Leaf harness transcripts are never captured in Tangle boxes: opencode writes opencode.db under the sidecar's private runtime home, not $HOME/.local/share/opencode/storage

[drewstone]

Measured

Over the Discovery fleet records of 2026-09-23/24 (268 runs, agent-runtime 0.249.1 to 0.261.0), 437 settled leaf children carried harnessTranscript: { status: 'unavailable', reason: 'no-transcript' }, and one carried available.
The capture ran, and found no files.

A read-only probe of two live axes-screen children (2026-09-24 09:02Z, boxes sandbox-7103be8ce232 and sandbox-e546815f03fe) showed why:

• The box user is agent with HOME=/home/agent.
• The running harness is opencode run --format json --session ses_… with HOME=/home/agent/.sidecar/cli-runtime-homes/opencode/<sha256> and XDG_DATA_HOME=<that>/.local/share.
• The session store is <runtime home>/.local/share/opencode/opencode.db (SQLite, 6.2 MB plus a 4.2 MB WAL after 45 minutes), beside log/opencode.log. There is no storage/ directory.
• /home/agent/.sidecar, …/cli-runtime-homes and …/cli-runtime-homes/opencode are root 711: traversable, not listable. The runtime home itself is agent 755.

captureHarnessTranscript (src/runtime/harness-transcript.ts) runs find "$HOME/.local/share/opencode/storage" "$HOME/.local/share/opencode/log" with the exec user's $HOME, so it lists nothing and reports no-transcript.
Even with the right directory, the store is one binary SQLite file above MAX_FILE_BYTES (2 MiB), and environment.read returns a string.

The sidecar derives the runtime home as sha256(provider \0 backendIdentity) (agent-dev-container apps/sidecar/src/backends/cli-auth.ts, resolveCliRuntimeHome), so Runtime cannot compute it.

Consequence

No leaf child in the fleet has a native harness session on record.
The native session is the only record of what opencode's own task subagents did (#1264): 34 child-level task calls in these runs are visible as calls in the provider events, and their contents are not retained anywhere.

What would close it

1. agent-dev-container (sidecar): expose the harness session for a sandbox session id, either as a session export (opencode export <sessionID>, JSON) or as the runtime-home path the sidecar used, through the box API the Tangle provider already calls.
2. agent-sdk (agent-provider-tangle): surface it on the environment, for example as an optional transcript(sessionId).
3. agent-runtime: prefer that port in captureHarnessTranscript; keep the file enumeration for harnesses that write under $HOME. The session id is already in the provider events (session.updated.sessionId).

The done check: a settled leaf child in a Tangle box records available, and agent-eval's opencode reader opens the artifact.

Related: #1214 (capture before destroy), #1264 (harness subagents), agent-runtime#1359 (nested managers forward the receipt), agent-eval#797 (the integrity report counts native-session-unavailable by reason).
Coverage report: tangle-network/discovery-lab reports/fleet-observability/coverage.md.

[drewstone]

Correction to the consequence paragraph: the 34 child-level task calls came from a text search that counted each call up to three times (once per id it carries). Counted once per opencode part id over the 315 runs in the Lab coverage report, children show 30 task calls and roots 27, and none of the 57 is observed (discovery-lab#1028).

[drewstone]

The runtime home is discoverable without a sidecar change. The sidecar's own session record, /home/agent/.opencode/sessions/<retained-session>.json (root 644), names it: "providerSessionHome": "/home/agent/.sidecar/cli-runtime-homes/opencode/<sha256>", beside providerSessionId. 24 of the 25 worker captures on drew-gtr-pro (2026-09-24) carry it. The sidecar source gives that home to the demoted CLI user with execute-only root ancestors (apps/sidecar/src/backends/cli-auth.ts, "a process with the same uid can still access known paths"), so captureHarnessTranscript can read <home>/.local/share/opencode/opencode.db and its WAL by path. That leaves the binary-size limit (MAX_FILE_BYTES, string environment.read) as the remaining Runtime change. agent-eval reads the store with openOpencodeDb. The Lab keeper packs it the same way in discovery-lab#1052.

[drewstone]

Follow-up: #1365 (merged 20:11Z) already adds .opencode/sessions, .opencode/messages and .local/share/opencode/export to the opencode capture, so a leaf's own session is carried as text once a run uses it. What stays uncaptured is each harness subagent's session (#1264). The parent's task part names it in its output, <task id="ses_…" state="completed"> (5 of 5 calls in the Lab's worker captures), so Runtime can run opencode export <id> with HOME set to the record's providerSessionHome and keep the child session as text inside the current limits, with no binary store and no sidecar change.