"""Start rig A's daemon from EXE under a PROVEN scrubbed env (launch-gate.py pattern): Popen DETACHED + log file,
then read the child's env + exe back with psutil. Refuses if any scrubbed var leaked."""
import os, subprocess, sys, time, pathlib, psutil
EXE = sys.argv[1]; HOME = "C:/Users/decid/spt-rig-a"; LOG = pathlib.Path(sys.argv[2])
TRIO = ("OWL_SESSION_ID", "SPT_AGENT_ID", "SPT_ENDPOINT_ID")
COMP = ("SPT_SESSION_NAME", "SPT_ADAPTER", "SPT_HOST_PID", "SPT_INJECT_VERIFY_ECHO", "SPT_POOL_UNCHECKED", "CARGO_TARGET_DIR", "SPT_DOCS_PORT")
env = dict(os.environ)
dropped = [k for k in TRIO + COMP if env.pop(k, None) is not None]
env["SPT_HOME"] = HOME; env["SPT_TEST_EPHEMERAL_ADVISORY_PORTS"] = "1"
log = open(LOG, "ab")
flags = subprocess.CREATE_NEW_PROCESS_GROUP | subprocess.DETACHED_PROCESS
child = subprocess.Popen([EXE, "daemon", "run", "--detached"], cwd=HOME, env=env, stdout=log, stderr=subprocess.STDOUT, stdin=subprocess.DEVNULL, creationflags=flags, close_fds=True)
print(f"launcher child pid={child.pid} dropped={' '.join(dropped) or 'none'}")
pidf = pathlib.Path(HOME) / "daemon.pid"; before = pidf.read_text().strip() if pidf.exists() else ""
deadline = time.time() + 40; dpid = None
while time.time() < deadline:
    if pidf.exists():
        p = pidf.read_text().strip()
        if p and p != before and psutil.pid_exists(int(p)):
            dpid = int(p); break
    time.sleep(1)
if dpid is None:
    print(f"NO NEW daemon.pid within 40 s (before={before!r}); launcher child alive={child.poll() is None}"); sys.exit(3)
proc = psutil.Process(dpid); seen = proc.environ(); leaked = [k for k in TRIO + COMP if k in seen]
print(f"daemon pid={dpid} exe={proc.exe()} SPT_HOME={seen.get('SPT_HOME')} advisory={seen.get('SPT_TEST_EPHEMERAL_ADVISORY_PORTS')} leaked={leaked or 'NONE'}")
if leaked: proc.kill(); sys.exit(4)