Function verify_answer_capability 

pub fn verify_answer_capability<S: BuildHasher>(
    payload: &[u8],
    conversation_id: &str,
    turn_id: &str,
    consumed: &HashSet<String, S>,
    trusted_signers: &[Vec<u8>],
) -> Option<VerifiedQuestionAnswer>

Verify a persisted question_response as a SINGLE-USE, conversation-bound capability (invariant I3/I7), gated on a trusted-signer allow-list.

Returns the verified answer only when ALL hold: the embedded signer is trusted; the signature verifies; the signed conversation_id equals conversation_id; the signed turn_id names the occurrence turn_id (or is empty — see below); the signed nonce is non-empty AND not already in consumed. The caller MUST record the returned nonce into its consumed set before honoring the answer, so a second presentation is rejected.

The empty-turn carve-out is the durable-record rule, not a loophole: an answer signed before occurrence identity existed derives its turn from its own append-only event kind, which the caller supplies as turn_id. Every newly minted answer signs its turn, so it must name the occurrence it is applied to.