pub enum Capability { Inspect, CandidateWrite, Release, ExternalMutation }
pub fn authorize(lease:&Lease, req:&Request, now_ms:u64)->Result<(),GateError>{
    if now_ms >= lease.expires_at_ms { return Err(GateError::Expired); }
    if req.resource != lease.resource { return Err(GateError::ResourceMismatch); }
    if req.actor != lease.actor { return Err(GateError::ActorMismatch); }
    if req.fence == 0 || req.fence != lease.fence { return Err(GateError::FenceMismatch); }
    match req.capability { Capability::Inspect|Capability::CandidateWrite=>Ok(()), _=>Err(GateError::CapabilityDenied) }
}