pan admin cloister

Manage deacon-lite — the surviving watchdog. It observes and nudges or
notifies; it never reconciles a stored copy of pipeline state. Its four
routines: nudge work agents idle too long with unpushed work, nudge agents
stuck on a repeated API error, reconcile the dashboard's agent-liveness
cache against the terminal backend's own inventory, and reap agents left
behind on closed issues.

Usage

pan admin cloister status [--json]   # Show watchdog service status and agent health
pan admin cloister start             # Start the watchdog (no-op if already running)
pan admin cloister stop              # Stop the watchdog (running agents continue)
pan admin cloister emergency-stop    # Kill ALL agents immediately — destructive

Stopping the watchdog does NOT stop running work agents — they continue in
their sessions. It only suspends deacon-lite's own nudges and liveness
reconciliation. Restart with pan admin cloister start to re-engage it.

When to use each subcommand

• status — first stop for diagnosing why an idle agent wasn't nudged,
  or why the dashboard's liveness view looks stale. The Deacon loop: line
  shows the last patrol the deacon child relayed to the dashboard
  (lastRunAt, plus lastRunError when the run failed). waiting for first run means the child is up but has not finished a patrol yet. A last run
  older than three intervals (three minutes) prints red. The pan up
  supervisor watchdog restarts the dashboard on that same condition.
• start — after a host reboot, after stop, or when pan status shows
  no watchdog process.
• stop — when debugging the watchdog itself, or when you want to make
  manual lifecycle interventions without it racing you.
• emergency-stop — last resort. Kills every running agent (work, review,
  test, planning). Workspaces and branches survive but sessions
  are destroyed. Use when something has gone catastrophically wrong (runaway
  fork, memory exhaustion, billing alert).

Confirm before emergency-stop

Treat emergency-stop like pan wipe: confirm with the user before invoking
it. It's not destructive to source or git state, but it terminates in-flight
work and the user will need to recover or restart agents.

See also

• pan admin specialists <cmd> — manage review/test/ship specialist pool
• pan recover <id> — recover a crashed work agent
• pan show <id> --health — agent health and heartbeat
• pan resources — RAM/swap usage by agent
• roles/work.md — work-agent role definition