"OpenCode scores 34/55 — +2 over Aider. Where does the +2 come from?" Almost entirely from sandboxing: +3 Module 5 (Docker containerized server) offset by -1 Module 9 (weak verification). The client/server architecture is the enabler. harness-engineering::dd03::analysis "What is OpenCode's defining architectural feature?" Client/server split. The loop runs as a SERVER (in Docker); the client is a stateless UI that connects. Enables remote sessions, Docker sandboxing, multi-client access. harness-engineering::dd03::recall "Why can OpenCode sandbox while Pi and Aider cannot?" Client/server: the loop (server) runs in a Docker container. Pi/Aider's loops run directly in the user's terminal process — no container boundary. The client/server split is the PREREQUISITE for Module 5's outside-sandbox pattern in CLI. harness-engineering::dd03::analysis "Name 3 things OpenCode does better than Pi/Aider." (1) Client/server = sandboxable (Docker native). (2) LSP integration (precise code nav as tools). (3) Remote sessions (connect from any client; server persists). harness-engineering::dd03::recall "What does 'client is stateless' mean, and why does it matter?" The client holds no session state — it's a UI. It can reconnect, switch machines, or run headless. The server holds everything. Enables team/shared sessions and resilience (client crash ≠ session loss). harness-engineering::dd03::analysis "OpenCode blast radius vs Pi/Aider — same or different?" DIFFERENT (better). OpenCode's server runs in Docker: blast radius = container. Pi/Aider run in the terminal process: blast radius = host. The client/server split enables the container boundary. harness-engineering::dd03::analysis "Name 3 things to fix if you forked OpenCode." (1) Add computed verification (test gate) — Module 9 is weak. (2) The large codebase reduces legibility vs Pi/Aider. (3) Add untrusted-tagging on file reads. harness-engineering::dd03::application