[SDK Sentinel] Stabilize direct query replay count assertion

[sdk-sentinel-bot]

Caution

This PR contains untrusted AI-generated code. Do not approve or run CI until a maintainer has reviewed the diff. SDK Sentinel verified that GitHub Actions remained approval-gated with zero executable jobs when this PR was opened.

Summary

• CI evidence: failed CI job · workflow run · last known pass · first known failure

Stabilizes a replay assertion that failed in a [target-branch CLI run](https://github.com/temporalio/sdk-java/actions/runs/37068414255/job/111041829366) and an [earlier PR run](https://github.com/temporalio/sdk-java/actions/runs/36949025777/job/110657577315). A [preceding main run](https://github.com/temporalio/sdk-java/actions/runs/37029728465) was the last known good before the target-branch failure. Breaking changes: none. Server PR: not required.

Root cause

The test expected exactly three executions after its final query. That total also included processing of the preceding signal, which may require another full replay depending on service task routing. The intended behavior—one replay for the final query without a duplicate exception log—still holds.

Fix

Capture the count after signal completion and assert that the final query increases it by exactly one. The exception-log assertion remains unchanged.

Validation

Four focused Java 11 loopback CLI attempts and module Spotless passed. The unchanged baseline validator passed. Candidate validation could not start because the investigation user could not chmod the preloaded Gradle cache, so target CLI CI and trusted validation remain required.

Validation status: validation-incomplete

• Flake confidence: high
• Fix confidence: high
• Value: high
• Patch scope: standard — 1 changed file; 1.3 KiB
• Local reproduction: not-reproduced — Two pre-patch Java 11 loopback CLI attempts passed; CI supplied two exact failures on different SHAs.
• Regression coverage: pass-after-only — The existing focused test was made causal and passed four post-change CLI attempts; no deterministic fail-before reproduction was obtained locally.
• Unchanged baseline (Gradle formatting and test-source compilation) — passed
• Independent candidate (Gradle formatting and test-source compilation) — did not pass (failure)

Investigator-run checks

• GRADLE_USER_HOME=$PWD/.ci-flake-runtime/tmp/gradle-home USE_EXTERNAL_SERVICE=true TEMPORAL_SERVICE_ADDRESS=127.0.0.1:7233 USER=unittest ./gradlew --offline --no-daemon :temporal-sdk:test --tests 'io.temporal.workflow.queryTests.DirectQueryReplaysDontSpamLogWithWorkflowExecutionExceptionsTest' -PtestJavaVersion=11 -x :temporal-serviceclient:initSubmodules -x :temporal-serviceclient:updateSubmodules -x :temporal-sdk:compileJava17Java — passed; 4 attempt(s). Both focused tests passed in all four candidate attempts against the preloaded loopback Temporal CLI.
• .ci-flake-runtime/input/validate.sh — failed; 1 attempt(s). Candidate validation could not start Gradle because the investigation user could not chmod the preloaded daemon cache directory.
• .ci-flake-runtime/input/validate.sh (trusted unchanged baseline) — passed; 1 attempt(s). The supplied trusted unchanged baseline completed successfully.
• GRADLE_USER_HOME=$PWD/.ci-flake-runtime/tmp/gradle-home ./gradlew --offline --no-daemon :temporal-sdk:spotlessCheck -x :temporal-serviceclient:initSubmodules -x :temporal-serviceclient:updateSubmodules — passed; 1 attempt(s). Temporal SDK formatting passed.

Required target CI

• Continuous Integration / Unit test with CLI on Java 11 using dev-server
• Trusted fixed repository validation: ./gradlew --offline --no-daemon spotlessCheck testClasses -x test

Residual risks

• The candidate was not exercised on a run where signal processing selected the extra-replay route.
• Independent candidate validation remains required because local Gradle cache ownership prevented the fixed validator from starting.

Automation provenance

• Investigator workflow
• Base SHA: 1af71ba343d7fe4d5c6c97c959cea6b68f178e0e

If this finding should not be fixed, apply the sdk-sentinel:false-positive label and close the PR. Sentinel will suppress the finding until its affected source changes.

SDK Sentinel recurrence history

• Unique failed CI run attempts: 1
• First occurrence: 2026-10-02 21:53 UTC
• Latest occurrence: 2026-10-02 21:53 UTC
• Recent occurrences:
  • 2026-10-02 21:53 UTC — failed CI job