Python: Fix Anthropic server-tool continuation and replay

docs/specs/004-python-function-calling-loop.md

@@ -616,6 +616,7 @@ that manually replay messages own the equivalent rule: do not resend an approval
 | Declaration-only mixed batch | Known local siblings are never converted into Host pauses. With an authoritative session they remain deferred until every Host pause occurrence is answered, survive session serialization with a process-portable logical-run budget (including a reclassified approval continuation), reclassify against the current tool policy, execute exactly once using the configured concurrent or sequential invocation mode, replay results in original model order, and remain inert on replay; without one they execute on the same turn under the same configured invocation mode. Streaming updates and finalization preserve one Host pause and one result per local sibling. | `test_mixed_declaration_only_batch_defers_siblings_until_all_host_results`, `test_mixed_declaration_only_deferred_call_keeps_ordinary_middleware_semantics`, `test_mixed_declaration_only_deferred_call_reclassifies_changed_approval_policy`, `test_mixed_declaration_only_budget_survives_reclassification_to_approval`, `test_mixed_declaration_only_deferred_call_does_not_execute_removed_tool`, `test_mixed_declaration_only_budget_is_process_portable_without_approval_middleware`, `test_sessionless_mixed_declaration_only_batch_executes_siblings_sequentially`, `test_sessionless_mixed_declaration_only_batch_executes_siblings_concurrently`, `test_streaming_sessionless_mixed_declaration_only_batch_returns_pause_and_result` |
 | Function invocation disabled | The client bypasses the invocation loop without losing invocation kwargs. | `test_function_invocation_config_enabled_false`, `test_function_invocation_config_enabled_false_preserves_invocation_kwargs`, `test_streaming_function_invocation_config_enabled_false` |
 | Runtime tool changes | Added tools become available on the next iteration and retain approval behavior. | `test_add_tools_available_next_iteration`, `test_add_tools_with_approval_required_tool` |
+| Anthropic pause-turn continuation | `pause_turn` replays the returned assistant content with the same tools until Anthropic completes the server-side turn in streaming and non-streaming modes when every native content block can be reconstructed faithfully. Intermediate messages and usage remain caller-visible and retain provider message boundaries. Unsupported parsed content, native blocks dropped during parsing (including redacted reasoning), streamed MCP calls whose argument deltas are not retained, and bounded-continuation exhaustion keep `finish_reason="pause_turn"` instead of sending a lossy transcript or reporting normal completion. | `packages/anthropic/tests/test_anthropic_client.py::test_agent_continues_anthropic_pause_turn`, `test_streaming_hosted_tool_pause_turn_continues`, `test_streaming_pause_turn_preserves_message_boundaries_for_structured_output`, `test_non_streaming_code_execution_pause_turn_is_not_auto_continued`, `test_streaming_code_execution_pause_turn_is_not_auto_continued`, `test_streaming_mcp_pause_turn_is_not_auto_continued`, `test_non_streaming_redacted_thinking_pause_turn_is_not_auto_continued`, `test_streaming_redacted_thinking_pause_turn_is_not_auto_continued`, `test_anthropic_pause_turn_limit_preserves_finish_reason` |
 | Direct delegated session propagation | A custom loop must explicitly identify parent provider-owned state before sharing a non-empty session; missing ownership fails before the child runs, while declared parent keys remain isolated and application state still propagates. | `packages/core/tests/core/test_agents.py::test_chat_agent_as_tool_direct_propagation_requires_parent_provider_ownership`, `test_chat_agent_as_tool_direct_propagation_uses_explicit_parent_provider_ownership` |
 | In-run compaction summaries | Summaries inserted for tool groups excluded by in-run compaction are returned in the final non-streaming response transcript before the group they replace, so history loaded with `skip_excluded` keeps the summarized content; summaries of caller-owned input messages are not added. | `packages/core/tests/core/test_clients.py::test_function_loop_returns_compaction_summaries_in_final_response`, `test_function_loop_returns_compaction_summaries_when_iteration_budget_exhausted`, `test_function_loop_reconciles_nested_compaction_summaries`, `test_function_loop_returns_compacted_transcript_on_early_terminal_exit`, `packages/core/tests/core/test_agents.py::test_agent_run_returns_and_persists_compaction_summaries` |
 | Per-service-call provider context | When framework-managed history is loaded around each model call, tools and instructions contributed by `HistoryProvider.before_run` remain available to the model and function loop without duplication in streaming or non-streaming execution. | `packages/core/tests/core/test_agents.py::test_vector_history_search_tool_is_available_with_per_service_call_persistence` |

python/packages/anthropic/README.md

@@ -44,3 +44,19 @@ response = await client.get_response("Hello", options={"instructions": system_bl
 Instructions contributed later in a run — by a context provider such as `SkillsProvider`, or by per-run
 `options` — are appended as an additional text block after the configured blocks. The blocks you supply keep
 their structure and their position, so a `cache_control` breakpoint stays valid.
+
+### Persisted server-tool history
+
+Anthropic server-tool calls and results use `Content.additional_properties["anthropic"]["server_tool_block"]`
+internally to preserve the native block type, structured result content, and optional caller metadata across
+message serialization. Result metadata can contain provider-encrypted fields such as `encrypted_content`; the
+adapter stores those plain serialized values unchanged because Anthropic requires them for replay. Applications
+should treat this namespace as adapter-owned replay data and must not modify it.
+
+### Paused server-tool turns
+
+When Anthropic returns `pause_turn`, the client automatically replays the paused assistant content with the same
+tools when every content block can be reconstructed faithfully. It performs at most 10 continuation requests.
+If the paused response contains unsupported native tool content, includes a native block dropped during parsing
+(such as redacted reasoning), contains a streamed MCP call whose argument deltas are not retained, or remains paused
+after that limit, the response retains `finish_reason="pause_turn"` so the caller can decide whether to continue later.