#!/usr/bin/env python3
"""Run one bounded original-only diagnostic control; preserve failures and unsupported exit 2."""
import argparse
import json
import os
from pathlib import Path
import secrets
import subprocess

parser=argparse.ArgumentParser(description=__doc__)
parser.add_argument('--adapter',type=Path,required=True)
parser.add_argument('--output',type=Path,required=True)
parser.add_argument('--mode',choices=['normal','active-restart'],required=True)
args=parser.parse_args()
output=args.output.resolve()
if output.exists():raise RuntimeError('Use a fresh private output directory')
log=output.with_suffix('.log')
environment=os.environ.copy()
environment['OTOPCUA_BASELINE_CANONICAL_KEY']='otua_k-server-events_'+secrets.token_hex(3)
command=['dotnet',str(args.adapter.resolve(strict=True)),str(output),'1']
if args.mode=='active-restart':command+=['--active-restart-control']
with os.fdopen(os.open(log,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600),'w') as stream:
    try:result=subprocess.run(command,env=environment,stdout=stream,stderr=subprocess.STDOUT,timeout=120);exit_code=result.returncode
    except subprocess.TimeoutExpired:exit_code=124
if output.exists():
    (output/'runner-receipt.json').write_text(json.dumps({'mode':args.mode,'exitCode':exit_code,'acceptance':False,
        'productRebuilt':False,'timeoutSeconds':120,'credentialBytes':len(environment['OTOPCUA_BASELINE_CANONICAL_KEY'].encode())},indent=2)+'\n')
print(json.dumps({'mode':args.mode,'exitCode':exit_code,'acceptance':False}))
raise SystemExit(exit_code)