How do you prevent replay attacks on BLE control commands?

Prevent BLE replay attacks with monotonic counters, session nonces, or authenticated encryption on write characteristics that change behavior. Reject stale commands with error codes the app can explain. For example, a heater should ignore a captured old enable command even if the phone reconnects later nearby.