Detect send event target changes during replay

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 56111c85-99ce-477c-a97f-c2d57a162a55

Author: andystaples

CHANGELOG.md

@@ -10,7 +10,9 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ADDED
 
 - Added `OrchestrationContext.send_event()` for replay-safe, one-way event
-delivery from an orchestration to another orchestration instance.
+delivery from an orchestration to another orchestration instance. During
+replay, Python validates the target instance ID as well as the event name,
+intentionally detecting target changes that DurableTask.Core does not.
 - Added asynchronous `AsyncScheduledTaskClient` / `AsyncScheduleClient` and
 `AsyncExportHistoryClient` / `AsyncExportHistoryJobClient` APIs. Applications
 using `AsyncTaskHubGrpcClient` can now manage scheduled tasks and history

durabletask/task.py

@@ -370,6 +370,9 @@ def send_event(self, instance_id: str, event_name: str, *,
         :meth:`wait_for_external_event`. This is a one-way operation and does
         not wait for the target orchestration to process the event. If the
         target orchestration does not exist, the event is silently dropped.
+        During replay, the Python SDK validates both the event name and target
+        instance ID. This is intentionally stricter than DurableTask.Core,
+        which does not validate the target instance ID.
 
         Parameters
         ----------

durabletask/worker.py

@@ -3017,6 +3017,19 @@ def _cancel_timer() -> None:
                         task.get_name(ctx.send_event),
                         action,
                     )
+                elif (
+                        action.sendEvent.instance.instanceId
+                        != event.eventSent.instanceId
+                ):
+                    # Python intentionally validates the target during replay,
+                    # unlike DurableTask.Core, to avoid silently suppressing
+                    # delivery when orchestration code changes the target.
+                    raise _get_wrong_action_target_error(
+                        event.eventId,
+                        method_name=task.get_name(ctx.send_event),
+                        expected_instance_id=event.eventSent.instanceId,
+                        actual_instance_id=action.sendEvent.instance.instanceId,
+                    )
                 elif (
                         action.sendEvent.name.casefold()
                         != event.eventSent.name.casefold()
@@ -3340,6 +3353,21 @@ def _get_wrong_action_name_error(
     )
 
 
+def _get_wrong_action_target_error(
+        task_id: int,
+        method_name: str,
+        expected_instance_id: str,
+        actual_instance_id: str,
+) -> task.NonDeterminismError:
+    return task.NonDeterminismError(
+        f"Failed to restore orchestration state due to a history mismatch: A previous execution called "
+        f"{method_name} with target instance ID='{expected_instance_id}' and sequence number {task_id}, but the "
+        f"current execution is instead targeting instance ID='{actual_instance_id}' as part of rebuilding its "
+        f"history. This kind of mismatch can happen if an orchestration has non-deterministic logic or if the "
+        f"code was changed after an instance of this orchestration already started running."
+    )
+
+
 def _get_method_name_for_action(action: pb.OrchestratorAction) -> str:
     action_type = action.WhichOneof("orchestratorActionType")
     match action_type:

tests/durabletask/test_orchestration_executor.py

@@ -1558,7 +1558,10 @@ def orchestrator(ctx: task.OrchestrationContext, _):
     assert result.actions == []
 
 
-@pytest.mark.parametrize("mismatch", ["name", "type", "missing", "entity"])
+@pytest.mark.parametrize(
+    "mismatch",
+    ["name", "target", "type", "missing", "entity"],
+)
 def test_send_event_replay_detects_nondeterminism(mismatch: str):
     if mismatch == "type":
         def orchestrator(ctx: task.OrchestrationContext, _):
@@ -1574,6 +1577,10 @@ def orchestrator(ctx: task.OrchestrationContext, _):
                 "increment",
             )
             yield ctx.wait_for_external_event("Done")
+    elif mismatch == "target":
+        def orchestrator(ctx: task.OrchestrationContext, _):
+            ctx.send_event("changed-target", "OriginalName")
+            yield ctx.wait_for_external_event("Done")
     else:
         def orchestrator(ctx: task.OrchestrationContext, _):
             ctx.send_event("target-instance", "ChangedName")
@@ -1605,6 +1612,9 @@ def orchestrator(ctx: task.OrchestrationContext, _):
     if mismatch == "name":
         assert "OriginalName" in complete_action.failureDetails.errorMessage
         assert "ChangedName" in complete_action.failureDetails.errorMessage
+    elif mismatch == "target":
+        assert "target-instance" in complete_action.failureDetails.errorMessage
+        assert "changed-target" in complete_action.failureDetails.errorMessage
     elif mismatch == "type":
         assert "create_timer" in complete_action.failureDetails.errorMessage
     elif mismatch == "entity":