Name the code a run ran, and let an interrupted sync finish

Three faults with one root: the stored body of a code-defined node is an
import shim, and nothing that mattered was ever read from the code itself.

- The run stamp could not identify what ran. The shim imports whatever is on
  disk when the worker starts, and an uncommitted tree stamps <commit>-dirty
  for every run it ever produces. Run.code_digest hashes the repository's .py
  files, memoized on their stat state, and it is read again when the run is
  actually claimed -- so a sweep queued for hours records the code each of its
  runs executed, not the code that was there when it was submitted.
- The stage cache adopted code that was too new. The fingerprint hashed the
  shim, which is invariant under any edit to the imported function or anything
  it calls into, so a re-run was served from cache and answered without the
  outputs the edit added. It now carries the repo digest and the node's
  declared ports. Every fingerprint changes once, which invalidates the
  existing cache; a canvas flow has no repository and keys as before.
- An interrupted sync looked like a hand-edited canvas. The engine answers a
  new-node template for a node with no stored body, and the template carries
  no marker, so the drift check read "somebody edited this" and demanded
  --force -- for the one state that re-running the sync is the fix for.
  NodeSource.missing states the fact, and sync skips those and reuses the
  bodies it read instead of asking for each one twice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/sdk/client.py

@@ -237,8 +237,17 @@ class Client:
         return result
 
     def get_source(self, flow: str, node: str) -> str:
-        result = self._call("GET", f"/flows/{flow}/nodes/{node}/source")
-        return str(result.get("code", ""))
+        return str(self.get_source_entry(flow, node).get("code", ""))
+
+    def get_source_entry(self, flow: str, node: str) -> dict[str, Any]:
+        """A node's stored body, and whether there is one at all.
+
+        `missing` is what separates a node nobody has written from a node
+        somebody edited: the engine answers a new-node template for both, and
+        only one of them is work worth refusing to overwrite.
+        """
+        result: dict[str, Any] = self._call("GET", f"/flows/{flow}/nodes/{node}/source")
+        return result or {}
 
     def put_source(self, flow: str, node: str, code: str) -> dict[str, Any]:
         result: dict[str, Any] = self._call(
@@ -623,13 +632,16 @@ def _sync_one(
     report = SyncReport(target.name)
     stored = client.get_flow(target.name)
     version = 1
+    # What the drift check already read, so the write loop below does not ask
+    # the engine for every node's body a second time.
+    known: dict[str, str] = {}
     if stored is None:
         report.created = True
     else:
         definition = stored.get("definition") or {}
         version = int(definition.get("version") or 1)
         if not force:
-            _refuse_on_drift(client, target, definition)
+            known = _refuse_on_drift(client, target, definition)
 
     saved = client.put_flow(target.document(origin) | {"version": version})
     stored_version = int((saved.get("definition") or {}).get("version") or version)
@@ -640,8 +652,12 @@ def _sync_one(
     version = stored_version
 
     for node_id, code in target.shims().items():
-        if not report.created and client.get_source(target.name, node_id) == code:
-            continue
+        if not report.created:
+            stored_code = known.get(node_id)
+            if stored_code is None:
+                stored_code = client.get_source(target.name, node_id)
+            if stored_code == code:
+                continue
         client.put_source(target.name, node_id, code)
         report.changed.append(node_id)
 
@@ -651,26 +667,43 @@ def _sync_one(
     return report
 
 
-def _refuse_on_drift(client: Client, target: Flow, definition: dict[str, Any]) -> None:
+def _refuse_on_drift(
+    client: Client, target: Flow, definition: dict[str, Any]
+) -> dict[str, str]:
     """Stop before overwriting work that was done somewhere else.
 
     Two ways a stored flow is not ours to replace: it was drawn on the canvas
     and has no origin at all, or one of its node bodies no longer carries the
     line saying it was generated — which means somebody edited the code there.
+
+    A node with *no* stored body is neither. That is what a sync interrupted
+    part of the way through leaves, and it used to read as a canvas edit,
+    because the engine answers the new-node template for it and the template
+    carries no marker either. Re-running the sync is the fix for that state,
+    so refusing to is precisely wrong.
+
+    Returns the bodies it read, so the caller can compare against them without
+    asking again.
     """
     if not definition.get("origin"):
         raise SyncError(
             f"flow '{target.name}' was not created by sync, so replacing it would "
             "discard whoever drew it. Rename yours, or pass --force."
         )
+    seen: dict[str, str] = {}
     for stored_node in definition.get("nodes") or []:
         node_id = str(stored_node.get("id"))
         try:
-            code = client.get_source(target.name, node_id)
+            entry = client.get_source_entry(target.name, node_id)
         except ApiError:
             continue
+        if entry.get("missing"):
+            continue
+        code = str(entry.get("code", ""))
+        seen[node_id] = code
         if code and not code.startswith(MARKER):
             raise SyncError(
                 f"node '{target.name}.{node_id}' was edited on the canvas, and "
                 "syncing would throw that edit away. Copy it out, or pass --force."
             )
+    return seen