elanous 0.2.21 → 0.2.23

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -16,13 +16,14 @@
  * 풀을 안 주면 종전처럼 «현재 컨텍스트» 하나다(동작 불변).
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, utimesSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { debug } from '../../debug/log.js';
 import { PodLeaseAdmission, type PodLeasePredecessor, type PodLeaseRelease } from '../../pod-lease/admission.js';
 import { predecessorState, type PredecessorState } from '../../pod-lease/dependency-state.js';
-import { HostPoolLease, leaseHasPendingPod } from '../../pod-lease/host-lease.js';
+import { HostPoolLease, hostLeaseBaseDir, leaseHasPendingPod } from '../../pod-lease/host-lease.js';
+import { acquireLockAsync, acquireLockSync } from '../../storage/file-lock.js';
 import { harnessCpuSlotsBesideGate, measurePoolLease, recommendConcurrency, type PodLeaseMember, type PoolDnsProbe, type PoolLeaseRecommendation } from './pod-lease.js';
 
 export interface PodPoolMember {
@@ -98,6 +99,12 @@ export function registryImageRef(member: PodPoolMember, commit: string | null, r
   } catch { return null; }
 }
 
+/** IMAGE-ONE-SOURCE: 이 멤버의 노드에 레지스트리 컨테이너가 있나(syncPoolImages 의 판정과 같은 명령). 로컬 멤버는 false. */
+export function memberHasRegistry(member: PodPoolMember, run: RemoteRun = defaultRemoteRun): boolean {
+  if (!member.sshHost) return false;
+  return run(member.sshHost, `docker inspect ${memberRegistry(member).split(':')[0]} >/dev/null 2>&1`).status === 0;
+}
+
 /** 노드 이미지의 스킬 해시 라벨(`elanous.pod-skills`). */
 export function remoteImageSkillsDigest(member: PodPoolMember, image: string, run: RemoteRun = defaultRemoteRun): string | null {
   if (!member.sshHost) return null;
@@ -275,7 +282,14 @@ export class PodPoolScheduler {
       const decision = measured.recommended === null ? measured : { ...measured, recommended: Math.max(0, measured.recommended - others + (transferIsOther ? 1 : 0)) };
       // An unknown reading cannot erase permits already granted: on recovery,
       // the first healthy recommendation must still account for their slots.
-      if (decision.recommended === null) return decision;
+      // GATE-ADMIT-UNMEASURED(10-09 대표 «판 발행 문제없게»): 측정이 «?»(예: 부하 노드의 DNS 탐침)여도 게이트 조각은 하나씩 들어간다 —
+      //   게이트가 측정 복구를 기다리며 조각마다 승인 시간 초과를 물지 않게. 실제로 자리가 없으면 스케줄러가 Pending 으로 둔다(잃는 것 없음).
+      if (decision.recommended === null) {
+        if (!gate) return decision;
+        const active = this.gateAdmission.snapshot().active;
+        debug.log('pod.pool', 'gate-admit-unmeasured', { active, reason: decision.reason ?? null });
+        return { ...decision, recommended: active + 1 };
+      }
       // A new launch consumes a measured additional slot. Compare consecutive
       // measurements so repeated stale readings cannot grant that slot again.
       this.budget = Math.max(0, this.budget + decision.recommended - (this.initialized ? this.lastFree : 0));
@@ -323,7 +337,7 @@ export class PodPoolScheduler {
         const pendingJobs = this.lastRaw?.pendingJobs ?? [];
         const lease = transferred ?? (free !== null && free > 0 ? this.hostLease.tryReserve((others) =>
           others - this.hostLease.live().filter((r) => leaseHasPendingPod(r, pendingJobs) &&
-            (r.pid !== process.pid || r.startedAt !== this.hostLease.selfStart())).length < free) : null);
+            (r.pid !== process.pid || r.startedAt !== this.hostLease.selfStart())).length < free) : (gate && free === null ? this.hostLease.tryReserve(() => true) : null));
         if (lease) {
           let hostReleased = false;
           const releaseHost = () => { if (!hostReleased) { hostReleased = true; lease(); } };
@@ -473,13 +487,64 @@ type LocalImageInspect = (image: string) => { status: number | null; stdout: str
 /** `docker save | ssh docker load` 한 번. 시험이 실제 전송 대신 호출 횟수만 센다. */
 type ImageShip = (member: PodPoolMember, image: string) => { status: number | null; stderr: string };
 
+const IMAGE_SHIP_TIMEOUT_MS = 1_800_000;
+const REMOTE_RUN_TIMEOUT_MS = 900_000;
+
+/**
+ * Runs a shell pipeline in its «own process group» and kills the whole group, not just bash (flood 10-08:
+ * 186 orphaned `docker save | gzip | ssh` pipes after runs timed out or died).
+ *   - `perl setpgrp` gives the pipeline a group of its own, so `kill 0` cannot reach the caller.
+ *   - The pipeline runs in the background and bash `wait`s, because bash defers a trap until a «foreground»
+ *     command finishes — a TERM from the spawnSync timeout would otherwise wait out `docker save`.
+ *   - A watchdog in the group polls the parent pid: if the caller dies (kill -9 included), the group goes too.
+ *   - On a normal finish the group is swept as well (watchdog and its `sleep`).
+ * ⚠️ The background pipeline's stdin is /dev/null (non-interactive bash) — fine for `docker save`.
+ */
+export function runProcessGroupPipeline(pipeline: string, opts: { timeoutMs: number; parentPid?: number; watchIntervalSec?: number }): { status: number | null; stderr: string; timedOut: boolean } {
+  const script = [
+    `trap 'trap "" TERM HUP INT; kill -TERM 0 2>/dev/null; exit 143' TERM HUP INT`,
+    `( while kill -0 "$ELANOUS_PIPE_PARENT" 2>/dev/null; do sleep "$ELANOUS_PIPE_WATCH"; done; kill -TERM 0 2>/dev/null ) &`,
+    `( set -o pipefail; eval "$ELANOUS_PIPE_CMD" ) &`,
+    'wait $!',
+    'rc=$?',
+    `trap "" TERM HUP INT`,
+    'kill -TERM 0 2>/dev/null',
+    'exit $rc',
+  ].join('\n');
+  const r = spawnSync('perl', ['-e', 'setpgrp(0,0) or die "setpgrp: $!"; exec @ARGV or die "exec: $!"', 'bash', '-c', script], {
+    encoding: 'utf8',
+    timeout: opts.timeoutMs,
+    killSignal: 'SIGTERM',
+    env: { ...process.env, ELANOUS_PIPE_CMD: pipeline, ELANOUS_PIPE_PARENT: String(opts.parentPid ?? process.pid), ELANOUS_PIPE_WATCH: String(opts.watchIntervalSec ?? 2) },
+  });
+  const timedOut = (r.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT';
+  return { status: r.status, stderr: (r.stderr ?? '') + (timedOut ? ` · timed out after ${opts.timeoutMs}ms (process group killed)` : r.error ? ` · ${String(r.error)}` : ''), timedOut };
+}
+
 function defaultImageShip(member: PodPoolMember, image: string): { status: number | null; stderr: string } {
-  const ship = spawnSync('bash', ['-c', `set -o pipefail; docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`], { encoding: 'utf8', timeout: 1_800_000 });
-  return { status: ship.status, stderr: ship.stderr ?? '' };
+  const ship = runProcessGroupPipeline(`docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`, { timeoutMs: IMAGE_SHIP_TIMEOUT_MS });
+  return { status: ship.status, stderr: ship.stderr };
+}
+
+/** This machine's image ID (`sha256:…` — `docker save | docker load` keeps it). Null when unreadable. */
+function defaultLocalImageId(image: string): { status: number | null; stdout: string } {
+  const r = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000 });
+  return { status: r.status, stdout: r.stdout ?? '' };
+}
+
+function imageIdFrom(r: { status: number | null; stdout: string }): string | null {
+  const v = r.status === 0 ? r.stdout.trim() : '';
+  return /^sha256:[0-9a-f]{64}$/.test(v) ? v : null;
+}
+
+/** The remote node's image ID. Null when unreadable — never read as «same». */
+export function remoteImageId(member: PodPoolMember, image: string, run: RemoteRun = defaultRemoteRun): string | null {
+  if (!member.sshHost) return null;
+  return imageIdFrom(run(member.sshHost, `docker image inspect ${image} --format '{{.Id}}'`));
 }
 
 export function defaultRemoteRun(host: string, script: string): { status: number | null; stdout: string; stderr: string } {
-  const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: 900_000 });
+  const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: REMOTE_RUN_TIMEOUT_MS });
   return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error ? String(r.error) : '') };
 }
 
@@ -491,29 +556,100 @@ export function remoteImageCommit(member: PodPoolMember, image: string, run: Rem
   return v && v !== '<no value>' ? v : null;
 }
 
+/** Cross-process lock options for one image ship per host (tests shrink them). */
+export interface ImageShipLockOptions {
+  /** Directory for the per-host lock files. Default = the machine-wide pod lease dir (shared by every universe on this machine). */
+  dir?: string;
+  retryMs?: number;
+  /** A lock older than this is a crash leftover. Default = ship timeout ⊕ import timeout ⊕ 2 min. */
+  staleMs?: number;
+  maxTries?: number;
+}
+
+export function imageShipLockPath(host: string, dir: string = join(hostLeaseBaseDir(), 'image-ship')): string {
+  return join(dir, `${host.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120) || 'host'}.lock`);
+}
+
 /**
  * 원격 노드에 이 기계의 이미지를 보낸다(판이 다를 때만) — `docker save | ssh docker load` ⊕ `k3d image import`.
  * ⛔ Pod 의 elanous 는 이미지 판이다(피드백: Pod 는 main 이 아니라 이미지를 돈다) — 노드마다 판이 다르면 같은 골이 노드마다 다른 코드로 돈다.
+ * 🩸 10-08 flood: many runs saw the same stale label at once and all shipped together — ssh refused them
+ *   (`Session open refused by peer` · `kex_exchange_identification`). Now:
+ *   ① «same image» = commit label OR (label missing) the same image ID on both sides — never ship it twice.
+ *   ② one ship per host, under a cross-process lock; whoever gets the lock re-checks and skips if another process shipped.
+ *   ③ the ship pipeline runs in its own process group (`runProcessGroupPipeline`).
  */
-export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; transfer?: ImageShip } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
-  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, transfer: run.transfer };
+export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; inspectId?: LocalImageInspect; transfer?: ImageShip; lock?: ImageShipLockOptions } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
+  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, inspectId: run.inspectId, transfer: run.transfer, lock: run.lock };
   const remote = opts.run ?? defaultRemoteRun;
   const inspect = opts.inspect ?? defaultLocalImageInspect;
+  // An injected label inspect without an ID inspect = a hermetic caller: the ID check is off (no real docker call).
+  const inspectId = opts.inspectId ?? (opts.inspect ? null : defaultLocalImageId);
   const transfer = opts.transfer ?? defaultImageShip;
   if (!member.sshHost) return { ok: true, action: 'local', detail: 'this machine' };
+  const host = member.sshHost;
   const before = remoteImageCommit(member, image, remote);
   if (localCommit && before === localCommit) return { ok: true, action: 'fresh', detail: before.slice(0, 12) };
   // 통째 전송은 이 기계 이미지의 커밋 라벨이 목표와 같을 때만. 다르면 낡은 판을 보내지 않는다.
   const here = localImageCommit(image, inspect);
   if (localCommit && here !== localCommit) return { ok: false, action: 'failed', detail: '로컬 이미지 판이 다르다 · 보내지 않음' };
-  const ship = transfer(member, image);
-  if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
-  const imp = remote(member.sshHost, `k3d image import ${image} -c ${member.k3dCluster}`);
-  if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
-  const after = remoteImageCommit(member, image, remote);
-  return after && (!localCommit || after === localCommit)
-    ? { ok: true, action: 'shipped', detail: `${before?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
-    : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
+  const localId = inspectId ? imageIdFrom(inspectId(image)) : null;
+  /** Fresh = the commit label matches, or the very same image (ID) is already there. Null = not fresh. */
+  const freshDetail = (label: string | null): string | null => {
+    if (localCommit && label === localCommit) return label.slice(0, 12);
+    if (localId && remoteImageId(member, image, remote) === localId) return `same image id ${localId.slice(7, 19)}`;
+    return null;
+  };
+  const sameId = freshDetail(before);
+  if (sameId) {
+    debug.log('pod.pool', 'image-ship-skipped-same-id', { host, image, localCommit, remoteCommit: before, detail: sameId });
+    return { ok: true, action: 'fresh', detail: sameId };
+  }
+
+  const lockOpts = opts.lock ?? {};
+  const retryMs = lockOpts.retryMs ?? 2_000;
+  const staleMs = lockOpts.staleMs ?? IMAGE_SHIP_TIMEOUT_MS + REMOTE_RUN_TIMEOUT_MS + 120_000;
+  const lockDir = lockOpts.dir ?? join(hostLeaseBaseDir(), 'image-ship');
+  const lockPath = imageShipLockPath(host, lockDir);
+  const t0 = Date.now();
+  let waited = false;
+  let release: () => void;
+  try {
+    mkdirSync(lockDir, { recursive: true });
+    release = acquireLockSync(lockPath, {
+      staleMs,
+      retryBusyMs: retryMs,
+      maxTries: lockOpts.maxTries ?? Math.ceil(staleMs / retryMs) + 10,
+      breakDeadHolder: true,
+      onWait: (holder) => { waited = true; debug.log('pod.pool', 'image-ship-lock-wait', { host, image, lockPath, holder }); },
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    debug.log('pod.pool', 'image-ship-lock-failed', { host, image, lockPath, reason }, { level: 'warn' });
+    return { ok: false, action: 'failed', detail: `image ship lock: ${reason}` };
+  }
+  try {
+    debug.log('pod.pool', 'image-ship-lock-acquired', { host, image, lockPath, waited, waitedMs: Date.now() - t0 });
+    // ⭐ Re-check after the lock: the holder we waited for may have shipped this very image.
+    const labelNow = waited ? remoteImageCommit(member, image, remote) : before;
+    const fresh = waited ? freshDetail(labelNow) : null;
+    if (fresh) {
+      debug.log('pod.pool', 'image-ship-skipped-fresh-after-wait', { host, image, localCommit, remoteCommit: labelNow, detail: fresh, waitedMs: Date.now() - t0 });
+      return { ok: true, action: 'fresh', detail: `${fresh} (shipped by another process while waiting)` };
+    }
+    const ship = transfer(member, image);
+    if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
+    // The import phase gets its own stale window (the lock file's age restarts here).
+    try { const now = new Date(); utimesSync(lockPath, now, now); } catch { /* lock gone · finish anyway */ }
+    const imp = remote(host, `k3d image import ${image} -c ${member.k3dCluster}`);
+    if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
+    const after = remoteImageCommit(member, image, remote);
+    return after && (!localCommit || after === localCommit)
+      ? { ok: true, action: 'shipped', detail: `${labelNow?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
+      : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
+  } finally {
+    release();
+  }
 }
 
 export type PoolKubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
@@ -596,7 +732,7 @@ function defaultRemoteBuild(script: string, image: string): RemoteBuild {
  *           📏 커밋이 바뀐 뒤 두 노드를 올리는 데 벽시계 55초(종전: 다시 굽기 1분 40초 ⊕ 4GB 차례 전송 5분 48초).
  *   실패하면 = 종전의 통째 전송(syncPoolImage)으로 떨어진다.
  */
-export async function syncPoolImages(members: readonly PodPoolMember[], image: string, localCommit: string | null, deps: { run?: RemoteRun; remoteBuild?: RemoteBuild; buildScript?: string | null; ship?: typeof syncPoolImage; localSkillsDigest?: string | null; waitIntervalMs?: number; waitMaxMs?: number; now?: () => number; sleep?: (ms: number) => Promise<void>; inspect?: LocalImageInspect; transfer?: ImageShip; pack?: PoolPack | null } = {}): Promise<Map<string, PoolImageSync>> {
+export async function syncPoolImages(members: readonly PodPoolMember[], image: string, localCommit: string | null, deps: { run?: RemoteRun; remoteBuild?: RemoteBuild; buildScript?: string | null; ship?: typeof syncPoolImage; localSkillsDigest?: string | null; waitIntervalMs?: number; waitMaxMs?: number; now?: () => number; sleep?: (ms: number) => Promise<void>; inspect?: LocalImageInspect; transfer?: ImageShip; pack?: PoolPack | null; lock?: ImageShipLockOptions } = {}): Promise<Map<string, PoolImageSync>> {
   const run = deps.run ?? defaultRemoteRun;
   const script = deps.buildScript === undefined ? podImageBuildScript() : deps.buildScript;
   const remoteBuild = deps.remoteBuild ?? (script ? defaultRemoteBuild(script, image) : null);
@@ -611,22 +747,61 @@ export async function syncPoolImages(members: readonly PodPoolMember[], image: s
     const t0 = Date.now();
     if (!m.sshHost) { results.set(m.context, { ok: true, action: 'local', detail: 'this machine', ms: 0 }); return; }
     const before = remoteImageCommit(m, image, run);
-    // ⭐ «같은 판» = 커밋 ⊕ 스킬 해시 ⊕ (레지스트리 노드면) 레지스트리에 그 커밋 태그가 있다 — 스킬만 바뀌어도 다시 굽는다(대표 2026-09-26 «스킬 셋트 싱크»).
     const skillsNow = deps.localSkillsDigest;
-    const skillsSame = skillsNow == null || remoteImageSkillsDigest(m, image, run) === skillsNow;
     const refBefore = registryImageRef(m, localCommit, run, image);
     const hasRegistry = run(m.sshHost, `docker inspect ${memberRegistry(m).split(':')[0]} >/dev/null 2>&1`).status === 0;
-    if (localCommit && before === localCommit && skillsSame && (!hasRegistry || refBefore)) {
-      results.set(m.context, { ok: true, action: 'fresh', detail: before.slice(0, 12), ms: Date.now() - t0, ...(refBefore ? { imageRef: refBefore } : {}) });
+    const registrySkillsSame = (ref: string) => skillsNow == null || remoteImageSkillsDigest(m, `localhost:${memberRegistry(m).split(':')[1]}/${ref.slice(ref.indexOf('/') + 1)}`, run) === skillsNow;
+    const skillsSame = hasRegistry && refBefore ? registrySkillsSame(refBefore) : skillsNow == null || remoteImageSkillsDigest(m, image, run) === skillsNow;
+    if (hasRegistry && refBefore && skillsSame) {
+      debug.log('pod.pool', 'image-fresh-registry-tag', { context: m.context, host: m.sshHost, commit: localCommit, localLabel: before, imageRef: refBefore, waitedMs: 0 });
+      results.set(m.context, { ok: true, action: 'fresh', detail: localCommit!.slice(0, 12), ms: Date.now() - t0, imageRef: refBefore });
+      return;
+    }
+    if (!hasRegistry && localCommit && before === localCommit && skillsSame) {
+      results.set(m.context, { ok: true, action: 'fresh', detail: before.slice(0, 12), ms: Date.now() - t0 });
       return;
     }
     if (remoteBuild) {
-      // 같은 판이 아닌 멤버가 처음 여기 닿을 때 pack 한다(전부 fresh 면 pack 도 없다).
-      const shared = sharePack ? await (packed ??= sharePack()) : null;
-      if (shared && !shared.ok) debug.log('self-implement.pod', 'pool-image-pack-failed', { context: m.context, detail: shared.detail });
-      const b = shared && !shared.ok
-        ? { ok: false, detail: shared.detail }
-        : await remoteBuild(m.sshHost, m.k3dCluster, m.registry, shared?.tgz);
+      // Build and publish under a separate per-host lock: a failed build can then enter ship's synchronous lock.
+      const lockOpts = deps.lock ?? {};
+      const lockDir = lockOpts.dir ?? join(hostLeaseBaseDir(), 'image-ship');
+      const lockPath = `${imageShipLockPath(m.sshHost, lockDir)}.build`;
+      const retryMs = lockOpts.retryMs ?? 2_000;
+      const staleMs = lockOpts.staleMs ?? IMAGE_SHIP_TIMEOUT_MS + REMOTE_RUN_TIMEOUT_MS + 120_000;
+      const lockStarted = Date.now();
+      let b: { ok: boolean; detail: string };
+      try {
+        mkdirSync(lockDir, { recursive: true });
+        // Probe atomically rather than testing path existence: another process can acquire between that test and us.
+        let lock;
+        let waited = false;
+        try { lock = await acquireLockAsync(lockPath, { staleMs, retryBusyMs: 1, maxTries: 1 }); }
+        catch (error) {
+          if (!(error instanceof Error) || !error.message.startsWith('acquireLockAsync: timed out')) throw error;
+          waited = true;
+          debug.log('pod.pool', 'image-build-lock-wait', { context: m.context, host: m.sshHost, commit: localCommit, localLabel: before, imageRef: refBefore, waitedMs: Date.now() - lockStarted });
+          lock = await acquireLockAsync(lockPath, { staleMs, retryBusyMs: retryMs, maxTries: lockOpts.maxTries ?? Math.ceil(staleMs / retryMs) + 10 });
+        }
+        try {
+          if (waited && hasRegistry) {
+            const refNow = registryImageRef(m, localCommit, run, image);
+            if (refNow && registrySkillsSame(refNow)) {
+              debug.log('pod.pool', 'image-build-skipped-after-wait', { context: m.context, host: m.sshHost, commit: localCommit, localLabel: before, imageRef: refNow, waitedMs: Date.now() - lockStarted });
+              results.set(m.context, { ok: true, action: 'fresh', imageRef: refNow, detail: `${localCommit?.slice(0, 12)} (built by another process while waiting)`, ms: Date.now() - t0 });
+              return;
+            }
+          }
+          // 같은 판이 아닌 멤버가 처음 여기 닿을 때 pack 한다(전부 fresh 면 pack 도 없다).
+          const shared = sharePack ? await (packed ??= sharePack()) : null;
+          if (shared && !shared.ok) debug.log('self-implement.pod', 'pool-image-pack-failed', { context: m.context, detail: shared.detail });
+          b = shared && !shared.ok
+            ? { ok: false, detail: shared.detail }
+            : lock.stillHeld() ? await remoteBuild(m.sshHost, m.k3dCluster, m.registry, shared?.tgz) : { ok: false, detail: 'image build lock lost' };
+          if (!lock.stillHeld()) b = { ok: false, detail: 'image build lock lost' };
+        } finally { lock.release(); }
+      } catch (error) {
+        b = { ok: false, detail: `image build lock: ${error instanceof Error ? error.message : String(error)}` };
+      }
       const after = remoteImageCommit(m, image, run);
       const refAfter = registryImageRef(m, localCommit ?? after, run, image);
       // ⭐ 레지스트리 노드면 «이 판 커밋 태그가 레지스트리에 있나»로 판정한다 — Pod 는 그 커밋 태그를 pull 한다.