/**
 * HELD-OUT cell H1-safe — discriminator counterpart of H1-vuln (same 3rd domain, same lexicon).
 * BOTH payout paths now mediate the self-deal: autoSettleBounty loads the reviewer of record and applies
 * the SAME isSameUser guard before recording the payout.
 * PREDICTION: oracle SILENT (no INTER-SINK GAP, no INTRA-SINK GAP) -> the detector DISCRIMINATES, it does
 * not fire on every value sink. A detector that flagged this safe variant would be worthless.
 */
type Submission = { researcherUserId: string; bountyAgorot: number; reviewerUserId: string };

function loadSubmission(id: string): Submission {
  return { researcherUserId: id, bountyAgorot: 0, reviewerUserId: id };
}
function recordLedgerEntry(entry: { amount: number; beneficiaryUserId: string; entryType: string }): void {
  void entry; // persists a ledger row (sink)
}
function isSameUser(a: string, b: string): boolean {
  return a === b;
}

export function approveAndPayBounty(submissionId: string, reviewerUserId: string): void {
  const submission = loadSubmission(submissionId);
  const researcherUserId = submission.researcherUserId;
  const payoutAmount = submission.bountyAgorot;

  if (isSameUser(reviewerUserId, researcherUserId)) {
    throw new Error('reviewer cannot approve own submission');
  }

  recordLedgerEntry({
    amount: payoutAmount,
    beneficiaryUserId: researcherUserId,
    entryType: 'bounty_payout',
  });
}

export function autoSettleBounty(submissionId: string): void {
  const submission = loadSubmission(submissionId);
  const researcherUserId = submission.researcherUserId;
  const reviewerUserId = submission.reviewerUserId;
  const bountyAmount = submission.bountyAgorot;

  // FIX: the auto-settle path now applies the same self-deal mediation.
  if (isSameUser(reviewerUserId, researcherUserId)) {
    throw new Error('reviewer of record cannot be the researcher');
  }

  recordLedgerEntry({
    amount: bountyAmount,
    beneficiaryUserId: researcherUserId,
    entryType: 'bounty_payout',
  });
}