Pinned counterexample / 25
One call ID.
Two callbacks.
The prior host-side bridge could invoke a simulated tool twice when the same A2UI function call arrived again. An atomic, host-owned invocation claim stops the second call before approval or dispatch.
Measured against the exact prior Git blob and the corrected code in six local scenarios. A2UI v1.0 is a candidate specification; this is not a full renderer or a live external tool.SAME HOST SESSION · SAME FUNCTIONCALLID
"functionCallId": "call_1"
BEFORE / NO CLAIM2 callbacks
AFTER / ATOMIC CLAIM1 callback
The replay gets a correlated INVALID_FUNCTION_CALL response. No second AML dispatch receipt is created.
6before/after scenarios
1 → 0replay callback on same ID
0live external side effects
Replay the counterexample.
Compare actual callback counts and inspect each A2UI response and AML receipt.
SELECT A CASE
The boundary:
functionCallId comes from the agent. The session identity and atomic claim store come from the trusted host. The included store is process-local and stops reusing an ID within that one process; production needs a durable shared store. A new ID can represent a new action, so real approval, authorization, and external idempotency remain separate controls.