Module gate 

Hot-path inbound gate.

Plugins call PairingGate::should_admit before publishing an inbound event to the broker. Three outcomes:

• Decision::Admit — sender is in allow_from; publish.
• Decision::Challenge — first time we see this sender and the binding has auto_challenge: true; the plugin replies with the code and drops the message.
• Decision::Drop — auto_challenge: false and sender unknown, or max-pending exhausted; silent drop.

A short-TTL cache (30 s) keeps the SQLite hit out of the hot path for already-allowlisted senders. Operators that need an immediate revoke can call PairingGate::flush_cache.

Structs

PairingGate