@@ -1,9 +1,14 @@
 import { spawnSync } from 'node:child_process';
-import { beforeAll, describe, expect, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { captureInvocation, type Phase } from '../agents/contract.ts';
 import { buildAgentImage } from '../agents/container/image.ts';
+import { RUNNER_LABEL } from '../agents/labels.ts';
 import { createIsolationProbeCommand, createPhasePolicy, type IsolationProbe } from '../agents/policy.ts';
-const TEST_RUNNER_OWNER = '0123456789abcdef0123456789abcdef';
+import { removeRunnerObjects } from './fixtures/docker-sweep.ts';
+// Each run has its own runner owner, and its probe containers carry it, so the sweep after this file removes this
+// run's leftovers and never another run's.
+const TEST_RUNNER_OWNER = randomBytes(16).toString('hex');
 
 // The gate is only meaningful if its probes fail when isolation breaks. Each case runs the exact production probe
 // script in a container deliberately built without one protection, bypassing the profile and its validator, and
@@ -25,18 +30,29 @@ const probeScript = (phase: Phase, probe: IsolationProbe) => {
 // A committed repository whose metadata lives on its own filesystem, as in a real task container.
 const seedRepository = 'git init -q /work && git -C /work -c user.name=gate -c user.email=gate@example.com '
   + 'commit -q --allow-empty -m seed';
-const runBroken = (mounts: readonly string[], script: string, env: readonly string[] = []) => spawnSync('docker', ['run',
-  '--rm', '--network=none', '--user', '10001:10001', '--env', 'HOME=/home/codeboost', ...env, '--workdir', '/work', ...mounts,
-  ...(mounts.some(mount => mount.startsWith('/home/codeboost:')) ? []
-    : ['--tmpfs', '/home/codeboost:rw,size=1048576,nr_inodes=128,uid=10001,gid=10001,mode=0700']),
-  '--entrypoint', 'sh', imageId, '-c', `${seedRepository} && ${script}`],
-{ encoding: 'utf8', timeout: 120_000, stdio: ['ignore', 'pipe', 'pipe'] });
+// A client killed by SIGTERM passes the signal to the container's shell, which ignores it, and waits; SIGKILL ends the
+// client at the timeout instead, and leaves the container to the sweep, which finds it by its runner label. A killed
+// client has no exit status, which the cases' `not.toBe(0)` checks would accept, so it throws: a hung probe fails.
+const runBroken = (mounts: readonly string[], script: string, env: readonly string[] = []) => {
+  const result = spawnSync('docker', ['run', '--rm', '--label', `${RUNNER_LABEL}=${TEST_RUNNER_OWNER}`,
+    '--network=none', '--user', '10001:10001', '--env', 'HOME=/home/codeboost', ...env, '--workdir', '/work', ...mounts,
+    ...(mounts.some(mount => mount.startsWith('/home/codeboost:')) ? []
+      : ['--tmpfs', '/home/codeboost:rw,size=1048576,nr_inodes=128,uid=10001,gid=10001,mode=0700']),
+    '--entrypoint', 'sh', imageId, '-c', `${seedRepository} && ${script}`],
+  { encoding: 'utf8', timeout: 120_000, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'] });
+  if (result.error || result.status === null)
+    throw new Error(`docker run did not exit: ${result.error?.message ?? `signal ${result.signal}`}`,
+      { cause: result.error });
+  return result;
+};
 const tmpfs = (target: string, options: string) => ['--tmpfs', `${target}:rw,uid=10001,gid=10001,${options}`];
 const bounded = tmpfs('/work', 'size=16m,nr_inodes=512');
 const writableMetadata = tmpfs('/work/.git', 'size=16m,nr_inodes=512');
 const boundedScratch = tmpfs('/tmp', 'size=32m,nr_inodes=4096');
 
 beforeAll(() => { imageId = buildAgentImage(); }, 10 * 60_000);
+// The file has no other cleanup: a probe container whose client timed out may still be running.
+afterAll(() => removeRunnerObjects(TEST_RUNNER_OWNER), 4 * 60_000);
 
 describe('isolation gate detects breaches', () => {
   it.each([
 
@@ -1,5 +1,5 @@
 import { execFileSync, spawnSync } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -9,7 +9,10 @@ import { assertVendorNetwork, createVendorNetwork, removeVendorNetwork, VENDOR_H
   VendorNetworkCreationCleanupError,
   type VendorNetwork } from '../agents/network/network.ts';
 import { captureInvocation, type InvocationInput } from '../agents/contract.ts';
-const TEST_RUNNER_OWNER = '0123456789abcdef0123456789abcdef';
+import { removeRunnerObjects } from './fixtures/docker-sweep.ts';
+// Each run has its own runner owner, so the sweep after this file removes only what this run left behind. Network and
+// proxy names are random, so the fixed attempt IDs below reach only labels, where this owner tells runs apart.
+const TEST_RUNNER_OWNER = randomBytes(16).toString('hex');
 
 let imageId = '', network: VendorNetwork, invocation: InvocationInput;
 const docker = (...args: string[]) => execFileSync('docker', args, {
@@ -31,7 +34,15 @@ beforeAll(async () => {
   network = await createVendorNetwork(invocation, imageId, randomUUID());
 }, 10 * 60_000);
 // If setup failed there is no network, and a teardown error would hide the setup failure.
-afterAll(async () => { if (network) await removeVendorNetwork(network); }, 60_000);
+afterAll(async () => {
+  try { if (network) await removeVendorNetwork(network); }
+  finally {
+    // Then remove whatever this run still owns, even when a test failed or the removal above threw. Objects a test
+    // makes without the runner label are not found here; those tests remove their own. It may not run before a hook
+    // timeout.
+    removeRunnerObjects(TEST_RUNNER_OWNER);
+  }
+}, 4 * 60_000);
 
 describe('vendor-only egress', () => {
   it('keeps failed allocation and its cleanup inside the caller deadline', async () => {
 
@@ -1,6 +1,6 @@
-import { randomUUID } from 'node:crypto';
-import { execFile, execFileSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { execFile, execFileSync, spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
@@ -14,11 +14,13 @@ import { attemptRef, openRunnerRepository } from '../runner/runner-repository.ts
 import { ReviewService } from '../runner/review.ts';
 import { Store } from '../runner/store.ts';
 import { createTaskWorkspace } from '../runner/workspace.ts';
+import { removeRunnerObjects } from './fixtures/docker-sweep.ts';
 import { fixtureGit as git } from './fixtures/git.ts';
 
 // F2b against the real lane D (#87): each item runs in fresh task storage cloned from the runner-owned repository, an
 // agent edits the work volume, and the runner's audited commit is taken into that repository for the next item.
-const RUNNER_OWNER = '0123456789abcdef0123456789abcdef';
+// Each run has its own runner owner, so the sweep after this file removes only what this run left behind.
+const RUNNER_OWNER = randomBytes(16).toString('hex');
 const identity = { repositoryId: 'repo', taskId: 'task', planId: 'plan' };
 const plan: Plan = { schema_version: 1, issue: 1, revision: 1, summary: 'Two items', questions: [], items: [
   { id: 'P1', title: 'First', intent: 'Change a', files: [{ path: 'a.ts', kind: 'edit', renamed_from: null, change: 'x' }], acceptance: [{ type: 'check', text: 'a' }], depends_on: [] },
@@ -29,9 +31,15 @@ let imageId = '';
 const roots: string[] = [], stores: Store[] = [];
 beforeAll(() => { imageId = buildAgentImage(); }, 10 * 60_000);
 afterAll(() => {
-  for (const store of stores) store.close();
-  for (const root of roots) rmSync(root, { recursive: true, force: true });
-});
+  try {
+    for (const store of stores) store.close();
+    for (const root of roots) rmSync(root, { recursive: true, force: true });
+  } finally {
+    // Then remove the task storage this run still owns, even when a test failed or the cleanup above threw. The path
+    // identity probe carries no owner labels, so it is not found here. It may not run before a hook timeout.
+    removeRunnerObjects(RUNNER_OWNER);
+  }
+}, 4 * 60_000);
 const docker = (...args: string[]) => execFileSync('docker', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 
 async function setup(agent: Record<string, string>) {
@@ -148,22 +156,63 @@ describe('real task workspace (#87)', () => {
 });
 
 describe('task storage path identity (#162)', () => {
-  // Only volumes made with the probe's own tmpfs options count, so other users of the daemon do not change the result.
-  // Precondition: no other probe runs on this daemon during the test (another runner's startup, or this file run from
-  // another checkout); its short-lived container and volume would match too. The docker project runs files one at a
-  // time, and no other file probes.
-  const probeVolumes = () => new Set(docker('volume', 'ls', '-q').split('\n').filter(Boolean).filter(volume => {
-    try { return docker('volume', 'inspect', '--format', '{{json .Options}}', volume).includes('size=1048576,nr_inodes=64,'); }
-    catch { return false; } // removed between the listing and the inspect
-  }));
+  // The probe names its container itself and gives it an anonymous volume, with no labels. This test finds both from
+  // the name the probe gave: a shim on PATH records it, and the daemon's events give that container's ID and the
+  // volumes mounted in it. Another probe on the daemon (another runner's startup, or this file run from another
+  // checkout) or a container a dead runner left behind does not count.
+  async function watchedProbe() {
+    const shim = mkdtempSync(join(tmpdir(), 'docker-shim-')); roots.push(shim);
+    const names = join(shim, 'names'), realDocker = execFileSync('sh', ['-c', 'command -v docker'], { encoding: 'utf8' }).trim();
+    // Not a fake: it records the argument after each separate `--name` (the form the probe uses; if that changed, no name
+    // is recorded and the test fails) and runs the real docker with the same arguments, so every exit status, stdout
+    // and stderr the probe reads is Docker's own.
+    writeFileSync(join(shim, 'docker'), ['#!/bin/sh', 'prev=',
+      `for arg; do if [ "$prev" = --name ]; then printf '%s\\n' "$arg" >> '${names}'; fi; prev="$arg"; done`,
+      `exec '${realDocker}' "$@"`].join('\n'), { mode: 0o755 });
+    // --since replays from the daemon's event buffer, so nothing between this call and the stream's start is lost. The
+    // minute of margin covers a daemon clock behind this one; it is harmless, as events are matched by the probe's own
+    // name and IDs.
+    const events: { Type: string; Action: string; Actor: { ID: string; Attributes: Record<string, string> } }[] = [];
+    const stream = spawn(realDocker, ['events', '--since', String(Math.floor(Date.now() / 1000) - 60), '--format',
+      '{{json .}}', '--filter', 'type=container', '--filter', 'type=volume'], { stdio: ['ignore', 'pipe', 'inherit'] });
+    let buffered = '';
+    stream.stdout.setEncoding('utf8').on('data', (chunk: string) => {
+      const lines = (buffered + chunk).split('\n'); buffered = lines.pop()!;
+      for (const line of lines) if (line) events.push(JSON.parse(line));
+    });
+    const path = process.env.PATH;
+    process.env.PATH = `${shim}:${path}`;
+    try {
+      const identity = await probeTaskStoragePathIdentity(imageId);
+      const recorded = readFileSync(names, 'utf8').split('\n').filter(Boolean);
+      expect(recorded).toEqual([expect.stringMatching(/^codeboost-path-identity-[0-9a-f-]{36}$/)]);
+      const container = () => events.find(event => event.Type === 'container' && event.Action === 'create'
+        && event.Actor.Attributes.name === recorded[0])?.Actor.ID;
+      const volumes = () => [...new Set(events.filter(event => event.Type === 'volume' && event.Action === 'mount'
+        && event.Actor.Attributes.container === container()).map(event => event.Actor.ID))];
+      // Wait for the daemon to report the container and its volumes destroyed, for up to 10 s; absence is still
+      // proved by inspect below, so a destroy that never comes fails there.
+      const destroyed = (type: string, id: string | undefined) =>
+        events.some(event => event.Type === type && event.Action === 'destroy' && event.Actor.ID === id);
+      for (const until = performance.now() + 10_000; performance.now() < until;) {
+        if (container() && volumes().length && destroyed('container', container())
+          && volumes().every(volume => destroyed('volume', volume))) break;
+        await new Promise(resolve => setTimeout(resolve, 100));
+      }
+      return { identity, container: container(), volumes: volumes() };
+    } finally { process.env.PATH = path; stream.kill(); }
+  }
   it('measures the tmpfs the agent edits, whatever the host folds, and leaves no container or volume behind', async () => {
-    const before = probeVolumes();
+    const probe = await watchedProbe();
     // Task storage is a tmpfs in the daemon's Linux kernel: case-sensitive, and names are compared as bytes. A macOS
     // host folder would report the reverse, which is why the probe does not read the host.
-    expect(await probeTaskStoragePathIdentity(imageId)).toEqual({ caseSensitive: true, unicodeNormalization: 'none' });
+    expect(probe.identity).toEqual({ caseSensitive: true, unicodeNormalization: 'none' });
+    // The events found the probe's container and its one volume, so the absence checks below look at real objects.
+    expect(probe.container).toMatch(/^[0-9a-f]{64}$/);
+    expect(probe.volumes).toEqual([expect.stringMatching(/^[0-9a-f]{64}$/)]);
     // In any state: a container created but never started would outlive --rm.
-    expect(docker('ps', '-aq', '--filter', 'name=codeboost-path-identity-')).toBe('');
-    expect([...probeVolumes()].filter(volume => !before.has(volume))).toEqual([]);
+    expect(() => docker('container', 'inspect', probe.container!)).toThrow(/No such container/);
+    expect(() => docker('volume', 'inspect', probe.volumes[0]!)).toThrow(/no such volume/i);
   }, 120_000);
   it('removes a never-started probe container and its volume with the cleanup\'s own rm', () => {
     // The failure path's claim: a container created but never started (a killed client) loses its anonymous volume to