build
As build, but also reports what became of the packet's start.
Use this wherever the recovered origin time matters, which is anywhere two copies of one event have to be ordered. build cannot express the difference: it writes now into start whenever it has nothing better, and that fallback is indistinguishable from a genuine value once it is in the XML, while reading as maximally fresh.
now is the reference instant, defaulting to the current one. Pass the original decode instant when rebuilding a stored capture, otherwise every carried start is refused as out of range against a clock hours ahead of the one that recorded it.
Return
the XML, which is always produced, plus the StartRecovery case and the sender's own start when there is one. Deciding what to do about StartRecovery.REFUSED is the caller's: this is a codec, and the position, uid and type are unaffected by a bad clock.
The three suppressions below were carried by build in the detekt baseline before its body moved here. Relocated rather than newly incurred, and stated at the code rather than in a file nobody opens: this renders every CoT payload variant in one pass.