Fleet
A pending worker holds no credential and receives nothing. Compare its fingerprint against the pod log before approving — that comparison is the only step that cannot be automated.
Threads
The affinity row is written before the command is queued. A thread sticks to its worker until that worker is fenced or revoked.