Python: consume local process inputs before awaiting step invocations - #14760

Motivation and Context

Fixes #14759.

When a local process function awaits, later messages can reuse its in-flight input dictionary. The sequence a=1, b=1, a=2, b=2 can execute an extra (2,1) invocation. When the second b arrives in a later superstep, completion of the first invocation can also discard the pending a=2.

Description

Consume the filled input buffer before invoking the local step, so later messages populate a fresh dictionary. Completion preserves that newer buffer on both success and error. Public signatures and concurrent local dispatch are unchanged.

Four regressions use ProcessBuilder and the public local start() entry, covering same/later-superstep delivery and successful/failing first invocations.

The Dapr review follow-up is covered by four queue-path controls using a real kernel and step. StepActor.process_incoming_messages() awaits each handle_message() before dequeuing another; handle_message is not an actor RPC. These controls pass with unchanged Dapr runtime code. This assessment covers the current registered queue path with normal actor turn-based access; no live Dapr host or reentrant/direct concurrent invocation was tested.

Merged main at 25bd1bb67c38976bb13958783572efa57d3445d4. Relocated this PR's local test and localized its context import so a git merge-tree with #14732 at 45976a66f2f85fddc294ba044af2fb0d83ed6888 is clean. No code from #14732 was merged.

Validation

Final commit: 1ef82d116cebf88460055efca17babdf335b8c3a.

• All four local regressions fail with main's original local_step.py and pass with this fix. Test assertions and input sequences are unchanged by the relocation.
• All four Dapr queue controls pass with unchanged step_actor.py; as a sensitivity check, all four fail when its sequential queue pump is temporarily replaced with concurrent dispatch. That was an artificial mutation, not a reproduction of a current Dapr bug.
• Complete Python unit suite, split as in CI: 4987 passed, 1 skipped, 5 xfailed outside Dapr; 86 passed in the separate Dapr environment, including the four new controls.
• Applicable native pre-commit hooks on all three changed files passed, including the repository-pinned Ruff 0.9.6 lint/format and Bandit.
• Wheel and source distribution builds passed. Both 575-entry package lists were inspected: packaged LocalStep and StepActor match the final source; no task helpers, environments or temporary test data are included.
• Dependency consistency in both environments and git diff whitespace checks passed.
• Existing warnings remain: uv's prerelease-mode deprecation, Dapr legacy-extension/import deprecations and Pydantic/deprecated API notices.
• Independent AI review covered all three files and the real Local/Dapr dispatch paths, failure/cancellation behavior, adjacent function buffers and resource effects. Final evidence and package inventories were checked against the same commit and environment.

Environment: Python 3.12.14, uv 0.13.7, macOS/Apple Silicon. The main environment includes all optional dependencies and the development group; Dapr has a separate environment as in CI.

The main unit run allows loopback sockets and isolates only macOS system-proxy discovery (urllib.request._get_proxies) inside the test process. Application code, getproxies, proxy_bypass, proxy environment-variable tests and assertions remain unchanged. The host's system proxy otherwise produces unrelated DNS-pinning failures. No provider/service integration suite was run.

Contribution Checklist

• SDK wheel and source distribution build successfully.
• Applicable native pre-commit checks pass.
• Complete Python unit checks pass in the environment described above.
• Public API signatures and existing concurrent local dispatch are preserved.

AI assistance: Codex implemented and tested the changes. A separate AI reviewer independently reviewed the frozen changes and final evidence; no personal human code review is claimed.