[SDK Sentinel] Stabilize unfinished-handler tests during runner stalls

[sdk-sentinel-bot]

Caution

This PR contains untrusted AI-generated code. Do not approve or run CI until a maintainer has reviewed the diff. SDK Sentinel verified that GitHub Actions remained approval-gated with zero executable jobs when this PR was opened.

Summary

• CI evidence: failed CI job · workflow run · last known pass · first known failure

A [macOS Python 3.14 failure](https://github.com/temporalio/sdk-python/actions/runs/35401778660/job/105783048683) intermittently rejected unfinished-handler updates after workflow-task failures; the same SHA passed on rerun. The [last captured equivalent success](https://github.com/temporalio/sdk-python/actions/runs/35245285630) preceded the [first captured failure](https://github.com/temporalio/sdk-python/actions/runs/35248260973/job/105293870514).

Root cause

Runner stalls can exceed consecutive default 10-second workflow-task attempts, putting the update into a failed state. The exception-path helper also left its background result task unobserved, so its later RPC error could fail another test.

Fix

Use a test-scoped 60-second workflow-task timeout and always cancel and gather the background result task. This preserves the warning assertions while removing dependence on short scheduling gaps.

Validation

poe test -s -k unfinished_handler passed 48 cases; a three-run flake-finder check passed six cases; the fixed repository validator passed. The natural failure did not reproduce on Linux, so the Python 3.14 macOS ARM CI job remains required.

Validation status: ci-validation-required

• Flake confidence: high
• Fix confidence: high
• Value: high
• Patch scope: standard — 1 changed file; 2.5 KiB
• Local reproduction: not-reproduced — One pre-edit Linux focused run passed; the macOS runner-stall trigger was unavailable locally.
• Regression coverage: not-added — No new test was added; the existing 48-case focused suite and six repeated focused cases passed after the change.
• Unchanged baseline (Poe lint, bridge lint, and editable build) — passed
• Independent candidate (Poe lint, bridge lint, and editable build) — passed

Investigator-run checks

• poe test -s -k 'test_unfinished_update_handler or test_unfinished_signal_handler' — passed; 1 attempt(s). Both tests passed before the edit; natural Linux reproduction did not occur.
• poe test -s -k unfinished_handler — passed; 1 attempt(s). All 48 selected unfinished-handler cases passed after the edit.
• poe test -s -k 'test_unfinished_update_handler or test_unfinished_signal_handler' --flake-finder --flake-runs=3 — passed; 1 attempt(s). Six repeated focused cases passed after the edit.
• .ci-flake-runtime/input/validate.sh — passed; 1 attempt(s). Ruff, pyright, mypy, basedpyright, pydocstyle, bridge clippy, and editable bridge build passed.

Required target CI

• Continuous Integration / build-lint-test (3.14, macos-arm)

Residual risks

• Only macOS CI can validate behavior under the observed runner stalls.
• The scoped 60-second workflow-task timeout can lengthen failure diagnosis for these tests if a workflow task genuinely stops progressing.
• Other unrelated timeout and assertion signatures in the snapshot are not addressed.

Automation provenance

• Investigator workflow
• Base SHA: 1d1ad747dfd95d18626930202ab5869d79b6066b

If this finding should not be fixed, apply the sdk-sentinel:false-positive label and close the PR. Sentinel will suppress the finding until its affected source changes.

SDK Sentinel recurrence history

• Unique failed CI run attempts: 3
• First occurrence: 2026-09-17 18:12 UTC
• Latest occurrence: 2026-09-18 22:48 UTC
• Recent occurrences:
  • 2026-09-18 22:48 UTC — failed CI job
  • 2026-09-18 19:36 UTC — failed CI job
  • 2026-09-17 18:12 UTC — failed CI job