Only set OnConflictOptions when there is a link or callback to attach

The server rejects a StartActivityExecutionRequest whose OnConflictOptions
sets attach_request_id when the request carries neither a link nor a
completion callback (chasm/lib/activity/validator.go's
validateOnConflictOptions: "attach_request_id requires at least one
completion callback or link"). The previous code set attach_request_id and
attach_links unconditionally whenever any Nexus context existed, regardless
of whether the inbound task actually had links -- a bypass-path activity
start issued during an invocation whose inbound Nexus task carries no links
would send exactly that invalid combination and get rejected. This wasn't
caught before because the existing unit tests mock the client and never
exercise real server-side validation.

OnConflictOptions is now only set when there's something to attach, and each
flag reflects what the request actually carries, matching sdk-go's identical
gating in its own fix (temporalnexus/temporal_operation.go, PR #2633). This
also fixes the guarded (metadata-backed) path: it previously set
attach_completion_callbacks based on whether metadata was present rather
than whether a callback URL was actually set, so a guarded start with an
empty callback URL and no links would hit the same rejection.

RootActivityClientInvokerTest: flipped the assertion in
nexusMetadataWithEmptyCallbackUrlOmitsCompletionCallback (attach_completion_
callbacks now correctly reflects the absence of a real callback), rewrote
nexusContextWithoutAmbientStateStartsOrdinaryActivity to assert
OnConflictOptions is entirely absent, and added
metadataWithEmptyCallbackUrlAndNoLinksOmitsOnConflictOptions covering the
previously-untested guarded-call variant of the same bug.

Author: tekkaya

temporal-sdk/src/main/java/io/temporal/internal/client/RootActivityClientInvoker.java

@@ -136,14 +136,19 @@ public StartActivityOutput startActivity(StartActivityInput input) {
       // completes the Nexus operation.
       protoLinks = nexusContext.getRequestLinks();
       request.addAllLinks(protoLinks);
-      io.temporal.api.common.v1.OnConflictOptions.Builder onConflictOptions =
+    }
+
+    boolean willAttachCompletionCallback =
+        nexusOperationMetadata != null
+            && !Strings.isNullOrEmpty(nexusOperationMetadata.callbackUrl);
+    if (nexusContext != null && (!protoLinks.isEmpty() || willAttachCompletionCallback)) {
+      // The server rejects attach_request_id unless the request also carries at least one link
+      // or completion callback to attach on conflict.
+      request.setOnConflictOptions(
           io.temporal.api.common.v1.OnConflictOptions.newBuilder()
               .setAttachRequestId(true)
-              .setAttachLinks(true);
-      if (nexusOperationMetadata != null) {
-        onConflictOptions.setAttachCompletionCallbacks(true);
-      }
-      request.setOnConflictOptions(onConflictOptions);
+              .setAttachLinks(!protoLinks.isEmpty())
+              .setAttachCompletionCallbacks(willAttachCompletionCallback));
     }
 
     if (nexusOperationMetadata != null) {
@@ -159,7 +164,7 @@ public StartActivityOutput startActivity(StartActivityInput input) {
             "failed to generate activity operation token",
             e);
       }
-      if (!Strings.isNullOrEmpty(nexusOperationMetadata.callbackUrl)) {
+      if (willAttachCompletionCallback) {
         Callback cb =
             InternalUtils.buildNexusCallback(
                 nexusOperationMetadata.callbackUrl,

temporal-sdk/src/test/java/io/temporal/internal/client/RootActivityClientInvokerTest.java

@@ -143,11 +143,30 @@ public void nexusMetadataWithEmptyCallbackUrlOmitsCompletionCallback() {
     Assert.assertEquals(0, request.getCompletionCallbacksCount());
     Assert.assertTrue(request.getOnConflictOptions().getAttachRequestId());
     Assert.assertTrue(request.getOnConflictOptions().getAttachLinks());
-    Assert.assertTrue(request.getOnConflictOptions().getAttachCompletionCallbacks());
+    Assert.assertFalse(request.getOnConflictOptions().getAttachCompletionCallbacks());
     Assert.assertNotNull(metadata.operationToken);
     Assert.assertEquals(Collections.singletonList(activityLink()), nexusContext.getResponseLinks());
   }
 
+  @Test
+  public void metadataWithEmptyCallbackUrlAndNoLinksOmitsOnConflictOptions() {
+    NexusOperationMetadata metadata =
+        new NexusOperationMetadata(
+            "nexus-request-id", "", Collections.singletonMap("Custom-Header", "value"));
+    nexusContext.setNexusOperationMetadata(metadata);
+
+    invoker.startActivity(newStartActivityInput());
+
+    ArgumentCaptor<StartActivityExecutionRequest> captor =
+        ArgumentCaptor.forClass(StartActivityExecutionRequest.class);
+    verify(genericClient).startActivity(captor.capture());
+    StartActivityExecutionRequest request = captor.getValue();
+    Assert.assertEquals("nexus-request-id", request.getRequestId());
+    Assert.assertEquals(0, request.getLinksCount());
+    Assert.assertEquals(0, request.getCompletionCallbacksCount());
+    Assert.assertFalse(request.hasOnConflictOptions());
+  }
+
   @Test
   public void nexusContextWithoutMetadataGetsAmbientLinksAndAmbientRequestIdButNoCallback() {
     Link link = workflowEventLink();
@@ -195,9 +214,7 @@ public void nexusContextWithoutAmbientStateStartsOrdinaryActivity() {
     Assert.assertFalse(request.getRequestId().isEmpty());
     Assert.assertEquals(0, request.getLinksCount());
     Assert.assertEquals(0, request.getCompletionCallbacksCount());
-    Assert.assertTrue(request.getOnConflictOptions().getAttachRequestId());
-    Assert.assertTrue(request.getOnConflictOptions().getAttachLinks());
-    Assert.assertFalse(request.getOnConflictOptions().getAttachCompletionCallbacks());
+    Assert.assertFalse(request.hasOnConflictOptions());
     Assert.assertEquals(Collections.singletonList(activityLink()), nexusContext.getResponseLinks());
   }