@@ -9,7 +9,9 @@ permissions:
 jobs:
   real-docker:
     runs-on: ubuntu-latest
-    # Covers the 10 min image build, 2 min teardown and the per-test Docker budgets.
+    # Covers the 10 min image build and ordinary run times of the Docker-backed files. It does not cover every test
+    # and hook at its own Vitest limit: the five afterAll hooks that sweep allow 46 min between them (#189), which only
+    # a stalled daemon reaches.
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
 
@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     # The probes' own time limits total 33 min (6, 8, 8 and 11). agent-container and agent-supervisor may each spend
     # up to 10 min building the image before their probes; agent-question builds inside its probe's own 11 min. The
-    # teardown hooks have Vitest limits that total 9 min: agent-container 2 after each test and 2 at the end,
-    # agent-supervisor 3 and agent-question 2. That is 62 min, plus setup. These are only Vitest's limits: the afterAll
-    # hooks in agent-container and agent-question call docker through spawnSync with no timeout of their own, and
-    # Vitest's hook timer cannot fire while such a call blocks. The 75 min job limit caps the run.
-    timeout-minutes: 75
+    # teardown hooks have Vitest limits that total 24 min: agent-container 2 after each test and 13 at the end (two
+    # sweeps of up to 5.5 min each, #189), agent-supervisor 7 and agent-question 2. That is 77 min, plus setup. These
+    # are only Vitest's limits: Vitest's hook timer cannot fire while a synchronous docker call blocks, and some calls in
+    # these hooks have no timeout of their own (the sweeps' calls have 30 s each). The 90 min job limit caps the run.
+    timeout-minutes: 90
     steps:
       # Fail at once when the secret is missing, so a missing secret never looks like a passing run.
       - name: Require the Claude token
 
@@ -2591,8 +2591,10 @@ describe('real Docker agent isolation', () => {
       let released: unknown;
       try { removeTaskFilesystems(filesystems); } catch (error) { released = error; console.warn('cleanup: removing the storage failed:', error); }
       removeLabelledObjects('io.codeboost.allocation', owner.allocationId, 'test');
-      if (passed && keeperRemoved.status !== 0) throw new Error(`docker rm --force ${filesystems.keeper} failed: `
-        + (keeperRemoved.error?.message ?? (keeperRemoved.signal ? `killed by ${keeperRemoved.signal}` : keeperRemoved.stderr?.trim())));
+      const keeperFailure = keeperRemoved.status === 0 ? undefined : `docker rm --force ${filesystems.keeper} failed: `
+        + (keeperRemoved.error?.message ?? (keeperRemoved.signal ? `killed by ${keeperRemoved.signal}` : keeperRemoved.stderr?.trim()));
+      if (keeperFailure && !passed) console.warn('cleanup:', keeperFailure);
+      if (keeperFailure && passed) throw new Error(keeperFailure);
       if (passed && released) throw released;
     }
   }, 7 * 60_000);
 
@@ -128,12 +128,19 @@ it('talks to the daemon set when it loaded, though a test changed DOCKER_HOST or
   expect(new Set(lines)).toEqual(new Set([loaded]));
 });
 
-it('takes the daemon set at load, not the default, when one was set', async () => {
+it('takes the daemon set at load, not the default, when one was set, for every call', async () => {
   const root = mkdtempSync(join(tmpdir(), 'codeboost-sweep-')); roots.push(root);
-  const seen = join(root, 'seen');
-  // Records the address each call is given, and answers as Docker 27.4 does for a missing container and an empty `ls`.
-  writeFileSync(join(root, 'docker'), ['#!/bin/sh', `printf '%s|%s\\n' "\${DOCKER_HOST-unset}" "\${DOCKER_CONTEXT-unset}" >> '${seen}'`,
-    'if [ "$2" = inspect ]; then echo; echo "Error response from daemon: No such container: x" >&2; exit 1; fi', 'exit 0'].join('\n'),
+  const seen = join(root, 'seen'), net = 'n'.repeat(64), holder = 'a'.repeat(64), named = 'b'.repeat(64);
+  // Records the address and command of each call. Answers as Docker 27.4 does, in the parts the code reads, for one
+  // swept network with one holder and for a container named x; every other call gets no output and exit 0, as for
+  // `ls` with no match, and the removals' stdout is not read. The network line holds only the fields the sweep reads.
+  writeFileSync(join(root, 'docker'), ['#!/bin/sh', 'for arg; do last="$arg"; done',
+    `printf '%s|%s|%s %s\\n' "\${DOCKER_HOST-unset}" "\${DOCKER_CONTEXT-unset}" "$1" "$2" >> '${seen}'`,
+    `if [ "$1 $2" = "network ls" ]; then printf '%s\\n' '{"ID":"${net}","Name":"swept"}'; exit 0; fi`,
+    `if [ "$1" = ps ]; then printf '%s\\n' ${holder}; exit 0; fi`,
+    `if [ "$1 $2" = "container inspect" ] && [ "$last" = x ]; then printf '%s\\n' '"${named}" "/x"'; exit 0; fi`,
+    `if [ "$1 $2" = "container inspect" ]; then printf '%s\\n' '"${holder}" {"swept":{}}'; exit 0; fi`,
+    'exit 0'].join('\n'),
   { mode: 0o755 });
   // A fresh copy of the module, loaded while a daemon is set, as on a machine with Colima or rootless Docker.
   vi.stubEnv('DOCKER_HOST', 'unix:///codeboost-loaded.sock');
@@ -146,7 +153,12 @@ it('takes the daemon set at load, not the default, when one was set', async () =
     fresh.removeByName('container', 'x', 'test', join(root, 'docker'));
     fresh.removeLabelledObjects(TEST_RUN_LABEL, 'x', 'test', join(root, 'docker'));
   } finally { vi.unstubAllEnvs(); }
-  expect(new Set(readFileSync(seen, 'utf8').split('\n').filter(Boolean))).toEqual(new Set(['unix:///codeboost-loaded.sock|codeboost-loaded']));
+  const lines = readFileSync(seen, 'utf8').split('\n').filter(Boolean).map(line => line.split('|'));
+  // Every kind of call the two make: inspect and removal by name, the listings, the holder lookup and read, the
+  // holders' removal and the network's.
+  expect(new Set(lines.map(line => line[2]))).toEqual(new Set(['container inspect', 'rm --force', 'container ls', 'network ls',
+    'volume ls', 'ps --all', 'network rm']));
+  expect(new Set(lines.map(line => `${line[0]}|${line[1]}`))).toEqual(new Set(['unix:///codeboost-loaded.sock|codeboost-loaded']));
 });
 
 it.each([
 
@@ -317,7 +317,7 @@ describe('CI workflows', () => {
     const job = live.jobs['live-probes']!;
     // No `defaults`, `env`, `strategy` or `container`: any of them could change what the steps run.
     expect(Object.keys(job).toSorted()).toEqual(['runs-on', 'steps', 'timeout-minutes']);
-    expect(job).toMatchObject({ 'runs-on': 'ubuntu-latest', 'timeout-minutes': 75 });
+    expect(job).toMatchObject({ 'runs-on': 'ubuntu-latest', 'timeout-minutes': 90 });
     const token = { CLAUDE_CODE_OAUTH_TOKEN: '${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}' };
     expect(job.steps.map(step => Object.keys(step).toSorted())).toEqual([['env', 'name', 'run'], ['uses'], ['uses', 'with'],
       ['run'], ['env', 'name', 'run'], ['name', 'run']]);