[SDK Sentinel] Stabilize cancelled deployment version updates

[sdk-sentinel-bot]

Caution

This PR contains untrusted AI-generated code. Do not approve or run CI until a maintainer has reviewed the diff. SDK Sentinel verified that GitHub Actions remained approval-gated with zero executable jobs when this PR was opened.

Summary

• CI evidence: failed CI job · workflow run · first known failure

Stabilize worker-deployment integration tests that intermittently fail when setting the current deployment version across Linux, FIPS, Cloud, and Windows jobs.

Root cause

The first captured occurrence is [a target-branch Linux failure](https://github.com/temporalio/sdk-python/actions/runs/33009807946/job/98312844312), with [matching Windows evidence](https://github.com/temporalio/sdk-python/actions/runs/33098052475/job/98608070911). No preceding equivalent success was captured. A cancelled mutation has an ambiguous outcome, but the helper propagated CANCELLED immediately, failing whether the server had committed the update or cancelled it before committing.

Fix

After cancellation, describe the deployment. Treat the requested version as successful when already committed; otherwise refresh the conflict token and retry within the existing bounded eventual assertion.

Validation

Four focused deployment tests passed in three runs, and an inline harness verified both cancellation outcomes. The unchanged baseline validator passed. Candidate Python lint, type, formatting, and doc checks passed, but the isolated environment lacked a Rust toolchain for bridge validation. The affected CI matrix and canonical validation remain required.

Validation status: validation-incomplete

• Flake confidence: high
• Fix confidence: high
• Value: high
• Patch scope: standard — 1 changed file; 2.6 KiB
• Local reproduction: not-reproduced — The four focused deployment tests passed once before editing; natural RPC cancellation did not occur locally.
• Regression coverage: pass-after-only — Existing deployment tests passed in three post-edit attempts, and an inline causal harness exercised both ambiguous cancellation outcomes. No deterministic before-edit failure was obtained.
• Unchanged baseline (Poe lint, bridge lint, and editable build) — passed
• Independent candidate (Poe lint, bridge lint, and editable build) — passed

Investigator-run checks

• poe test -s -k 'test_continue_as_new_with_version_upgrade or test_continue_as_new_with_ramping_version or test_worker_deployment_dynamic_workflow_with_auto_upgrade_versioning or test_worker_with_worker_deployment_config' — passed; 3 attempt(s). All four selected tests passed in each attempt, totaling 12 post-edit executions.
• uv run python - <<'PY' \[inline committed-versus-uncommitted cancellation reconciliation harness\] PY — passed; 1 attempt(s). Verified that an already-committed update returns the described token and an uncommitted update retries with the refreshed token.
• poe test -s -k 'test_workflow_cancel_activity' — passed; 5 attempt(s). Both activity parameters passed in all five Linux attempts; the macOS failure did not reproduce.
• poe format --help — failed; 1 attempt(s). The Poe task formatted the Python file successfully, then cargo fmt failed because no Rust toolchain was installed.
• .ci-flake-runtime/input/validate.sh — failed; 1 attempt(s). The trusted unchanged baseline was successful. Candidate Python formatting, imports, pyright, mypy, basedpyright, and docstyle passed; bridge-lint then failed because rustup had no installed toolchain.

Required target CI

• Continuous Integration / fips-build
• Continuous Integration / cloud-test
• Continuous Integration / build-lint-test (3.10, ubuntu-latest)
• Continuous Integration / build-lint-test (3.10, ubuntu-arm)
• Continuous Integration / build-lint-test (3.10, windows-latest)
• Continuous Integration / build-lint-test (3.14, windows-latest)
• Canonical validation with an installed Rust toolchain

Residual risks

• Natural service cancellation was not reproduced locally.
• The candidate validator could not execute bridge-lint or build-develop because the investigation environment lacked a Rust toolchain.
• The bounded snapshot provides no preceding successful CI run.

Automation provenance

• Investigator workflow
• Base SHA: 35b24bb28edf40fc3e2d3c446ea77a0cba312f6f

If this finding should not be fixed, apply the sdk-sentinel:false-positive label and close the PR. Sentinel will suppress the finding until its affected source changes.

SDK Sentinel recurrence history

• Unique failed CI run attempts: 1
• First occurrence: 2026-08-26 20:31 UTC
• Latest occurrence: 2026-08-26 20:31 UTC
• Recent occurrences:
  • 2026-08-26 20:31 UTC — failed CI job

[tconley1428]

@sdk-sentinel-bot Why does it matter that the set deployment version waits for confirmation, don't the tests subsequently wait for the new version if they need it. Is the particular failing test missing that wait, or is that wait not sufficient for some reason?