diff --git a/src-tauri/src/download.rs b/src-tauri/src/download.rs
index 85c9649..11ef788 100644
--- a/src-tauri/src/download.rs
+++ b/src-tauri/src/download.rs
@@ -580,14 +580,14 @@ async fn download_attempt(
         )));
     }
 
-    let mut resumed = existing_len > 0 && response.status() == StatusCode::PARTIAL_CONTENT;
+    let resumed = existing_len > 0 && response.status() == StatusCode::PARTIAL_CONTENT;
     if resumed {
         let content_range = response
             .headers()
             .get(reqwest::header::CONTENT_RANGE)
             .and_then(|h| h.to_str().ok());
         if !content_range.is_some_and(|r| r.starts_with(&format!("bytes {}-", existing_len))) {
-            resumed = false;
+            return Err(AttemptError::Failed("Server returned invalid Content-Range for resume".to_string()));
         }
     }
     let completed_at_start = if resumed { existing_len } else { 0 };
diff --git a/src-tauri/src/extension_server.rs b/src-tauri/src/extension_server.rs
index 06f35e7..648685a 100644
--- a/src-tauri/src/extension_server.rs
+++ b/src-tauri/src/extension_server.rs
@@ -337,7 +337,7 @@ fn claim_request(signature: &str, timestamp: u64, replay_cache: &ReplayCache) ->
     };
     cache.retain(|_, seen_at| now.saturating_sub(*seen_at) < SIGNATURE_MAX_AGE_MS);
     if cache.len() > 10_000 {
-        cache.clear();
+        return false;
     }
     let key = format!("{timestamp}:{}", signature.to_ascii_lowercase());
     cache.insert(key, now).is_none()