revisioned_register.go

package conformance

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"reflect"
	"sort"
	"sync"
	"testing"
	"time"

	"github.com/operatorstack/boatstack/boatstack/kernel"
)

const (
	registerAcceptTransition  = "register.accept"
	registerRecoverTransition = "register.recover"
	registerInspectOperation  = "register.inspect"
	registerRecoverOperation  = "register.recover"
)

// SettlementSnapshot is deterministic evidence from the settlement fixture.
// Candidate content is intentionally absent: staging is not accepted state.
type SettlementSnapshot struct {
	State         kernel.ControlState
	Observation   kernel.Observation
	Receipts      []kernel.Receipt
	Effects       map[string]int
	Verifications map[string]int
	CommitCount   int
}

// AcceptedValue is the independently reconstructed accepted register value.
type AcceptedValue struct {
	Binding              kernel.ObjectiveBinding
	CandidateFingerprint string
	Content              json.RawMessage
	Receipt              kernel.Receipt
}

// SettlementConformance binds a domain-neutral settlement fixture to reusable
// laws. New returns an isolated fixture; Reopen returns a fresh Runtime over
// the same durable ports.
type SettlementConformance struct {
	Program            kernel.Program
	AlternateProgram   kernel.Program
	InstanceID         string
	Authority          kernel.Authority
	AcceptTransition   string
	RecoveryTransition string

	New                        func(testing.TB) SettlementConformance
	Stage                      func(any) (kernel.Objective, error)
	Accepted                   func() (AcceptedValue, error)
	Snapshot                   func() SettlementSnapshot
	Runtime                    func(testing.TB, kernel.Program, kernel.Locker) kernel.Runtime
	Reopen                     func(testing.TB) kernel.Runtime
	IndependentLocker          func() kernel.Locker
	FailNextVerification       func()
	FailNextCommit             func()
	BumpStateRevision          func()
	DriftObjectiveBinding      func(kernel.Objective)
	RetargetProgram            func(kernel.ProgramIdentity)
	RetargetInstance           func(string)
	CorruptCandidate           func(string)
	HideCandidate              func(string)
	RemoveCommittedReceipts    func()
	SubstituteCommittedReceipt func(kernel.Receipt)
}

type registerCandidate struct {
	Objective          kernel.Objective
	ContentFingerprint string
	Content            json.RawMessage
}

type registerCandidates struct {
	mu          sync.Mutex
	byObjective map[string]registerCandidate
	hidden      map[string]bool
}

func newRegisterCandidates() *registerCandidates {
	return &registerCandidates{byObjective: map[string]registerCandidate{}, hidden: map[string]bool{}}
}

func (s *registerCandidates) stage(value any) (kernel.Objective, error) {
	content, err := json.Marshal(value)
	if err != nil {
		return kernel.Objective{}, err
	}
	sum := sha256.Sum256(content)
	contentFingerprint := hex.EncodeToString(sum[:])
	objective, err := kernel.NewObjective("register-"+contentFingerprint[:16], 1, struct {
		CandidateFingerprint string `json:"candidate_fingerprint"`
	}{contentFingerprint})
	if err != nil {
		return kernel.Objective{}, err
	}
	s.mu.Lock()
	defer s.mu.Unlock()
	if existing, ok := s.byObjective[objective.Fingerprint]; ok {
		if existing.ContentFingerprint != contentFingerprint || !reflect.DeepEqual(existing.Content, json.RawMessage(content)) {
			return kernel.Objective{}, fmt.Errorf("immutable candidate identity already contains different content")
		}
		return existing.Objective, nil
	}
	s.byObjective[objective.Fingerprint] = registerCandidate{
		Objective: objective, ContentFingerprint: contentFingerprint,
		Content: append(json.RawMessage(nil), content...),
	}
	return objective, nil
}

func (s *registerCandidates) resolve(objective kernel.Objective) (registerCandidate, error) {
	if err := objective.Validate(); err != nil {
		return registerCandidate{}, err
	}
	s.mu.Lock()
	defer s.mu.Unlock()
	candidate, ok := s.byObjective[objective.Fingerprint]
	if !ok || s.hidden[objective.Fingerprint] || !candidate.ValidateIs(objective) {
		return registerCandidate{}, fmt.Errorf("exact immutable candidate is unavailable")
	}
	sum := sha256.Sum256(candidate.Content)
	if hex.EncodeToString(sum[:]) != candidate.ContentFingerprint {
		return registerCandidate{}, fmt.Errorf("immutable candidate fingerprint mismatch")
	}
	referenceFingerprint, err := candidateFingerprintFromObjective(objective)
	if err != nil || referenceFingerprint != candidate.ContentFingerprint {
		return registerCandidate{}, fmt.Errorf("objective does not resolve to the immutable candidate")
	}
	candidate.Content = append(json.RawMessage(nil), candidate.Content...)
	return candidate, nil
}

func (s *registerCandidates) resolveBinding(binding kernel.ObjectiveBinding) (registerCandidate, error) {
	s.mu.Lock()
	candidate, ok := s.byObjective[binding.ObjectiveFingerprint]
	s.mu.Unlock()
	if !ok || !binding.Matches(candidate.Objective) {
		return registerCandidate{}, fmt.Errorf("objective binding does not identify a staged immutable candidate")
	}
	return s.resolve(candidate.Objective)
}

func (s *registerCandidates) identities() []string {
	s.mu.Lock()
	defer s.mu.Unlock()
	identities := make([]string, 0, len(s.byObjective))
	for identity := range s.byObjective {
		if !s.hidden[identity] {
			identities = append(identities, identity)
		}
	}
	sort.Strings(identities)
	return identities
}

func (s *registerCandidates) corrupt(objectiveFingerprint string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	candidate := s.byObjective[objectiveFingerprint]
	candidate.Content = append(candidate.Content, byte(' '))
	s.byObjective[objectiveFingerprint] = candidate
}

func (s *registerCandidates) hide(objectiveFingerprint string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.hidden[objectiveFingerprint] = true
}

func candidateFingerprintFromObjective(objective kernel.Objective) (string, error) {
	var reference struct {
		CandidateFingerprint string `json:"candidate_fingerprint"`
	}
	if err := json.Unmarshal(objective.Reference, &reference); err != nil || len(reference.CandidateFingerprint) != 64 {
		return "", fmt.Errorf("objective reference lacks an exact candidate fingerprint")
	}
	return reference.CandidateFingerprint, nil
}

// ValidateIs compares immutable objective bytes without accepting an alias.
func (o registerCandidate) ValidateIs(objective kernel.Objective) bool {
	return o.Objective.ID == objective.ID &&
		o.Objective.Revision == objective.Revision &&
		o.Objective.Fingerprint == objective.Fingerprint &&
		reflect.DeepEqual(o.Objective.Reference, objective.Reference)
}

type registerDomain struct {
	candidates       *registerCandidates
	mu               sync.Mutex
	failVerification bool
	verifications    map[string]int
}

func (d *registerDomain) Observe(context.Context, string) (kernel.Observation, error) {
	return kernel.NewObservation(struct {
		Candidates []string `json:"candidates"`
	}{d.candidates.identities()})
}

func (d *registerDomain) Admissible(_ context.Context, evaluation kernel.Evaluation) (bool, string, error) {
	switch evaluation.Transition.Operation {
	case registerInspectOperation:
		if evaluation.State.ObjectiveBinding != nil || evaluation.Objective == nil {
			return false, "initial acceptance requires an unbound instance and one exact candidate", nil
		}
		if _, err := d.candidates.resolve(*evaluation.Objective); err != nil {
			return false, err.Error(), nil
		}
		return true, "exact immutable candidate is available", nil
	case registerRecoverOperation:
		return evaluation.State.Recovery != nil, "an unresolved candidate inspection requires recovery", nil
	default:
		return false, "unknown register operation", nil
	}
}

func (d *registerDomain) Verify(_ context.Context, evaluation kernel.Evaluation, effect kernel.Effect, target kernel.Observation) error {
	d.mu.Lock()
	d.verifications[evaluation.Transition.ID]++
	fail := d.failVerification
	d.failVerification = false
	d.mu.Unlock()
	if fail {
		return fmt.Errorf("simulated deterministic verification rejection")
	}
	if target.Fingerprint != evaluation.Observation.Fingerprint {
		return fmt.Errorf("candidate inventory changed during execution")
	}
	switch evaluation.Transition.Operation {
	case registerInspectOperation:
		if evaluation.Objective == nil {
			return fmt.Errorf("candidate inspection lacks an objective")
		}
		candidate, err := d.candidates.resolve(*evaluation.Objective)
		if err != nil {
			return err
		}
		want := kernel.EffectFact{Facet: "register.candidate", Operation: registerInspectOperation, Fingerprint: candidate.ContentFingerprint}
		if len(effect.Facts) != 1 || effect.Facts[0] != want {
			return fmt.Errorf("candidate inspection fact does not identify the exact content")
		}
	case registerRecoverOperation:
		if len(effect.Facts) != 1 || effect.Facts[0].Operation != registerRecoverOperation {
			return fmt.Errorf("recovery fact is incomplete")
		}
	default:
		return fmt.Errorf("unknown register verification operation")
	}
	return nil
}

func (d *registerDomain) failNext() {
	d.mu.Lock()
	defer d.mu.Unlock()
	d.failVerification = true
}

func (d *registerDomain) snapshot() map[string]int {
	d.mu.Lock()
	defer d.mu.Unlock()
	result := make(map[string]int, len(d.verifications))
	for transition, count := range d.verifications {
		result[transition] = count
	}
	return result
}

type registerOperator struct {
	candidates *registerCandidates
	mu         sync.Mutex
	executions map[string]int
}

func (o *registerOperator) Execute(_ context.Context, operation kernel.Operation) (kernel.Effect, error) {
	o.mu.Lock()
	o.executions[operation.Transition.ID]++
	o.mu.Unlock()
	switch operation.Transition.Operation {
	case registerInspectOperation:
		if operation.Objective == nil {
			return kernel.Effect{}, fmt.Errorf("candidate inspection lacks an objective")
		}
		candidate, err := o.candidates.resolve(*operation.Objective)
		if err != nil {
			return kernel.Effect{}, err
		}
		return kernel.Effect{Facts: []kernel.EffectFact{{
			Facet: "register.candidate", Operation: registerInspectOperation, Fingerprint: candidate.ContentFingerprint,
		}}}, nil
	case registerRecoverOperation:
		return kernel.Effect{Facts: []kernel.EffectFact{{
			Facet: "register.candidate", Operation: registerRecoverOperation, Fingerprint: "recovery-complete",
		}}}, nil
	default:
		return kernel.Effect{}, fmt.Errorf("unknown register operation")
	}
}

func (o *registerOperator) snapshot() map[string]int {
	o.mu.Lock()
	defer o.mu.Unlock()
	result := make(map[string]int, len(o.executions))
	for transition, count := range o.executions {
		result[transition] = count
	}
	return result
}

type registerCapabilities struct{}

func (registerCapabilities) RequiredCapabilities(transition kernel.Transition) ([]kernel.Capability, error) {
	switch transition.Operation {
	case registerInspectOperation:
		return []kernel.Capability{"objective.bind", "register.inspect"}, nil
	case registerRecoverOperation:
		return []kernel.Capability{"register.recover"}, nil
	default:
		return nil, fmt.Errorf("unclassified register operation %q", transition.Operation)
	}
}

// registerInstance is one durable instance record in the settlement store.
type registerInstance struct {
	state    kernel.ControlState
	receipts []kernel.Receipt
	commits  int
}

// registerStore is the keyed multi-instance settlement Store: state,
// receipts, revisions, and compare-and-swap are local to one instance.
type registerStore struct {
	mu             sync.Mutex
	instances      map[string]*registerInstance
	current        string
	commitFailures int
}

// newRegisterStore returns a settlement store provisioned with one initial
// instance record.
func newRegisterStore(initial kernel.ControlState) *registerStore {
	store := &registerStore{instances: map[string]*registerInstance{}}
	if err := store.Create(context.Background(), initial.InstanceID, initial); err != nil {
		panic(err)
	}
	return store
}

func (s *registerStore) Create(_ context.Context, instanceID string, initial kernel.ControlState) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	if initial.InstanceID != instanceID {
		return fmt.Errorf("initial control state belongs to %q, not %q", initial.InstanceID, instanceID)
	}
	if _, ok := s.instances[instanceID]; ok {
		return kernel.InstanceExistsError{InstanceID: instanceID}
	}
	s.instances[instanceID] = &registerInstance{state: cloneSettlementState(initial)}
	if s.current == "" {
		s.current = instanceID
	}
	return nil
}

func (s *registerStore) Load(_ context.Context, instanceID string) (kernel.InstanceRecord, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance, ok := s.instances[instanceID]
	if !ok {
		return kernel.InstanceRecord{}, kernel.InstanceNotFoundError{InstanceID: instanceID}
	}
	return kernel.InstanceRecord{State: cloneSettlementState(instance.state), Receipts: append([]kernel.Receipt(nil), instance.receipts...)}, nil
}

func (s *registerStore) BeginEffect(_ context.Context, instanceID string, revision uint64, attempt kernel.ControlState) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance, ok := s.instances[instanceID]
	if !ok {
		return kernel.InstanceNotFoundError{InstanceID: instanceID}
	}
	if instance.state.Revision != revision {
		return fmt.Errorf("stale revision")
	}
	instance.state = cloneSettlementState(attempt)
	return nil
}

func (s *registerStore) CommitTransition(_ context.Context, instanceID string, revision uint64, target kernel.ControlState, receipt kernel.Receipt) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance, ok := s.instances[instanceID]
	if !ok {
		return kernel.InstanceNotFoundError{InstanceID: instanceID}
	}
	if s.commitFailures > 0 {
		s.commitFailures--
		return fmt.Errorf("simulated atomic transaction failure")
	}
	if instance.state.Revision != revision {
		return fmt.Errorf("stale revision")
	}
	instance.state = cloneSettlementState(target)
	instance.receipts = append(instance.receipts, receipt)
	instance.commits++
	return nil
}

// currentInstance returns the fixture's active instance record. Fixture
// hooks act on this record; the kernel-facing Store methods never use it.
func (s *registerStore) currentInstance() *registerInstance {
	instance, ok := s.instances[s.current]
	if !ok {
		panic(fmt.Sprintf("register store has no current instance %q", s.current))
	}
	return instance
}

func (s *registerStore) snapshot() (kernel.ControlState, []kernel.Receipt, int) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance := s.currentInstance()
	return cloneSettlementState(instance.state), append([]kernel.Receipt(nil), instance.receipts...), instance.commits
}

func (s *registerStore) failNextCommit() {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.commitFailures++
}

func (s *registerStore) bumpRevision() {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().state.Revision++
}

func (s *registerStore) retargetProgram(program kernel.ProgramIdentity) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().state.Program = program
}

// retargetInstance provisions a separate control instance whose state
// mirrors the active one and makes it the fixture's active instance, so laws
// can address a prescription minted for one instance against another.
func (s *registerStore) retargetInstance(instanceID string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	state := cloneSettlementState(s.currentInstance().state)
	state.InstanceID = instanceID
	s.instances[instanceID] = &registerInstance{state: state}
	s.current = instanceID
}

func (s *registerStore) setBinding(objective kernel.Objective) {
	s.mu.Lock()
	defer s.mu.Unlock()
	binding, err := kernel.BindObjective(objective)
	if err != nil {
		panic(err)
	}
	s.currentInstance().state.ObjectiveBinding = &binding
}

func (s *registerStore) removeReceipts() {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().receipts = nil
}

func (s *registerStore) substituteLastReceipt(receipt kernel.Receipt) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance := s.currentInstance()
	if len(instance.receipts) == 0 {
		panic("no committed receipt to substitute")
	}
	instance.receipts[len(instance.receipts)-1] = receipt
}

func (s *registerStore) reset(state kernel.ControlState) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().state = cloneSettlementState(state)
}

// forceState overwrites the requested instance's state without any
// compare-and-swap, for dishonest white-box store variants.
func (s *registerStore) forceState(instanceID string, state kernel.ControlState) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.instances[instanceID].state = cloneSettlementState(state)
}

// forceCommit commits state plus receipt without any compare-and-swap, for
// dishonest white-box store variants.
func (s *registerStore) forceCommit(instanceID string, target kernel.ControlState, receipt kernel.Receipt) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance := s.instances[instanceID]
	instance.state = cloneSettlementState(target)
	instance.receipts = append(instance.receipts, receipt)
	instance.commits++
}

type settlementLocker struct{ mu sync.Mutex }

func (l *settlementLocker) Acquire(context.Context, string) (kernel.Lock, error) {
	l.mu.Lock()
	return settlementLock{mu: &l.mu}, nil
}

type settlementLock struct{ mu *sync.Mutex }

func (l settlementLock) Unlock() error {
	l.mu.Unlock()
	return nil
}

type settlementClock struct{ now time.Time }

func (c settlementClock) Now() time.Time { return c.now }

// RevisionedRegisterFixture returns the second domain-neutral kernel fixture.
func RevisionedRegisterFixture() SettlementConformance {
	fixture, _ := newRevisionedRegisterFixture()
	return fixture
}

// registerPorts exposes the concrete fixture ports so white-box counterexample
// tests can wire dishonest store or reader variants against the same laws.
type registerPorts struct {
	program    kernel.Program
	initial    kernel.ControlState
	candidates *registerCandidates
	domain     *registerDomain
	operator   *registerOperator
	classifier registerCapabilities
	store      *registerStore
	clock      settlementClock
}

func newRevisionedRegisterFixture() (SettlementConformance, registerPorts) {
	program, err := compileRegisterProgram(1)
	if err != nil {
		panic(err)
	}
	alternate, err := compileRegisterProgram(2)
	if err != nil {
		panic(err)
	}
	instanceID := "revisioned-register"
	now := time.Date(2026, 8, 23, 12, 0, 0, 0, time.UTC)
	authority := kernel.Authority{Receipts: []kernel.AuthorityReceipt{{
		ID: "register-authority", Subject: "fixture", Fingerprint: "register-authority",
		Capabilities: []kernel.Capability{"objective.bind", "register.inspect", "register.recover"},
		IssuedAt:     now.Add(-time.Minute), ExpiresAt: now.Add(time.Hour),
	}}}
	candidates := newRegisterCandidates()
	domain := &registerDomain{candidates: candidates, verifications: map[string]int{}}
	operator := &registerOperator{candidates: candidates, executions: map[string]int{}}
	store := newRegisterStore(kernel.ControlState{
		InstanceID: instanceID, Program: program.Identity(), Mode: "unbound", Revision: 1,
	})
	clock := settlementClock{now: now}
	classifier := registerCapabilities{}

	runtimeFor := func(t testing.TB, selected kernel.Program, selectedLocker kernel.Locker) kernel.Runtime {
		t.Helper()
		runtime, runtimeErr := kernel.NewRuntime(selected, domain, operator, classifier, store, selectedLocker, clock)
		if runtimeErr != nil {
			t.Fatalf("construct settlement runtime: %v", runtimeErr)
		}
		return runtime
	}
	snapshot := func() SettlementSnapshot {
		state, receipts, commits := store.snapshot()
		observation, observeErr := domain.Observe(context.Background(), state.InstanceID)
		if observeErr != nil {
			panic(observeErr)
		}
		return SettlementSnapshot{
			State: state, Observation: observation, Receipts: receipts,
			Effects: operator.snapshot(), Verifications: domain.snapshot(), CommitCount: commits,
		}
	}
	accepted := func() (AcceptedValue, error) {
		state, receipts, _ := store.snapshot()
		if state.ObjectiveBinding == nil {
			return AcceptedValue{}, fmt.Errorf("accepted objective binding is absent")
		}
		candidate, resolveErr := candidates.resolveBinding(*state.ObjectiveBinding)
		if resolveErr != nil {
			return AcceptedValue{}, resolveErr
		}
		var matching []kernel.Receipt
		for _, receipt := range receipts {
			if receipt.TransitionID == registerAcceptTransition &&
				reflect.DeepEqual(receipt.ResultObjectiveBinding, state.ObjectiveBinding) {
				matching = append(matching, receipt)
			}
		}
		if len(matching) != 1 {
			return AcceptedValue{}, fmt.Errorf("accepted binding requires exactly one matching committed receipt, got %d", len(matching))
		}
		receipt := matching[0]
		if err := receipt.Validate(); err != nil ||
			receipt.InstanceID != state.InstanceID ||
			receipt.ResultStateRevision != state.Revision ||
			receipt.PriorObjectiveBinding != nil ||
			!reflect.DeepEqual(receipt.RequestedObjectiveBinding, state.ObjectiveBinding) {
			return AcceptedValue{}, fmt.Errorf("committed receipt does not prove the exact accepted binding")
		}
		return AcceptedValue{
			Binding: *state.ObjectiveBinding, CandidateFingerprint: candidate.ContentFingerprint,
			Content: append(json.RawMessage(nil), candidate.Content...), Receipt: receipt,
		}, nil
	}

	fixture := SettlementConformance{
		Program: program, AlternateProgram: alternate, InstanceID: instanceID, Authority: authority,
		AcceptTransition: registerAcceptTransition, RecoveryTransition: registerRecoverTransition,
		Stage: candidates.stage, Accepted: accepted, Snapshot: snapshot,
		Runtime:              runtimeFor,
		Reopen:               func(t testing.TB) kernel.Runtime { return runtimeFor(t, program, &settlementLocker{}) },
		IndependentLocker:    func() kernel.Locker { return &settlementLocker{} },
		FailNextVerification: domain.failNext, FailNextCommit: store.failNextCommit,
		BumpStateRevision: store.bumpRevision, DriftObjectiveBinding: store.setBinding,
		RetargetProgram:  store.retargetProgram,
		RetargetInstance: store.retargetInstance,
		CorruptCandidate: candidates.corrupt, HideCandidate: candidates.hide,
		RemoveCommittedReceipts:    store.removeReceipts,
		SubstituteCommittedReceipt: store.substituteLastReceipt,
	}
	fixture.New = func(testing.TB) SettlementConformance {
		fresh, _ := newRevisionedRegisterFixture()
		return fresh
	}
	ports := registerPorts{
		program: program, initial: cloneSettlementState(kernel.ControlState{
			InstanceID: instanceID, Program: program.Identity(), Mode: "unbound", Revision: 1,
		}),
		candidates: candidates, domain: domain, operator: operator,
		classifier: classifier, store: store, clock: clock,
	}
	return fixture, ports
}

func compileRegisterProgram(priority int) (kernel.Program, error) {
	return kernel.CompileProgram("revisioned-register", "1.0.0", "kernel-v1", "unbound", []string{"accepted"}, []kernel.Transition{
		{
			ID: registerAcceptTransition, SourceModes: []string{"unbound"}, TargetMode: "accepted",
			ObjectiveScope: kernel.ObjectiveNone, ObjectiveMutation: kernel.BindInitialObjective,
			RequiredCapabilities: []kernel.Capability{"objective.bind", "register.inspect"},
			OwnedFacets:          []string{"register.candidate", "supervisor.objective"},
			Operation:            registerInspectOperation, SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: priority,
		},
		{
			ID: registerRecoverTransition, SourceModes: []string{"unbound"}, TargetMode: "unbound",
			ObjectiveScope: kernel.ObjectiveOptionalPreserve, ObjectiveMutation: kernel.PreserveObjective,
			RequiredCapabilities: []kernel.Capability{"register.recover"}, OwnedFacets: []string{"register.candidate"},
			Operation: registerRecoverOperation, SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 10,
			Recovers: []string{registerAcceptTransition, registerRecoverTransition},
		},
	})
}

func cloneSettlementState(state kernel.ControlState) kernel.ControlState {
	copy := state
	if state.ObjectiveBinding != nil {
		binding := *state.ObjectiveBinding
		copy.ObjectiveBinding = &binding
	}
	if state.Recovery != nil {
		recovery := *state.Recovery
		copy.Recovery = &recovery
	}
	return copy
}