@junghanacs/entwurf 0.23.1 → 0.25.0

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -44,6 +44,8 @@
 import { createHash } from "node:crypto";
 import { statSync } from "node:fs";
 import path from "node:path";
+import { HERDR_FRESH_CALL_BACKENDS } from "../../scripts/herdr-rails.mjs";
+import { callbackEnvAssignments } from "./callback-env.ts";
 import {
 	buildOmpBootstrapPayload,
 	composeBackendArgs,
@@ -54,11 +56,20 @@ import {
 	TASK_MAX_CHARS,
 } from "./fresh-call-composition.ts";
 
-/** The pilot set, closed. `[#116 decision]` herdr's own `--kind` enum is much larger, and that is
+/**
+ * The pilot set, closed. `[#116 decision]` herdr's own `--kind` enum is much larger, and that is
  * NOT evidence of support: every other backend is a pre-mutation named reject here, and there is
  * no fallback to the tmux rail — a caller inside herdr who asks for codex gets a refusal, not a
- * window somewhere else. */
-export const HERDR_FRESH_CALL_BACKENDS = ["pi", "claude-code"] as const;
+ * window somewhere else.
+ *
+ * The VALUE now lives in `scripts/herdr-rails.mjs`, the one leaf the status pane and the install
+ * narration also read (#116 A7), so a fourth backend cannot appear in prose on one surface while
+ * this rail still refuses it. The re-export keeps this module's public name unchanged. The TYPE
+ * still has to be a tuple: a `.mjs` leaf infers `readonly string[]` without the JSDoc cast there,
+ * and `HerdrFreshCallBackend` would silently widen to `string` while every runtime check still
+ * passed. A gate pins that.
+ */
+export { HERDR_FRESH_CALL_BACKENDS };
 export type HerdrFreshCallBackend = (typeof HERDR_FRESH_CALL_BACKENDS)[number];
 
 /** Our backend name → the `--kind` token herdr accepts. `[측정 2026-09-14]` both round-tripped with
@@ -443,7 +454,11 @@ export function herdrAgentNameFromNonce(nonce: string): string {
  * not from a screen. Repeating the flag is the grammar; `--env KEY=` injects the EMPTY value
  * rather than dropping the key.
  */
-export function buildHerdrTabCreateArgs(params: { workspaceId: string; cwd?: string }): string[] {
+export function buildHerdrTabCreateArgs(params: {
+	workspaceId: string;
+	cwd?: string;
+	callback: { target: string; nonce: string };
+}): string[] {
 	return [
 		"tab",
 		"create",
@@ -455,6 +470,7 @@ export function buildHerdrTabCreateArgs(params: { workspaceId: string; cwd?: str
 		"PI_SESSION_ID=",
 		"--env",
 		"PI_AGENT_ID=",
+		...callbackEnvAssignments(params.callback).flatMap((assignment) => ["--env", assignment]),
 	];
 }
 
@@ -849,6 +865,7 @@ export async function herdrFreshCall(
 		buildHerdrTabCreateArgs({
 			workspaceId: callerPane.workspaceId,
 			...(cwd === undefined ? {} : { cwd }),
+			callback: { target: callerGardenId, nonce },
 		}),
 	);
 	if (tabRun.status !== 0) {
@@ -1205,9 +1222,10 @@ export function renderHerdrFreshCall(result: HerdrFreshCallResult): { text: stri
 			`mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
 			`coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
 			`dispatched to them.\n` +
-			`The sibling's garden id arrives separately — it calls entwurf_v2 back with the nonce above as its first ` +
-			`action, and the sender envelope of THAT message is the address. Nothing is polling for it; if it never ` +
-			`comes, the pane is visible and can be read directly.`,
+			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+			`the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
+			`the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
+			`never comes, the pane is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/herdr-placement.ts

@@ -21,7 +21,7 @@
  * THE TWO AXES ARE NOT EQUALLY EXACT, AND THE DIFFERENCE IS NAMED. On the claude axis
  * the reported value IS the key, byte for byte. On the pi axis it is a session FILE
  * PATH, and the key is recovered from that filename by a strict conversion measured on
- * pi 0.85.1 — a VENDOR FLOOR, not a key equality. Calling both "a unique-key join"
+ * pi 0.86.0 — a VENDOR FLOOR, not a key equality. Calling both "a unique-key join"
  * would hide which one can drift when a vendor renames a file. The conversion is
  * deliberately strict at both ends so that drift lands as a missed join, never a wrong
  * one, and a listing that declined to read anything says so (see `declinedReports`).
@@ -112,14 +112,34 @@ const OFFICIAL_REPORTS: Readonly<
 };
 
 /**
- * A pi session filename, measured 2026-09-14 on pi 0.85.1:
+ * A pi session filename, measured 2026-09-20 on pi 0.86.0:
  *
- *   2026-09-14T05-17-03-979Z_01a09e58-f06a-70e8-b14a-1f0f0c7f7c7d.jsonl
+ *   2026-09-20T00-35-44-197Z_01a0bc3d-87c4-738e-b391-265c8ba5a1b0.jsonl
  *   └────────── start stamp ─────────┘ └──────── nativeSessionId ────────┘
  *
+ * `[측정 2026-09-20]` that is a REAL file a sandboxed pi 0.86.0 wrote, and its own
+ * `{"type":"session"}` header carries `id: 01a0bc3d-87c4-738e-b391-265c8ba5a1b0` —
+ * the exact string `piNativeSessionIdFromPath` recovers from the name. The layout was
+ * re-measured rather than carried: pi 0.86.0 rewrote session-manager.ts (+269 −141
+ * over v0.85.1), but every line that BUILDS a name is byte-unchanged
+ * (`${fileTimestamp}_${this.sessionId}.jsonl`, session-manager.ts:991/1527/1703); the
+ * only diff in that file's `.jsonl` lines is a lambda parameter rename on the READER
+ * side. A source read alone would not have settled it, so the real file is the receipt.
+ *
+ * `[측정 2026-09-22, pi 0.87.0]` re-measured, and the shape of the evidence CHANGED for the better.
+ * Source: the three lines that BUILD a session name are byte-unchanged from 0.86.0
+ * (`packages/coding-agent/src/core/session-manager.ts` `${fileTimestamp}_${sessionId}.jsonl` at
+ * :1080/:1666/:1842, moved from :991/:1527/:1703 by the +148/−9 `SessionManager`-canonical work
+ * 0.87.0 declares as breaking). File: `scripts/check-herdr-placement.ts` now makes the installed
+ * `SessionManager` write a real session file into a temp dir on EVERY run — `create()` plus one
+ * `appendMessage`, zero model, zero network, zero child process — and asserts this parser reads
+ * that basename back to the id the file's own header declares. So the vendor floor below is no
+ * longer a receipt somebody took once; it is re-taken by the gate. The 0.86.0 hand-measured file
+ * stays a 0.86.0 fact in the bump ledger rather than being re-dated.
+ *
  * WHY THIS IS PINNED HERE AND NOT INFERRED. The uuid is the join key and it lives in
  * a VENDOR filename, so this rule depends on pi's naming and would break silently if
- * pi changed it. **Vendor floor: pi 0.85.1, measured 2026-09-14** — whether that layout
+ * pi changed it. **Vendor floor: pi 0.86.0, measured 2026-09-20** — whether that layout
  * is a vendor contract or a convention is NOT measured, so this is the one place in the
  * axis that can drift under us. It is therefore strict on both ends — the name must end
  * in `.jsonl` and the tail after the last `_` must be a well-formed uuid — and a name

package/pi-extensions/lib/mux-fresh-call.ts

@@ -86,6 +86,7 @@
  *     there is no "session created" field because nothing here creates one.
  */
 
+import { callbackEnvAssignments } from "./callback-env.ts";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
 	CODEX_CALLER_SEAT_HINT,
@@ -111,6 +112,7 @@ import {
 	composeFreshCallPrompt,
 	FRESH_CALL_BACKENDS,
 	FRESH_CALL_CALLBACK_TOOL,
+	FRESH_CALL_DELIVERY_TOOL,
 	type FreshCallBackend,
 	type FreshCallComposition,
 	type FreshCallInputRejectReason,
@@ -158,6 +160,7 @@ export {
 	buildOmpBootstrapPayload,
 	FRESH_CALL_BACKENDS,
 	FRESH_CALL_CALLBACK_TOOL,
+	FRESH_CALL_DELIVERY_TOOL,
 	type FreshCallBackend,
 	type FreshCallComposition,
 	isSafeFreshCallModel,
@@ -351,9 +354,11 @@ export type FreshCallResult = { ok: true; receipt: FreshCallReceipt } | { ok: fa
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
  * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
- * exactly that after this argv has run. This is a fixed two-variable seam and deliberately NOT a
- * general env carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping
- * power this rail exists to refuse.
+ * exactly that after this argv has run. This is a fixed seam and deliberately NOT a general env
+ * carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping power this
+ * rail exists to refuse. Two more `-e` assignments ride beside the scrub: the callback pair
+ * (`callback-env.ts`), launcher-computed, so the sibling's first action does not retype an
+ * address out of prose.
  */
 const SCRUBBED_INHERITED_ENV = ["PI_SESSION_ID=", "PI_AGENT_ID="] as const;
 
@@ -371,7 +376,8 @@ export function buildFreshCallArgs(
 	targetSessionId: string,
 	runtimePath: string,
 	backendArgs: readonly string[],
-	cwd?: string,
+	cwd: string | undefined,
+	callback: { target: string; nonce: string },
 ): string[] {
 	assertSelector("session", targetSessionId);
 	assertLaunchTarget(runtimePath);
@@ -384,6 +390,7 @@ export function buildFreshCallArgs(
 		"-d",
 		"-a",
 		...SCRUBBED_INHERITED_ENV.flatMap((assignment) => ["-e", assignment]),
+		...callbackEnvAssignments(callback).flatMap((assignment) => ["-e", assignment]),
 		"-t",
 		`${targetSessionId}:{end}`,
 		...(cwd === undefined ? [] : ["-c", cwd]),
@@ -569,7 +576,13 @@ export function freshCall(
 			);
 		}
 	}
-	const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
+	const run = runTmux(
+		buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd, {
+			target: callerGardenId,
+			nonce,
+		}),
+		env,
+	);
 	assertTmuxOk("new-window", run);
 
 	let fields: ReturnType<typeof parseWindowFields>;
@@ -683,9 +696,11 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`\n` +
 			`This is a LAUNCH receipt: tmux created that window and was asked to start the runtime with the model above. It does ` +
 			`NOT mean the sibling is running, that its first turn ran, or that the task was delivered.\n` +
-			`The sibling's garden id arrives separately — it calls entwurf_v2 back with the nonce above as its ` +
-			`first action, and the sender envelope of THAT message is the address. Nothing is polling for it; ` +
-			`if it never comes, the window is visible and can be read directly.`,
+			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb ` +
+			`(codex is the one arm that still sends the nonce as arguments), and the sender envelope of THAT ` +
+			`message is the address. The nonce above is the correlation tag it carries; the sibling reads it ` +
+			`from its own launch env, never from this receipt. Nothing is polling for it; if it never comes, ` +
+			`the window is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/meta-bridge-omp.ts

@@ -83,7 +83,6 @@ import {
 	type MetaRootBundle,
 	ompMetaRootBase,
 	ompMetaRoots,
-	requireGardenId,
 	upsertMetaSession,
 	writeMetaSenderMarker,
 } from "./lib/meta-session.ts";
@@ -162,7 +161,7 @@ export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
 /** Payload grammar version. A payload that does not say exactly this is refused rather than
  * best-guessed: the launcher and this unit ship in the same package, so a mismatch means a
  * STALE installed unit — the one condition `doctor-omp-bridge` exists to name out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
+export const OMP_BOOTSTRAP_VERSION = 2;
 
 /**
  * The model-facing callback tool, spelled for omp. `[측정]` the vendor's minter sanitises to
@@ -177,7 +176,7 @@ export const OMP_BOOTSTRAP_VERSION = 1;
  * spellings are held equal by `test/omp-fresh-bootstrap.contract.test.ts`, the same shape
  * `check-omp-fresh-preflight` already uses for the preflight's reproduced oracles.
  */
-export const OMP_BOOTSTRAP_CALLBACK_TOOL = "mcp__entwurf_bridge_entwurf_v";
+export const OMP_BOOTSTRAP_CALLBACK_TOOL = "mcp__entwurf_bridge_entwurf_callback";
 
 /** Task ceiling, held equal to the launcher's `TASK_MAX_CHARS` by the same contract test. */
 export const OMP_BOOTSTRAP_TASK_MAX_CHARS = 16000;
@@ -195,15 +194,9 @@ export const OMP_BOOTSTRAP_READY_TIMEOUT_MS = 60_000;
  * primitive; a FIXED DELAY is forbidden because the gap is a race, not a constant. */
 export const OMP_BOOTSTRAP_POLL_MS = 100;
 
-/** The nonce the launcher mints (`mintNonce`: `mux-fresh-call-` + 12 random bytes as hex). */
-const BOOTSTRAP_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
-
-/** What the launcher put on the flag. Exactly three fields — a target to call back to, the
- * correlation nonce, and the operator's task. Nothing here is a command, a path or an env
- * name, and the decoder refuses anything wider. */
+/** What the launcher put on the flag. Address rides process env; this payload is the task
+ * released after the no-arg callback succeeds. The decoder refuses anything wider. */
 export interface OmpBootstrapPayload {
-	target: string;
-	nonce: string;
 	task: string;
 }
 
@@ -216,8 +209,6 @@ export type OmpBootstrapRejectReason =
 	| "payload-not-object"
 	| "version-unsupported"
 	| "payload-unknown-key"
-	| "target-invalid"
-	| "nonce-invalid"
 	| "task-empty"
 	| "task-too-long";
 
@@ -228,7 +219,7 @@ export type OmpBootstrapDecode =
 /** The wire keys, closed. An unknown key is a REFUSAL rather than an ignored extra: this
  * flag is the one thing a caller can put arbitrary bytes into, so the decoder's job is to
  * make "what the launcher meant" and "what this unit will act on" the same set. */
-const BOOTSTRAP_KEYS = new Set(["v", "target", "nonce", "task"]);
+const BOOTSTRAP_KEYS = new Set(["v", "task"]);
 
 /**
  * Read the flag value into a payload, or name why not.
@@ -256,18 +247,10 @@ export function decodeOmpBootstrapPayload(raw: unknown): OmpBootstrapDecode {
 	for (const key of Object.keys(obj)) {
 		if (!BOOTSTRAP_KEYS.has(key)) return { ok: false, reason: "payload-unknown-key" };
 	}
-	let target: string;
-	try {
-		target = requireGardenId(obj.target);
-	} catch {
-		return { ok: false, reason: "target-invalid" };
-	}
-	const nonce = obj.nonce;
-	if (typeof nonce !== "string" || !BOOTSTRAP_NONCE_RE.test(nonce)) return { ok: false, reason: "nonce-invalid" };
 	const task = obj.task;
 	if (typeof task !== "string" || task.trim().length === 0) return { ok: false, reason: "task-empty" };
 	if (task.length > OMP_BOOTSTRAP_TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
-	return { ok: true, value: { target, nonce, task } };
+	return { ok: true, value: { task } };
 }
 
 /**
@@ -279,18 +262,13 @@ export function decodeOmpBootstrapPayload(raw: unknown): OmpBootstrapDecode {
  * no competing goal at all. Stage two exists so this message never has to compete with the
  * work; adding "then do X" back into it would rebuild exactly the prompt that failed.
  */
-export function buildOmpCallbackOnlyPrompt(params: { target: string; nonce: string }): string {
+export function buildOmpCallbackOnlyPrompt(): string {
 	return [
 		"You are a fresh visible citizen that entwurf opened in the operator's tmux session.",
 		"",
-		`FIRST AND ONLY ACTION RIGHT NOW: call ${OMP_BOOTSTRAP_CALLBACK_TOOL} with ` +
-			`target=${params.target}, intent=fire-and-forget, wants_reply=false, and ` +
-			`message set to exactly ${params.nonce} — that string alone, nothing added.`,
+		`FIRST AND ONLY ACTION RIGHT NOW: call ${OMP_BOOTSTRAP_CALLBACK_TOOL} with no arguments.`,
 		"That call is how the agent that opened you learns your address. Make the call before",
-		"reading files, before planning, and before answering in prose. Do not reword the message.",
-		"",
-		"Do not inspect environment variables, do not call entwurf_self, and do not start an MCP",
-		"server yourself. Your own report of your identity is not the address anyone needs.",
+		"reading files, before planning, and before answering in prose. There are no parameters.",
 		"",
 		"Your actual task arrives as the NEXT user message, immediately after that call succeeds.",
 		"Do not ask for it and do not guess at it.",
@@ -756,20 +734,29 @@ export function ompCallbackToolReady(pi: OmpExtensionApi): boolean {
 }
 
 /**
- * Does this tool event name OUR callback, with OUR target and OUR nonce?
+ * Does this tool event name OUR callback?
  *
  * The event carries no server name, no session id and no original MCP tool name
- * (`extensions/types.ts:916-1017`), so the match is built from what IS there: the canonical
- * minted tool name plus the two argument values this rail already owns as contract. Exact
- * string equality on both — a prefix or `includes` here would let a sibling's nonce release
- * this session's task.
+ * (`extensions/types.ts:916-1017`), so the match is built from what IS there: exact string
+ * equality on the canonical minted tool name — a prefix or `includes` here would let a
+ * neighbouring tool release this session's task.
+ *
+ * The target/nonce half of this predicate is GONE, and that is the point of the out-of-band
+ * callback: the address rides the sibling's process env, so the verb takes no arguments and
+ * there are no argument values left to compare. What replaces the comparison is the ABSENCE
+ * of arguments — a call carrying a target or a message is a model supplying an address, which
+ * is the second address axis Hard Rule 2 refuses, and it must not release the task. Correlation
+ * to THIS bootstrap is not weakened by the removal: it is carried by the stored `toolCallId`
+ * (one session, one live tool call) plus the fact that only this session's env named the caller.
  */
-function matchesCallback(event: OmpToolCallEvent, payload: OmpBootstrapPayload): boolean {
+function matchesCallback(event: OmpToolCallEvent, _payload: OmpBootstrapPayload): boolean {
 	if (event?.toolName !== OMP_BOOTSTRAP_CALLBACK_TOOL) return false;
 	const input = event?.input;
-	if (typeof input !== "object" || input === null || Array.isArray(input)) return false;
+	if (input === undefined || input === null) return true;
+	if (typeof input !== "object" || Array.isArray(input)) return false;
 	const args = input as Record<string, unknown>;
-	return args.target === payload.target && args.message === payload.nonce;
+	// No-arg verb: a supplied target/message is a second address axis — not our callback.
+	return args.target === undefined && args.message === undefined;
 }
 
 /**
@@ -822,7 +809,7 @@ export function createOmpBootstrap(opts: {
 		stopTimer();
 		if (isFinal()) return;
 		phase = "failed";
-		log("WARN", `bootstrap-failed nonce=${payload.nonce}: ${why}; the task was NOT sent`);
+		log("WARN", `bootstrap-failed: ${why}; the task was NOT sent`);
 	}
 
 	/**
@@ -858,8 +845,8 @@ export function createOmpBootstrap(opts: {
 			// two callback prompts for one bootstrap.
 			phase = "callback-sent";
 			stopTimer();
-			log("INFO", `bootstrap-ready nonce=${payload.nonce}: callback tool live, sending callback-only prompt`);
-			send(buildOmpCallbackOnlyPrompt({ target: payload.target, nonce: payload.nonce }));
+			log("INFO", "bootstrap-ready: callback tool live, sending callback-only prompt");
+			send(buildOmpCallbackOnlyPrompt());
 			return;
 		}
 		if (timers.now() >= deadline) {
@@ -895,14 +882,14 @@ export function createOmpBootstrap(opts: {
 			const id = event?.toolCallId;
 			if (typeof id !== "string" || id.length === 0) return;
 			callId = id;
-			log("INFO", `bootstrap-callback-observed nonce=${payload.nonce} toolCallId=${id}`);
+			log("INFO", `bootstrap-callback-observed toolCallId=${id}`);
 		},
 		onToolResult(event: OmpToolResultEvent): void {
 			if (phase !== "callback-sent" || callId === null) return;
 			if (event?.toolCallId !== callId) return;
 			if (!matchesCallback(event, payload)) return;
 			if (event?.isError !== false) {
-				log("WARN", `bootstrap-callback-errored nonce=${payload.nonce} toolCallId=${callId}; the task was NOT sent`);
+				log("WARN", `bootstrap-callback-errored toolCallId=${callId}; the task was NOT sent`);
 				return;
 			}
 			// RELEASED, AND THE TASK IS NOT SENT HERE. This handler runs inside the callback
@@ -911,7 +898,7 @@ export function createOmpBootstrap(opts: {
 			// record that the callback provably succeeded; `onTurnEnd` owns the send.
 			phase = "released";
 			stopTimer();
-			log("INFO", `bootstrap-released nonce=${payload.nonce} toolCallId=${callId}: task armed for the next turn_end`);
+			log("INFO", `bootstrap-released toolCallId=${callId}: task armed for the next turn_end`);
 		},
 		/**
 		 * The stage-two boundary: the callback turn is over, so the session is at the edge
@@ -932,7 +919,7 @@ export function createOmpBootstrap(opts: {
 		onTurnEnd(): void {
 			if (phase !== "released") return;
 			phase = "task-sent";
-			log("INFO", `bootstrap-task-sent nonce=${payload.nonce}: delivering the task at the turn_end boundary`);
+			log("INFO", "bootstrap-task-sent: delivering the task at the turn_end boundary");
 			send(payload.task);
 		},
 		invalidate(why: string): void {
@@ -942,7 +929,7 @@ export function createOmpBootstrap(opts: {
 			// caller's task must die with the session it was addressed to.
 			if (isFinal()) return;
 			phase = "failed";
-			log("INFO", `bootstrap-invalidated nonce=${payload.nonce}: ${why}; the task was NOT sent`);
+			log("INFO", `bootstrap-invalidated: ${why}; the task was NOT sent`);
 		},
 	};
 }
@@ -1118,7 +1105,7 @@ export function startOmpBootstrap(opts: {
 	const handle = createOmpBootstrap({ payload: decoded.value, pi, timers, log });
 	activeBootstrap = { sessionId: envelope.nativeSessionId, handle };
 	bootstrapConsumed = true;
-	log("INFO", `bootstrap-armed nonce=${decoded.value.nonce} target=${decoded.value.target}`);
+	log("INFO", "bootstrap-armed: payload admitted, waiting for callback tool");
 	handle.start();
 }
 

package/protocol.js

@@ -21,11 +21,3 @@
  * AGENTS.md section from its own pi-context augment.
  */
 export const ENTWURF_PROJECT_CONTEXT_OPEN_TAG = "<project-context";
-
-/**
- * Sender-side UI echo custom message type for successful entwurf_v2 send calls.
- * The bridge emits it, the control renderer draws it, and the provider-level
- * context filter removes it before LLM conversion. Keep as one SSOT: a typo
- * here otherwise becomes a silent UI/context split.
- */
-export const ENTWURF_SENT_MESSAGE_TYPE = "entwurf-sent";