       : plainText(context.app.name),
     short: capabilityReviewSentence(review, "short", tz),
     hasCheck: Boolean(review.check),
+    slotValues: slotValues(
+      [
+        review.slots,
+        ...(review.consequences ?? []).map((entry) => entry.slots ?? {}),
+        ...(preview?.kind === "rule" ? [preview.when.slots ?? {}, ...preview.may.map((entry) => entry.slots ?? {})] : []),
+      ].flatMap((slots) => Object.values(slots)),
+      { locale, timeZone: context.timeZone },
+    ),
   };
 };
 
@@ -340,7 +405,8 @@ const messageRows = (block: ToolBlock): AiLegacyReviewRow[] => {
   for (const line of message.split("\n").map((entry) => entry.trim())) {
     if (!line || /^Review the validated arguments below before running this action\.$/i.test(line)) continue;
     const heading = /^([^:]{1,40}):$/.exec(line);
-    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
+    // The value starts at its first visible character, so the pattern never backtracks over the white space before it.
+    const match = /^([^:]{1,40}):\s+(\S.*)$/.exec(line);
     if (heading) {
       open = { label: heading[1]!, value: "" };
       rows.push(open);