def expected(x):
 if x.get('baseline_oracle_reuse') or not x.get('recomputed_from_new_connection', True): return 'HOLD_BASELINE_ORACLE_REUSE'
 if not x.get('oidc_subject_ref') or x.get('authentication_state')!='AUTHENTICATED_CURRENT': return 'HOLD_IDENTITY_BINDING'
 if x.get('required_publish_scope') not in x.get('granted_scope',[]): return 'HOLD_PUBLISH_SCOPE'
 if not x.get('consent_record_ref') or not x.get('consent_current',False): return 'HOLD_CONSENT'
 if not x.get('token_valid',False) and x.get('refresh_state') not in ('AVAILABLE_SYNTHETIC','REFRESHED_SYNTHETIC'): return 'HOLD_TOKEN_REAUTH'
 if x.get('token_secret_exposed'): return 'HOLD_TOKEN_SECURITY'
 if x.get('content_approval_state')!='APPROVED_CURRENT' or x.get('content_ref')!=x.get('approved_content_ref'): return 'HOLD_CONTENT_APPROVAL'
 if not x.get('actor_role_valid',False) or x.get('publish_permission')!=x.get('required_publish_scope'): return 'HOLD_ACTOR_AUTHORITY'
 if not x.get('provider_version_current',False): return 'HOLD_PROVIDER_VERSION'
 if x.get('revocation_state')!='NOT_REVOKED': return 'HOLD_REVOKED'
 if not x.get('audit_event_ref') or not x.get('provenance',False): return 'HOLD_AUDIT_PROVENANCE'
 return 'PUBLISH_REVIEW_REQUIRED'

def expected_transfer(x):
 return expected(x)

def inspect_transfer(x):
 out=[]
 if x.get('baseline_oracle_reuse'): out.append('BASELINE_ORACLE_REUSE_FORBIDDEN')
 if not x.get('recomputed_from_new_connection'): out.append('TRANSFER_MUST_RECOMPUTE')
 return out