Function decide_handshake 

pub fn decide_handshake(
    hello: &Hello,
    expected: &Welcome,
    face: &BindFace,
) -> HandshakeVerdict

Decides whether to accept a peer.

Order is deliberate: protocol agreement is settled before credentials. A browser holding a cached older client is the common case and deserves “refresh”, not “wrong password”. Pure - expected and face are parameters, never read from ambient state.

The credential a caller must present is the face’s, which means an exposed face cannot be served without one: BindFace::Exposed holds the digest, and there is no other way to reach this function.

The digest is a digest, not the token. This crate never holds the plaintext of a pairing token: the side that owns the token digests it once, and the boundary compares digests. That keeps credential exposure at the redemption points where it is audited, and it costs nothing here because the comparison hashes both sides anyway.