CodeParkstate ties the callback to the browser session that started the flow (CSRF on the redirect); nonce binds the ID token to that request so it can't be replayedstate stops CSRF on the redirect, and nonce stops ID token replay.state: The client creates state and stores it. It rejects any callback whose state doesn't match. So an attacker can't push their own authorization code into the victim's session.nonce: The server copies the nonce inside the signed ID token. So the client rejects a token captured from another login.
"nonce replaces PKCE; state replaces the client secret" is wrong. Neither one replaces PKCE, which protects the code itself.