import importlib.util, json, os, pathlib, shutil
from build import R,g
os.umask(0o077)
OLD=pathlib.Path('/tmp/codex/ltb1021/2026-09-11_contextra-metadata-auth_r01')
def main():
 assert not (R/'plan.json').exists()
 s=importlib.util.spec_from_file_location('previous_prepare',OLD/'prepare.py')
 m=importlib.util.module_from_spec(s);s.loader.exec_module(m)
 m.C=g.ENV.parent/'metadata-lan-lifespan'
 shutil.copyfile(OLD/'firewall.py',R/'firewall.py')
 m.main()
 plan=json.loads((R/'plan.json').read_text());C=pathlib.Path(plan['controls'])
 override=g.yaml.safe_load((C/'compose.yaml').read_text())
 override['services']['analytics']['image']=json.loads((R/'build.json').read_text())['tag']
 (C/'compose.yaml').write_text(g.yaml.safe_dump(override))
 plan['control_hashes']={str(p):g.sha(p) for p in C.iterdir() if p.is_file()}
 plan['temporary_controls']={
  'restart':'no during window; restore actual previous policy AND compose after stop',
  'display':'0.1 test only; restore previous configured value via fresh settings revision',
  'capture':'max3/60s; remove capture.enabled at end; retain mount/env disabled until next approved recreate',
  'metadata_auth_lan':'retain persistent authenticated settings if success; rollback only this task on failure'}
 (R/'plan.json').write_text(json.dumps(plan,indent=2))
 print('EXACT_IMAGE_AND_RESTORE_PLAN_FIXED')
if __name__=='__main__':main()