Verify the previous state as part of every state transition

I became worried about the threading logic, for example in Candidate, there seems to be a race condition between the timeout & the callback.  It is cheap to self-check the state transitions by passing in the previous state.