Function controller_request_admission 

pub fn controller_request_admission(
    expiry_ms: Option<i64>,
    api_key: i16,
    now_ms: i64,
) -> bool

Controller connections currently require reconnecting to reauthenticate.

Expiry therefore fails the authentication phase before any API dispatch. A session expires only strictly after its deadline, as Kafka’s KafkaChannel.serverAuthenticationSessionExpired decides, so a request at exactly expiry_ms is still admitted.