Function check 

pub fn check(
    policy: &ReplayDefensePolicy,
    state: &ReplayDefenseState,
    input: &ReplayDefenseCheckInput,
) -> ReplayDefenseDecision

Evaluate policy + state against input and return a deterministic ReplayDefenseDecision.

Precedence:

1. Domain mismatch is checked first (cheap, structural).
2. Signature drift is checked next so a rotated signature never silently slips through on an unexpired session.
3. Nonce rotation (state nonce != observed nonce) is checked before the nonce age so a nonce that was explicitly rotated is reported distinctly from a nonce that simply aged out.
4. Nonce age (nonce_age >= nonce_validity_window).
5. Rotation age (elapsed >= rotation_interval).

The decision is fully determined by (policy, state, input) — no I/O, no clock reads.