If partial centralization is OK, I'd have a dual-PK on the record pairing a received client ID (the first time it's received) with a self-generated ID, rejecting repeated requests that aren't canonically-identical replays.
If partial centralization is OK, I'd have a dual-PK on the record pairing a received client ID (the first time it's received) with a self-generated ID, rejecting repeated requests that aren't canonically-identical replays.
If you have a fediverse account, you can quote this note from your own instance. Search https://bsky.brid.gy/convert/ap/at://did:plc:cvzdmr3ssm2qvcx4xe5zwt74/app.bsky.feed.post/3m5s2jmkonk2s on your instance and quote it. (Note that quoting is not supported in Mastodon.)