Function token_mutation_decision 

pub fn token_mutation_decision(
    facts: TokenMutationFacts,
) -> TokenMutationDecision

Fence a token mutation against its exact committed generation.

A retained log tail wins over retry classification. Exact already-applied updates and already-missing deletes are idempotent. No update may revive a token that has expired, which Kafka’s DelegationTokenControlManager defines as a deadline strictly before now, or cross the token’s immutable maximum timestamp. A renewal lands at or after now but, as in Kafka’s renewDelegationToken, may shorten the current expiry.