Function pairing_enabled 

pub const fn pairing_enabled(
    pairing_mode: bool,
    pin_configured: bool,
    locked_out: bool,
) -> bool

Non-OOB pairing admission.

Pairing mode is mandatory. A configured PIN selects LESC Passkey Entry; it does not authorize enrollment, so it can never stand in for the physical-presence gesture that arms the window.

Lockout is conditioned on pin_configured deliberately: it exists to stop Passkey Entry bit-leak probing, and under Just Works there is no passkey to leak — gating the unauthenticated path on the same counter would let an in-range attacker deny pairing for the rest of the power cycle with three bad confirm values.

Bond-store capacity is deliberately not a term. A full store evicts its least-recently-used bond on the next successful pairing; enrollment is never refused for lack of space. See crate::ble_security callers and umsh_journal_store::ble::upsert_bond.