[SDK Sentinel] Fix unfinished-handler update race across continue-as-new

[sdk-sentinel-bot]

Caution

This draft contains untrusted AI-generated code. Do not approve or run CI until a maintainer has reviewed the diff. SDK Sentinel verified that GitHub Actions remained approval-gated with zero executable jobs when this PR was opened.

Summary

• CI evidence: failed CI job · workflow run · last known pass · first known failure

Fix a recurring Windows time-skipping failure where the unfinished-handler test reports that its admitted update is missing. The [preceding successful main run](https://github.com/temporalio/sdk-python/actions/runs/31719543769) and [first captured failure](https://github.com/temporalio/sdk-python/actions/runs/31736295303/job/94568624072) show intermittent behavior.

Root cause

The test used a workflow-ID-only handle. After the initial run continued as new, update completion could resolve against the successor run, which never contained that update.

Fix

Rebuild the handle with the initial run ID returned by workflow start. Test operations now target the intended run, removing the latest-run race without weakening assertions or coverage.

Validation

All 48 unfinished-handler combinations passed in the Linux time-skipping environment. The unchanged checkout did not naturally reproduce. Lint, bridge lint, and editable bridge build passed. Windows Python 3.10 and 3.14 time-skipping CI remain required.

Validation status: validated-without-reproduction

• Flake confidence: high
• Fix confidence: high
• Value: high
• Patch scope: standard — 1 changed file; 886 B
• Local reproduction: not-reproduced — The unchanged Linux time-skipping run passed all 8 affected cases; CI supplies four timing-dependent Windows reproductions.
• Regression coverage: pass-after-only — The existing parameterized regression path passed after run pinning, including all 48 test combinations.
• Unchanged baseline (Poe lint, bridge lint, and editable build) — passed
• Independent candidate (Poe lint, bridge lint, and editable build) — passed

Investigator-run checks

• poe test -s --workflow-environment time-skipping -k 'unfinished_handler_on_workflow_termination and update and continue' — passed; 3 attempt(s). All 8 selected cases passed once before and twice after candidate iterations; natural reproduction did not occur locally.
• poe test -s --workflow-environment time-skipping -k unfinished_handler_on_workflow_termination — passed; 1 attempt(s). All 48 parameter combinations passed with the final candidate on Linux Python 3.14.
• .ci-flake-runtime/input/validate.sh — passed; 3 attempt(s). Final validation passed lint, bridge lint, and editable bridge build using the preinstalled Rust toolchain. Earlier attempts exposed a corrected typing issue and the sandbox's empty rustup home.

Required target CI

• Continuous Integration / build-lint-test (3.10, windows-latest), time-skipping step
• Continuous Integration / build-lint-test (3.14, windows-latest), time-skipping step

Residual risks

• The candidate was not executed on Windows locally.
• Natural reproduction did not occur on Linux, so Windows CI must confirm the timing window is closed.
• The distinct OpenAI tracing flake remains unresolved.

Automation provenance

• Investigator workflow
• Base SHA: 680a6b4f32e9d5f2484e9a2e1c604178553c3f55

If this finding should not be fixed, apply the sdk-sentinel:false-positive label and close the PR. Sentinel will suppress the finding until its affected source changes.

SDK Sentinel recurrence history

• Unique failed CI run attempts: 1
• First occurrence: 2026-08-14 18:00 UTC
• Latest occurrence: 2026-08-14 18:00 UTC
• Recent occurrences:
  • 2026-08-14 18:00 UTC — failed CI job

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}