Every command is signed with the HMAC secret and expires in 120 seconds. The PC engine verifies each signature locally before anything reaches the EA, and the EA re-checks expiry and idempotency — a replayed or late command can never trade.