…e analysis + roadmap

Backed by a 30-page primary-source deep-crawl of band.ai (dossiers/band-ai.md).
BAND = $17M-seed closed/centralized SaaS doing wire's thesis. Verified wire
wins on identity (self-certifying DID vs account API-key), E2E crypto (BAND has
none), consent (operator-gated vs BAND's LLM-auto-accept option), and
decentralization (BAND coordination plane is SaaS-only). BAND wins on framework
reach (14 native SDKs) + funding.

Recommendation: own "no server owns your agent graph"; close reach
(MCP-as-universal-adapter, sharpened by BAND relegating MCP to automation-only)
+ observability (P1/P2); decline the traps (memory, task boards, governance
theater) as explicit anti-features.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT

…om open-BAND brief

Ratified Decline list: cross-agent memory store, task boards/kanban, and
governance-UI/policy-engine are explicit non-goals — each a deliberate
divergence from BAND verified against its shipped API (dossiers/band-ai.md).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT

… box (P0+P1)

New `wire dash` [--watch] [--json] [--all] [--probe]: enumerates every wire
session on the machine (persona, daemon liveness, pinned peers, relay binding,
sync recency), paired sessions first, idle solo daemons collapsed to a count.

P0 src/dash.rs: collect() enriches session::list_sessions() by reading each
session's trust.json (peers, self-excluded), relay.json (binding), daemon.pid,
and last_sync.json mtime — by EXPLICIT path (never the session-scoped
config helpers, which would read the current session 270x). Read-only: never
spawns/kills a daemon, no per-session network; relay /healthz is one deduped
GET, opt-in via --probe. Golden surface: wire-dash-v1 JSON.

P1 src/cli/dash.rs: table (ANSI, no ratatui dep) + --watch 2s redraw + --json.

In-situ vs the live 273-session store: 269 running / 11 paired / 258 idle,
pid-count unchanged before/after (zero spawn/kill). Honest classification:
"idle" = running daemon with no real peers (a live daemon heartbeat-syncs
regardless of use, so peers not sync-age is the signal). P2 (Mission Control
adapter) deferred — needs MC's WebSocket status schema, tracked as a follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT

…exclude, sanitize

Round-2 fixes from the 3-reviewer diff gate on 2ef5dd4:
- MAJOR: `--watch --json` (and `--watch | pipe` via auto-json) silently
  one-shotted. Watch is now the outer loop; each tick emits JSON or table.
  Verified: 2 JSON ticks in 5s (was 1).
- MAJOR: table misalignment — `{daemon:<9}` padded an ANSI-wrapped string
  (zero fill in color mode) and `fp` column was 7 wide for 8-char fingerprints.
  Pad plain-then-color; fp width 9.
- MAJOR: read_peers self-exclusion failed on a did-less self entry → session
  listed itself as a peer. Now excludes by DID or handle.
- Terminal-escape injection: peer handle/tier + name now run through
  character::sanitize_display_text before render (peer-published text).
- Hardening: bounded (256KB) file reads across the ~270-session fan-out;
  probe_relay rejects non-http(s) + disables redirects; fingerprint_from_did
  returns None on empty tail.
- UX: render cwd (reap-decision hint), pluralize the hidden-count line,
  fleet-over-SSH footer.
- Tests: golden wire-dash-v1 shape anti-drift, StalePid serialization,
  self-exclude-by-handle, ESC-strip, cwd render. 13 dash tests green.
- Doc: design P0 amended to the as-built DaemonState/likely_idle model.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT

The output path used print!/println!, which PANIC on EPIPE — so `wire dash | head`,
`wire dash --json | jq` closing early, or the Mission Control reporter dropping its
pipe crashed wire with a backtrace (exit 101). Round-2's watch-loop fix made this the
primary failure mode since the tool is now explicitly meant to be piped. Centralize
output through emit(), which exits 0 on BrokenPipe. Verified: `wire dash --all | head`
and `--watch | head` no longer panic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT

…ly decommission idle identities

The supervisor keeps a daemon alive for every real identity (so it can receive
mail), so an idle throwaway's daemon can't just be killed — it respawns within a
poll. This adds a retire lifecycle stage: write a `.retired` marker that makes
`supervisor_eligible` treat the home as ineligible (the supervisor's existing
reconcile loop then kills the child and never respawns), plus a direct
graceful-then-force kill for immediacy. Reversible: the marker is the only state
change; `wire revive` removes it and the identity comes back intact (relay slots
never expire, mail is retained, cursor kept).

Surface: `wire retire <handle|fp|key>`, `wire revive <...>`, `wire dash
--retire-idle [--older-than D] [--dry-run] [--force] [--json]`, `wire dash
--retired`. dash gains a `retired` state (collapsed by default, shown by
--retired/--all) + a retired count.

Hardened per a 4-persona plan review (5 blockers folded): retired filtered FIRST
in supervisor_eligible (above the cwd branch AND the max_idle=None early-return);
graceful-then-force kill (bare SIGTERM is a no-op for a headless Windows daemon);
current identity matched by HOME PATH and fail-closed (resolve_session_key is
None on a bare terminal); pending-inbound + paired + recent excluded from the
sweep; --force skips the typed confirm only, never the guards; guards re-checked
per target at kill time (TOCTOU); dry-run default; victims named before confirm.
CLI-only (no MCP tool — an agent must not retire identities unsupervised).

633 lib tests green (supervisor eligibility proven for retired+cwd/identity/
max_idle=None; retire/revive/marker mechanics; box-wide resolver).

NOTE: takes full effect only once the RUNNING supervisor is the new binary —
until `wire service install`/upgrade, the old supervisor respawns retired
daemons. Bulk-retiring the 258 backlog is the operator running --retire-idle
after upgrading.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT

…not daemon.pid

daemon.pid mtime resets to now on every supervisor respawn, so on a box whose
supervisor restarted recently it read every daemon as "just started" and the
--older-than guard matched almost nothing (1 of 258). private.key is written
once at keygen and never rewritten → its mtime is the identity's true age, immune
to respawn and to heartbeat sync. Dry-run on the live store now selects 222 at
7d / 257 at 1d, current + paired still correctly excluded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmVWMe6fE54U1drShE1yMT