Almost everything your AI agent does rides on one tool.

Why. Orphaned jobs and killing the wrong thing rank second in the pain catalog, and “timeout equals terminated” is the first pitfall the prior-art survey found. Codex’s resumable process (a yield that returns a session id, then follow-up calls) is the closest precedent, and it works.

How. One job system shared by shell commands, the check tool, and later child agents. The job’s end is announced at the model’s next input, with its last lines, the way a child agent’s failure already is.

Cost. This is the reorganization that shrinks today’s 3,500 lines of lifecycle code, where the persistent shell, detached jobs, fresh jobs, and check each carry their own. The risk is edge cases, like a root process that exited while a descendant still holds the pipe open. Today’s code already handles those, and its tests transfer.

Why. This is the architectural crux, and Fable recommends it against the research report’s first instinct, which was to keep the persistent shell because its round trip is 0.02 ms against 0.7 ms. That gap is noise next to a model turn. What a persistent shell cannot do is decisive: run two calls at once, be wrapped in a per-command kernel group or file policy (both are permanent for a process and its descendants), avoid being blocked by one long job, or survive a command that runs exec or exit.

How. Capture uses bash’s own built-in commands, sent over a private channel so output can’t confuse it: 0.07 ms against 0.58 ms for today’s env | base64 capture. If a command breaks the capture, the result says “state unknown after this call; carrying the previous state.”

What is lost. Traps, open file handles, positional parameters, and a live shell’s own background jobs don’t carry. For the rare workflow that needs a live shell, a named persistent session exists: nothing impossible, only explicit.

The view also strips terminal control codes for the model (kept for the cockpit, Loom’s dashboard), collapses runs of identical lines into a count, keeps only the final state of progress-bar spam, and names binary output as binary. Another view, like a line range, a search, or just the errors, is one cheap call.

Why. Silent truncation removed decisive evidence in the pain catalog’s incidents. Codex keeps 1 MiB of head and tail with a 10k-token response budget, Goose saves overflow to a file, and Terminus shows a 10 KB excerpt.

Cost. Disk. A retention policy is a number to choose, not a design problem.

Why. It is the pain catalog’s number one family. The estate’s rules “write substantive prose to a file first” and “choose collision-free heredoc delimiters” exist only because the tool has no other channel.

Bonus. If a command is refused, its files are still written and the result says so. That ends the confusion of “a denied compound command runs none of it.”

How. For the project, a git status before and after (milliseconds, with git’s file-system monitor on). For other paths the command could read, the stat-and-hash comparison Loom already does. For processes, whatever is still alive in the job’s kernel group. An effects: diff option returns the actual bounded diff, so a sed -i or a codemod (a script that rewrites code in bulk) is legible without a second call.

Honesty. No cheap observer gives a complete ledger: renames, writes through symlinks, memory-mapped writes, and other processes can all slip past. So effects are reported with their scope and confidence.

Survivors. Processes still alive when a call returns are listed in the result and stay owned by the job. At session end they are listed again. A job meant to outlive the session says so (keep: true) and gets a named systemd unit, as the estate’s rules already require. There is no “low memory” reaper, ever.

Why. Process groups alone miss descendants that call setsid. Kills by process ID hit reused IDs. Pattern kills took out other agents.

How. Loom starts inside a delegated systemd unit, so a per-job group is one mkdir and one write: microseconds. It also gets per-session CPU and memory accounting and a one-shot cleanup. The alternative, systemd-run --scope per job, costs a round trip to the system bus (unmeasured; likely tens of milliseconds). Tests and gates keep going through the estate’s testrun wrapper, and the header shows that routing.

Why. Agents killed healthy jobs after reading silence as death. One papercut waited five minutes on a command that wanted input. With stdin closed by default, that whole class fails fast instead of hanging. Prompts get answered in the interactive mode instead.

Why separate. The prior-art survey’s fourth pitfall is mistaking a terminal’s screen for process truth, so this stays its own mode with the job model underneath. Pipes remain the default, because a terminal changes buffering, echo, and line endings, and merges the two output streams.

How. node-pty (maintained by the VS Code team) plus @xterm/headless are the first candidates.

Also. The estate’s footguns hook already runs against Loom’s shell calls, and its denials render in this same shape. Warnings that do not block, like a ; after a command that failed or an unquoted heredoc containing $, annotate the result instead of passing silently. An override parameter with a stated reason lets the model widen a guard for one call, audit-logged, instead of routing around it.

Why. Landlock is confirmed on this kernel. It cannot see permission or ownership changes, which is fine for an accident guard. Loom’s own parser-based rule was retired once already for being both over-restrictive and incomplete. The old deletion rule stays as the friendly preflight explainer, and the kernel is the backstop for what no parser can see.

Cost. A small native launcher, since Node has no Landlock binding. A minimal bubblewrap sandbox measured about 1.4 ms per launch, and Landlock should be cheaper. Risks to test: git worktrees whose git directory lives outside the checkout, pnpm’s package store, the estate’s Unix sockets, and tools that write to unexpected cache paths.

The allowlist is PATH, HOME, locale, TERM=dumb, the XDG and D-Bus variables systemd needs, the estate’s realm markers, and TMPDIR. Output is screened for secret-shaped strings before the model sees it. Nothing on PATH is aliased or wrapped, and the dialect is pinned: bash 5.2, no startup files, and the session’s starting instructions say so.

Why. The credentials bead is open and the code does no filtering today. Codex ships a name-based exclusion and leaves it off by default, which is a warning about defaults. Environment divergence is the pain catalog’s third-ranked family, and twenty filings came from zsh’s reserved names alone.

And. The model can ask the tool what it is: version, shell, PATH, policy, limits, live jobs, and what changed since the session began. An open bead already asks for the survivors listing.