Python: Design safe provider-outbox recovery for completed mixed pauses

[eavanvalkenburg]

Description

Split from #8436 after full review of #8518.

When a mixed approval/Host batch has completed local execution but the provider invalidates the result-delivery request, the framework needs a durable retry path that does not repeat the approved local side effect. The outbox design must also preserve public streaming, input, history, and invocation-budget semantics.

Required behavior:

• persist the exact provider-bound Host and local results before delivery;
• retry provider delivery without re-authorizing or re-executing the local tool;
• clear the outbox only after provider acceptance and continuation-state update are safely established;
• preserve the already-charged function-call, error, duration, payload, and iteration budgets with explicit retry semantics;
• never silently replace or discard a new caller input while an outbox is pending—reject it explicitly or drain the outbox before processing it;
• keep stored terminal tool results in the retry's final response and durable history in both streaming and non-streaming modes;
• define what “published” means for streaming. A persisted boolean set before outer hooks or caller receipt is not a delivery acknowledgment and cannot guarantee exactly-once egress;
• use a strict, versioned serialized state shape. Missing required fields must fail closed rather than relying on compatibility defaults for an unreleased format.

Acceptance criteria:

• Cover streaming iteration and get_final_response()-only consumption.
• Assert retry final-response messages and persisted history, not only emitted chunks and final text.
• Cover a caller supplying new input while an outbox is pending.
• Cover repeated provider invalidation and every configured invocation budget.
• Round-trip the session through durable serialization before retry.
• Keep Host-correlation changes outside this PR except for a separately merged prerequisite.

Code Sample

# 1. Mixed approval/Host batch completes; approved local tool executes once.
# 2. Provider result delivery raises ResponseInvalidatedException.
# 3. Session is serialized/restored.
# 4. Retry delivers the stored results, exposes a complete final transcript,
#    and does not run the local tool again or lose a new caller message.

Error Messages / Stack Traces

ResponseInvalidatedException: provider invalidated result delivery

Package Versions

agent-framework-core: current main / unreleased

Python Version

All supported Python versions (3.10-3.14)

Additional Context

Original combined issue: #8436

Reviewed implementation: #8518

This issue intentionally covers only the durable provider-outbox/retry protocol. Host-response correlation should be handled independently.