docs(runner): what the age bound prevents; forks and tmp prefixes

README.md

@@ -13,7 +13,7 @@ Inspired by [community-scripts/ProxmoxVE](https://github.com/community-scripts/P
 | [nexus](ct/nexus.sh) | App LXC for [nexus](https://gitea.luki-net.org/l.kirchner/nexus-hub) (Family Knowledge Hub): host-mode runner (label `nexus`, CI + deploy), service skeleton, `/opt/nexus` layout. Runtime is provisioned/extended via [`install/nexus-runtime.sh`](install/nexus-runtime.sh) (idempotent, re-runnable) | ✅ in production |
 | [nexus-db](ct/nexus-db.sh) | PostgreSQL 16 + pgvector for nexus — least-privilege role, pg_hba allowlist (only the nexus LXC), DSN handed over via credentials file | ✅ in production |
 | [authentik](ct/authentik.sh) | Central homelab IdP (official Docker Compose via LXC nesting) — headless bootstrap admin **and** API token for agent-driven blueprint configuration, blueprints mount, permanent auth domain (WebAuthn RP-ID) | ✅ in production |
-| [runner](ct/runner.sh) | General **instance-wide** Gitea Actions runner (label `homelab`) — Docker for throwaway CI test containers, deliberately **no** sudoers/deploy rights. A daily cleaner ([`install/runner-cleanup.sh`](install/runner-cleanup.sh), `ci-runner-cleanup.timer`) removes what cancelled jobs left behind: only what a project claims under `/etc/ci-runner-cleanup.d/` (containers by its label `org.luki-net.project` and name, tmp entries by its prefix) and only past 4 h, above act_runner's 3 h job timeout (containers from their last start, tmp entries by ctime) | ✅ in production |
+| [runner](ct/runner.sh) | General **instance-wide** Gitea Actions runner (label `homelab`) — Docker for throwaway CI test containers, deliberately **no** sudoers/deploy rights. A daily cleaner ([`install/runner-cleanup.sh`](install/runner-cleanup.sh), `ci-runner-cleanup.timer`) removes what cancelled jobs left behind: only what a project claims under `/etc/ci-runner-cleanup.d/` (containers by its label `org.luki-net.project` and name, tmp entries by its prefix) and only past 4 h, above act_runner's 3 h job timeout (containers from their last start, tmp entries by ctime); `runner-install.sh` sets it up on new runners; runners installed before it do not have it until it is set up there | ✅ in production |
 
 Run any one-liner on a Proxmox VE host as root:
 

install/runner-cleanup.sh

@@ -41,7 +41,8 @@
 # for patchmgr on 11.10.2026: the repository is private, has no forks, and
 # only its owner and bots contribute. When it opens up for forks, its
 # deploy/testdb.sh gets a repository label as well, and this script filters
-# on that one too.
+# on that one too; tmp entries carry no label, so the prefix counter-check
+# gives its directory has to name the repository then as well.
 #
 # Age: act_runner v0.2.13 ends a job after 3 h (runner.timeout, measured on
 # runner-01..03 on 08.10.2026: no config file, LoadDefault sets 3 h), and
@@ -71,9 +72,10 @@ DRY_RUN=${DRY_RUN:-}
 CONF_DIR=${CONF_DIR:-/etc/ci-runner-cleanup.d}
 TMP_ROOT=${TMP_ROOT:-/tmp}
 
-# At most three digits and no leading zero: a larger number would overflow
-# the seconds below to anything, 0 included, and a leading zero reads as
-# octal.
+# At most three digits and no leading zero. Without an upper bound a large
+# enough number (4611686018427387904, for one) overflows the seconds below
+# to anything, 0 included; 999 h is far below that and longer than any age
+# worth waiting for. A leading zero reads as octal.
 if ! [[ "$MAX_AGE_HOURS" =~ ^[1-9][0-9]{0,2}$ ]] || [ "$MAX_AGE_HOURS" -le "$JOB_TIMEOUT_HOURS" ]; then
 	echo "MAX_AGE_HOURS must be a whole number from $((JOB_TIMEOUT_HOURS + 1)) to 999, above the job timeout of ${JOB_TIMEOUT_HOURS} h, not '$MAX_AGE_HOURS'" >&2
 	exit 1