@@ -2,8 +2,7 @@ import type { InvocationHandle } from '../contract.ts';
 import { createClaudeCommand, createPhasePolicy } from '../policy.ts';
 import { launchInvocation } from './supervisor.ts';
 import { setUpProfile } from './setup.ts';
-import { assertBuiltAgentImage } from '../container/image.ts';
-import { createAdapterInvocationBudget, type AgentAdapterOptions, type AgentAdapterRequest } from './types.ts';
+import { assertAdapterRequest, createAdapterInvocationBudget, type AgentAdapterOptions, type AgentAdapterRequest } from './types.ts';
 
 export function parseClaudeOutput(raw: Buffer): { text: string; providerFailed: boolean } {
   const envelope = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(raw)) as
@@ -19,7 +18,7 @@ export function startClaudeInvocation(request: AgentAdapterRequest,
   const policy = createPhasePolicy(request.invocation);
   const remaining = createAdapterInvocationBudget(request.invocation, options.timeoutMs);
   // Invalid input throws here, before anything is allocated; only Docker setup runs inside the handle.
-  assertBuiltAgentImage(request.imageId);
+  assertAdapterRequest(request);
   return launchInvocation(request.invocation, remaining, (signal, start) => setUpProfile(request, remaining, signal,
     network => ({ ...request, policy, network, command: createClaudeCommand(policy, request.prompt),
       claudeToken: oauthToken }),
 
@@ -4,8 +4,7 @@ import { agentContainerId } from '../container/run.ts';
 import { createCodexCommand, createPhasePolicy } from '../policy.ts';
 import { launchInvocation, readBoundedContainerFile } from './supervisor.ts';
 import { setUpProfile } from './setup.ts';
-import { assertBuiltAgentImage } from '../container/image.ts';
-import { createAdapterInvocationBudget, type AgentAdapterOptions, type AgentAdapterRequest } from './types.ts';
+import { assertAdapterRequest, createAdapterInvocationBudget, type AgentAdapterOptions, type AgentAdapterRequest } from './types.ts';
 
 export const CODEX_OUTPUT_FILE = '/run/codeboost-output/final.txt';
 // Read the output from the container this invocation created, by ID; a same-named replacement must not answer.
@@ -28,7 +27,7 @@ export function startCodexInvocation(request: AgentAdapterRequest,
   const policy = createPhasePolicy(request.invocation);
   const remaining = createAdapterInvocationBudget(request.invocation, options.timeoutMs);
   // Invalid input throws here, before anything is allocated; only Docker setup runs inside the handle.
-  assertBuiltAgentImage(request.imageId);
+  assertAdapterRequest(request);
   return launchInvocation(request.invocation, remaining, (signal, start) => setUpProfile(request, remaining, signal,
     network => ({ ...request, policy, network, command: createCodexCommand(policy, request.prompt),
       codexAuthFile: authFile, deferredOutput: true }),
 
@@ -19,7 +19,8 @@ const CLEANUP_TIMEOUT_MS = 30_000;
 export async function setUpProfile(request: AgentAdapterRequest, remaining: () => number, signal: AbortSignal,
   profileOptions: (network: VendorNetwork) => Omit<ProfileOptions, 'timeoutMs' | 'signal'>,
   start: (profile: ContainerProfile) => InvocationHandle): Promise<InvocationHandle> {
-  const network = await createVendorNetwork(request.invocation, request.imageId, Math.min(60_000, remaining()), signal);
+  const network = await createVendorNetwork(request.invocation, request.imageId, request.networkAllocationId,
+    Math.min(60_000, remaining()), signal);
   let profile: ContainerProfile;
   try {
     profile = await createContainerProfile({ ...profileOptions(network), timeoutMs: Math.min(60_000, remaining()),
 
@@ -1,5 +1,7 @@
 import type { InvocationInput } from '../contract.ts';
 import type { TaskFilesystems } from '../container/storage.ts';
+import { assertBuiltAgentImage } from '../container/image.ts';
+import { assertResourceOwner } from '../labels.ts';
 import type { CaptureLimits } from './supervisor.ts';
 
 export interface AgentAdapterRequest {
@@ -8,6 +10,17 @@ export interface AgentAdapterRequest {
   readonly inputDirectory: string;
   readonly imageId: string;
   readonly prompt: string;
+  /**
+   * The caller-chosen allocation ID (a lowercase UUID v4) for the vendor network and proxy, recorded before the start
+   * call so recovery can match them to the attempt (#51 item 3).
+   */
+  readonly networkAllocationId: string;
+}
+/** Check a start call's synchronous input, so invalid input throws before a handle exists. */
+export function assertAdapterRequest(request: AgentAdapterRequest): void {
+  assertBuiltAgentImage(request.imageId);
+  assertResourceOwner({ runnerOwner: request.invocation.runnerOwner, attemptId: request.invocation.attemptId,
+    allocationId: request.networkAllocationId });
 }
 export interface AgentAdapterOptions {
   readonly timeoutMs?: number;
 
@@ -5,7 +5,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { assertCapturedInvocation, type InvocationInput, type Phase, type UnreleasedResource } from '../contract.ts';
 import { assertBuiltAgentImage } from './image.ts';
-import { assertTaskFilesystems, type TaskFilesystems } from './storage.ts';
+import { assertTaskFilesystems, taskFilesystemOwner, type TaskFilesystems } from './storage.ts';
+import { ownerLabelArgs, type ResourceOwner } from '../labels.ts';
 import { assertVendorNetwork, removeVendorNetwork, vendorNetworkResources,
   type VendorNetwork } from '../network/network.ts';
 import { assertAgentCommand, assertPhasePolicy, type AgentCommand, type PhasePolicy } from '../policy.ts';
@@ -136,6 +137,12 @@ const captureInput = (directory: string): InputCapture => {
   return Object.freeze({ inputDirectory: canonical, schema, content: captured.content });
 };
 
+/** The labels on an invocation's agent container: its runner and attempt, and the task-storage allocation it mounts. */
+export function agentContainerOwner(invocation: InvocationInput, filesystems: TaskFilesystems): ResourceOwner {
+  return Object.freeze({ runnerOwner: invocation.runnerOwner, attemptId: invocation.attemptId,
+    allocationId: taskFilesystemOwner(filesystems).allocationId });
+}
+
 /** Prove that a profile object is the exact capability issued by this module. */
 export function assertContainerProfileAuthenticity(profile: ContainerProfile): void {
   if (!identities.has(profile)) throw new Error('Container profile was not created by the trusted profile builder.');
@@ -218,6 +225,11 @@ export async function createContainerProfile(options: ProfileOptions): Promise<C
     throw new Error('Container profile requires the immutable built image ID.');
   assertBuiltAgentImage(options.imageId);
   assertTaskFilesystems(filesystems, invocation.clone);
+  // The storage must belong to this runner. The agent container is labelled with its own attempt and the allocation
+  // it mounts, so recovery can find both from the container.
+  const storageOwner = taskFilesystemOwner(filesystems);
+  if (storageOwner.runnerOwner !== invocation.runnerOwner) throw new Error('Task filesystems belong to another runner.');
+  const containerOwner = agentContainerOwner(invocation, filesystems);
   const invocationLeft = Math.floor(invocation.deadline - Date.now());
   if (invocationLeft < 1) throw new Error('Invocation deadline has passed.');
   await assertVendorNetwork(options.network, invocation, undefined, Math.min(options.timeoutMs ?? 30_000, invocationLeft),
@@ -265,7 +277,7 @@ export async function createContainerProfile(options: ProfileOptions): Promise<C
       '--cpus=1', '--shm-size=16m', '--ipc=private', '--cgroupns=private',
       `--network=${options.network.name}`, '--dns=127.0.0.1', '--env', 'HOME=/home/codeboost',
       '--env', `CODEBOOST_PHASE=${invocation.phase}`,
-      '--label', `io.codeboost.invocation=${ownershipId}`,
+      '--label', `io.codeboost.invocation=${ownershipId}`, ...ownerLabelArgs(containerOwner),
       '--env', `CODEBOOST_VENDOR=${invocation.vendor}`, '--env', 'npm_config_cache=/tmp/npm-cache',
       '--env', `HTTPS_PROXY=${options.network.proxyUrl}`, '--env', `HTTP_PROXY=${options.network.proxyUrl}`,
       '--env', 'NO_PROXY=localhost,127.0.0.1',
 
@@ -2,11 +2,13 @@ import { realpathSync } from 'node:fs';
 import { createOutcomeUnknown, DOCKER_ID } from '../client-outcome.ts';
 import type { UnreleasedResource } from '../contract.ts';
 import { docker as runDockerCommand, pause, runDocker, type DockerOutcome } from '../docker.ts';
-import { assertContainerProfile, assertContainerProfileAuthenticity, disposeContainerProfile,
+import { agentContainerOwner, assertContainerProfile, assertContainerProfileAuthenticity, disposeContainerProfile,
   isContainerProfileAuthentic, profileTimeout,
   type ContainerProfile } from './profile.ts';
 import { BASE_IMAGE, CLAUDE_VERSION, CODEX_VERSION } from './image.ts';
-import { taskFilesystemAllocationId } from './storage.ts';
+import { taskFilesystemOwner } from './storage.ts';
+import { hasOwnerLabels, ownerLabels } from '../labels.ts';
+import { assertPhasePolicy } from '../policy.ts';
 export { prepareTaskFilesystems, removeTaskFilesystems } from './storage.ts';
 export type { TaskFilesystems, TaskStorageLimits } from './storage.ts';
 
@@ -54,6 +56,8 @@ const unsettledCreates = new WeakMap<ContainerProfile, number>();
 // removed only once the container's removal (or absence) is confirmed, so any later retry of the profile's own
 // network or staging cleanup is profile-only and never looks the name up again.
 const createdContainers = new WeakMap<ContainerProfile, string | undefined>();
+// The ownership labels written on each profile's agent container, for reporting it if its removal is not confirmed.
+const containerLabels = new WeakMap<ContainerProfile, Readonly<Record<string, string>>>();
 
 /**
  * The immutable ID of the agent container this profile created, when `docker create` returned one. Every operation
@@ -85,8 +89,9 @@ const assertLaunchable = (profile: ContainerProfile) => {
 export function agentContainerResources(profile: ContainerProfile): readonly UnreleasedResource[] {
   if (!createdContainers.has(profile)) return Object.freeze([]);
   const id = createdContainers.get(profile);
+  // Labels captured at create time: this runs while a handle settles and must never throw.
   return Object.freeze([Object.freeze({ kind: 'container' as const, name: profile.name, ...(id ? { id } : {}),
-    owner: Object.freeze({ label: 'io.codeboost.invocation', value: profile.ownershipId }) })]);
+    labels: containerLabels.get(profile) ?? Object.freeze({ 'io.codeboost.invocation': profile.ownershipId }) })]);
 }
 // Cleanup is never cancelled: it runs to its own deadline so nothing is dropped.
 const removeContainerOrThrow = async (profile: ContainerProfile, waitForSettle = false, timeoutMs = 30_000) => {
@@ -124,11 +129,16 @@ const removeContainerOrThrow = async (profile: ContainerProfile, waitForSettle =
   }
   const inspected = JSON.parse(String(before.stdout || '[]'))[0] as
     { Id?: string; Config?: { Labels?: Record<string, string> } } | undefined;
-  if (inspected?.Config?.Labels?.['io.codeboost.invocation'] !== profile.ownershipId)
+  // A captured ID proves the container is the one this profile created (Docker never reuses IDs), so it is removed
+  // even if validation refused its labels. A container found by name (its create's ID never came back) must carry
+  // every label this profile wrote.
+  const expected = containerLabels.get(profile) ?? { 'io.codeboost.invocation': profile.ownershipId };
+  if (!capturedId && (inspected?.Config?.Labels?.['io.codeboost.invocation'] !== profile.ownershipId
+    || Object.entries(expected).some(([label, value]) => inspected?.Config?.Labels?.[label] !== value)))
     throw new Error('Agent container name is held by another invocation; staged credentials were retained.');
   // Remove and confirm by the ID the daemon just reported for our container, never by the name: a same-named
   // replacement created after this inspect must not be deleted.
-  const id = inspected.Id;
+  const id = inspected?.Id;
   if (!id || !DOCKER_ID.test(id) || (capturedId && id !== capturedId))
     throw new Error('Failed to establish the agent container identity; staged credentials were retained.');
   const result = await runDocker(['rm', '--force', id], { timeoutMs: remaining() });
@@ -201,6 +211,7 @@ export async function validateContainer(container: string, profile: ContainerPro
     || JSON.stringify(inspect.Config.Entrypoint) !== JSON.stringify(['/usr/local/bin/codeboost-container-probe'])
     || JSON.stringify(inspect.Config.Cmd) !== JSON.stringify(profile.command)
     || inspect.Config.Labels?.['io.codeboost.invocation'] !== profile.ownershipId
+    || !hasOwnerLabels(inspect.Config.Labels, agentContainerOwner(assertPhasePolicy(profile.policy), profile.filesystems))
     || !host.ReadonlyRootfs || host.Privileged
     || !host.CapDrop?.map(value => value.toUpperCase()).includes('ALL') || (host.CapAdd?.length ?? 0) !== 0
     || !exactSecurityOptions(host.SecurityOpt)
@@ -262,7 +273,8 @@ export async function validateContainer(container: string, profile: ContainerPro
   const volumes = JSON.parse(await docker(['volume', 'inspect', work.Name!, metadata.Name!],
     { timeoutMs: remaining(), signal })) as
     Array<{ Name: string; Driver: string; Labels: Record<string, string> | null; Options: Record<string, string> | null }>;
-  const allocationId = taskFilesystemAllocationId(profile.filesystems);
+  // One owner for the whole check: the storage's runner, attempt and allocation label every volume and the keeper.
+  const storageOwner = taskFilesystemOwner(profile.filesystems);
   const expectedVolumes = new Map([
     [work.Name!, ['work', String(profile.filesystems.workBytes), String(profile.filesystems.workInodes)]],
     [metadata.Name!, ['metadata', String(profile.filesystems.metadataBytes), String(profile.filesystems.metadataInodes)]],
@@ -271,7 +283,7 @@ export async function validateContainer(container: string, profile: ContainerPro
     const expected = expectedVolumes.get(volume.Name), options = volume.Options ?? {}, optionString = options.o ?? '';
     if (!expected || volume.Driver !== 'local' || options.type !== 'tmpfs' || options.device !== 'tmpfs'
       || volume.Labels?.['io.codeboost.task-storage'] !== expected[0]
-      || volume.Labels?.['io.codeboost.allocation'] !== allocationId
+      || !hasOwnerLabels(volume.Labels, storageOwner)
       || !hasExactOptions(optionString, [`size=${expected[1]}`, `nr_inodes=${expected[2]}`,
         'uid=10001', 'gid=10001', 'mode=0755', 'nosuid', 'nodev']))
       throw new Error('Task volume does not match its bounded tmpfs allocation.');
@@ -286,7 +298,7 @@ export async function validateContainer(container: string, profile: ContainerPro
   const keeperVolumes = new Map((keeper?.Mounts ?? []).filter(item => item.Type === 'volume').map(item => [item.Destination, item]));
   if (!keeper?.State?.Running || keeper.Config?.Image !== profile.expectedImage || keeper.Config?.User !== '10001:10001'
     || keeper.Config?.Labels?.['io.codeboost.task-storage'] !== 'keeper'
-    || keeper.Config?.Labels?.['io.codeboost.allocation'] !== allocationId || !keeper.HostConfig?.ReadonlyRootfs
+    || !hasOwnerLabels(keeper.Config?.Labels, storageOwner) || !keeper.HostConfig?.ReadonlyRootfs
     || keeper.HostConfig.Privileged || keeper.HostConfig.NetworkMode !== 'none'
     || !keeper.HostConfig.CapDrop?.map(value => value.toUpperCase()).includes('ALL')
     || (keeper.HostConfig.CapAdd?.length ?? 0) !== 0
@@ -349,6 +361,8 @@ export async function createValidatedContainer(profile: ContainerProfile, timeou
   const remaining = createDeadline(profileTimeout(profile, timeoutMs));
   let createUnsettled = false;
   try {
+    containerLabels.set(profile, Object.freeze({ 'io.codeboost.invocation': profile.ownershipId,
+      ...ownerLabels(agentContainerOwner(assertPhasePolicy(profile.policy), profile.filesystems)) }));
     validateSecrets(profile, secrets);
     await assertContainerProfile(profile, remaining(), signal);
     signal?.throwIfAborted();