# Linux inotify observes opens, not just content validation. Only an owned temp fixture is watched.
import ctypes, os, struct, subprocess, tempfile
from pathlib import Path
repo=Path('/mnt/storage/src/mosaic-stack-rocko-178')
libc=ctypes.CDLL(None,use_errno=True)
fd=libc.inotify_init1(os.O_NONBLOCK|os.O_CLOEXEC)
assert fd>=0,'inotify unavailable'
try:
 with tempfile.TemporaryDirectory(prefix='proof-render-watch-',dir=os.environ['TMPDIR']) as d:
  file=Path(d)/'proof.fixture';file.write_text('fixture-invalid-proof-bytes');file.chmod(0o600)
  # IN_ACCESS | IN_OPEN: metadata stat/realpath never opens or reads the watched file.
  wd=libc.inotify_add_watch(fd,os.fsencode(file),0x1|0x20)
  assert wd>=0,'watch failed'
  r=subprocess.run(['bash',str(repo/'scripts/webui-service.sh'),'render','--public-host','console.example','--auth-header','x-user','--allow-user','jason','--proof-header','x-console-proof','--proof-file',str(file)],env={**os.environ,'HOME':d,'XDG_CONFIG_HOME':str(Path(d)/'config')},capture_output=True,text=True,timeout=10)
  assert r.returncode==0,'render failed'
  try:events=os.read(fd,65536)
  except BlockingIOError:events=b''
  assert not events,'render opened or read the fixture proof file'
  assert 'fixture-invalid-proof-bytes' not in r.stdout+r.stderr,'render disclosed fixture contents'
  print('PASS: render carries both flags without opening or reading the watched fixture')
finally:os.close(fd)