Function decide_handshake 

pub fn decide_handshake(
    hello: &Hello,
    expected: &Welcome,
    keys: &Keys<'_>,
) -> HandshakeVerdict

Decides whether to accept a peer.

Order is deliberate: protocol agreement is settled before credentials. A browser holding a cached older client is the common case and deserves “refresh”, not “wrong password”. Pure - expected and keys are parameters, never read from ambient state.

The credential a caller must present is the face’s key or a live session token (Keys::pairing); neither face can be served without a key, so there is no greeting this accepts empty-handed.

The digest is a digest, not the token. This crate never holds the plaintext of a pairing token: the side that owns the token digests it once, and the boundary compares digests. That keeps credential exposure at the redemption points where it is audited, and it costs nothing here because the comparison hashes both sides anyway.