From 513aee3e04d70a3d58f7ac05398cc9bcb7ff281b Mon Sep 17 00:00:00 2001
From: jsboige <jsboige@gmail.com>
Date: Wed, 2 Sep 2026 20:10:43 +0200
Subject: [PATCH 1/2] ci(runner,#14347): garde supervisor_pids via $$ (fix
 crash-loop systemd), HOLDER_NAME par defaut, Wants=docker.service

- supervise.sh : le garde d'idempotence s'auto-matchait sous systemd ($PPID=1
  herite du lancement par PID 1, bash ne le recompute pas dans les subshells)
  -> crash-loop du service. Exclusion par $$ (PID du bash principal, stable
  dans les subshells). Mesure : self=1 + out=propre PID.
- persist/launch-runner.sh : HOLDER_NAME derive de la machine par defaut
  (hold-$(hostname).ps1), FATAL si absent. Valide en live (no-op idempotent).
- persist/coursia-runner.service : Wants= au lieu de Requires= (docker en
  echec au boot = retry, pas sortie de liste).
---
 .../linux-runner/persist/coursia-runner.service  |  7 ++++++-
 .../docker/linux-runner/persist/launch-runner.sh | 16 ++++++++++++----
 scripts/ci/docker/linux-runner/supervise.sh      | 12 ++++++++----
 3 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/scripts/ci/docker/linux-runner/persist/coursia-runner.service b/scripts/ci/docker/linux-runner/persist/coursia-runner.service
index 526415af62..1209d6882b 100644
--- a/scripts/ci/docker/linux-runner/persist/coursia-runner.service
+++ b/scripts/ci/docker/linux-runner/persist/coursia-runner.service
@@ -7,7 +7,12 @@
 # N slots (po-2024 -> 4) vivent dans le wrapper coursia-runner-start.sh.
 [Unit]
 Description=CoursIA Linux runners supervisor (docker slots)
-Requires=docker.service
+# Wants= au lieu de Requires= (cf #14347 item 2, reserve Hermes sur #14341) :
+# un docker.service en echec au boot DOIT retarder le service et le maintenir
+# en retry (Restart=always), pas le faire sortir de la liste des unites.
+# Le superviseur est resilient par conception : sa boucle de slots retente
+# docker toutes les 15 s, et le holder reprend au prochain logon.
+Wants=docker.service
 After=docker.service
 
 [Service]
diff --git a/scripts/ci/docker/linux-runner/persist/launch-runner.sh b/scripts/ci/docker/linux-runner/persist/launch-runner.sh
index f5357609b1..823be7116c 100644
--- a/scripts/ci/docker/linux-runner/persist/launch-runner.sh
+++ b/scripts/ci/docker/linux-runner/persist/launch-runner.sh
@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
 # Pont logon -> holder : action de la tache planifiee "CoursIA-LinuxRunners"
-# (InteractiveToken, LeastPrivilege). Copie de reference genrique -- sur
-# po-2024 l'original vit sous %USERPROFILE%\.coursia-runner\launch-myia-po-2024.sh
-# et appelle le holder machine-local hold-myia-po-2024.ps1.
+# (InteractiveToken, LeastPrivilege). Copie de reference genrique -- le pont
+# appelle le holder via HOLDER_NAME, derive par defaut de la machine
+# (hold-$(hostname).ps1) : la recette §Persistance est copy-paste sur une
+# machine tierce, aucune edition de script (cf #14347 item 1, reserve Hermes
+# sur #14341).
 #
 #   schtasks action : C:\Program Files\Git\bin\bash.exe -lc "<ce script> 4"
 #
@@ -16,7 +18,13 @@ exec >>"$LOG" 2>&1
 echo "=== $(date -u +%Y-%m-%dT%H:%M:%SZ) pont logon->holder (args: $*) ==="
 
 # cygpath : powershell.exe -File exige un chemin Windows, $HOME est posix.
-WINPS1="$(cygpath -w "$HOME/.coursia-runner/hold-myia-po-2024.ps1")"
+HOLDER_NAME="${HOLDER_NAME:-hold-$(hostname).ps1}"
+WINPS1="$(cygpath -w "$HOME/.coursia-runner/$HOLDER_NAME")"
+if [ ! -f "$WINPS1" ]; then
+  echo "FATAL: holder $WINPS1 introuvable -- deployer le ps1 ou surcharger HOLDER_NAME" >&2
+  exit 2
+fi
+echo "holder=$HOLDER_NAME"
 powershell.exe -NoProfile -ExecutionPolicy Bypass -File "$WINPS1"
 rc=$?
 echo "holder spawn -> rc=$rc"
diff --git a/scripts/ci/docker/linux-runner/supervise.sh b/scripts/ci/docker/linux-runner/supervise.sh
index a7daeb40d8..b5af46490e 100644
--- a/scripts/ci/docker/linux-runner/supervise.sh
+++ b/scripts/ci/docker/linux-runner/supervise.sh
@@ -70,10 +70,14 @@ die() { echo "ERREUR: $*" >&2; exit 1; }
 # -- sans lui, un `start 4` rend 5 PIDs et le defense-positif echoue.
 # Sortie : liste espacee de PIDs (vide si aucun superviseur).
 supervisor_pids() {
-  ps -ef 2>/dev/null \
-    | grep '[s]upervise\.sh start' \
-    | awk '$3==1 {print $2}'
-  return 0
+  local me out
+  # #14347 : `$$` = PID du bash principal, stable dans les subshells.
+  # `$PPID` vaut 1 sous systemd (herite du lancement par PID 1 ; bash ne le
+  # recompute pas pour les subshells) -- mesure : self=PPID=1 avec out=mon
+  # propre PID, donc le garde s'auto-matchait et le service crash-loopait.
+  me="$$"
+  out="$(ps -ef 2>/dev/null | grep '[s]upervise\.sh start' | awk -v me="$me" '$2 != me && $3==1 {print $2}')"
+  printf '%s\n' "$out"
 }
 
 fetch_token() {

From eabe3382bb83e735eed80ca7178eaf6fc406a5b4 Mon Sep 17 00:00:00 2001
From: jsboige <jsboige@gmail.com>
Date: Wed, 2 Sep 2026 20:17:44 +0200
Subject: [PATCH 2/2] =?UTF-8?q?ci(runner,#14288):=208=20slots=20=E2=80=94?=
 =?UTF-8?q?=20ExecStart=20start=208=20+=20.gitignore=20artefact=20gh=20run?=
 =?UTF-8?q?time?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- persist/coursia-runner.service : ExecStart start 8 (dispatch capacite 2026-09-02,
  seul goulot CI : 36 queued / 19 busy au moment du dispatch). N porte par argv.
- .gitignore : .local/state/gh/device-id est un artefact runtime de la stack
  (regenerable, non-secret) -- ecrit dans l'arbre pendant les cycles conteneur.
---
 scripts/ci/docker/linux-runner/.gitignore                    | 3 +++
 .../ci/docker/linux-runner/persist/coursia-runner.service    | 5 +++--
 2 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 scripts/ci/docker/linux-runner/.gitignore

diff --git a/scripts/ci/docker/linux-runner/.gitignore b/scripts/ci/docker/linux-runner/.gitignore
new file mode 100644
index 0000000000..5217c7a578
--- /dev/null
+++ b/scripts/ci/docker/linux-runner/.gitignore
@@ -0,0 +1,3 @@
+# Runtime gh CLI artifact spilled by the runner stack (device-id, regenerable) --
+# written into this dir during container/job cycles; never commit.
+.local/
\ No newline at end of file
diff --git a/scripts/ci/docker/linux-runner/persist/coursia-runner.service b/scripts/ci/docker/linux-runner/persist/coursia-runner.service
index 1209d6882b..bdb6670ee7 100644
--- a/scripts/ci/docker/linux-runner/persist/coursia-runner.service
+++ b/scripts/ci/docker/linux-runner/persist/coursia-runner.service
@@ -4,7 +4,8 @@
 # /etc/systemd/system/coursia-runner.service (systemctl enable --now).
 #
 # Parametres machine : NAME_PREFIX (po-2024 -> myia-po-2024-linux-docker) et
-# N slots (po-2024 -> 4) vivent dans le wrapper coursia-runner-start.sh.
+# N slots (po-2024 -> 8, dispatch capacite #14288 2026-09-02) vivent dans le
+# wrapper coursia-runner-start.sh (N porte par l'argument ExecStart).
 [Unit]
 Description=CoursIA Linux runners supervisor (docker slots)
 # Wants= au lieu de Requires= (cf #14347 item 2, reserve Hermes sur #14341) :
@@ -17,7 +18,7 @@ After=docker.service
 
 [Service]
 Type=simple
-ExecStart=/usr/local/bin/coursia-runner-start.sh start 4
+ExecStart=/usr/local/bin/coursia-runner-start.sh start 8
 ExecStop=/usr/local/bin/coursia-runner-start.sh stop
 Restart=always
 RestartSec=30