fix(diff): diff runs exec on a scratch copy and reports exactly the units it writes (#907, #807)

[ako]

Closes #907, closes #807. Also fixes the "diff runs no earlier statements" part of #856. Part of #714.

What changes

mxcli diff used to predict exec by rendering each statement as MDL and comparing that text with the stored document's describe, without running anything. Every normalisation exec applies had to be copied into that renderer, and the copies drifted. Rehearsal 3 found phantom changes on 66 scripts and no report on 37 scripts that did write.

diff now runs exec. The new package mdl/scriptdiff:

1. copies the project to a scratch folder. It skips .git, deployment, releases and node_modules, and deletes the folder afterwards;
2. runs the script there with exec's own code: the same pre-flight (execPreflight, moved out of exec into one shared function), ExecuteProgram or the continue-on-error run, under the script's language header;
3. compares the copy with the project unit by unit, both by bytes and by the .mpr Unit-table container. Without the container check, a move that rewrites no unit bytes would not show up;
4. renders each changed unit with DESCRIBE before and after. A domain model is shown per entity and association; module security per module role; project security per user role and demo user. If a unit is written but describes the same, diff lists the properties that change (changed: CanvasHeight, …), or the folder it moves to.

The units diff reports are therefore the units exec writes. There is no second verdict left to keep in step with exec.

What this fixes:

• mxcli diff disagrees with exec: phantom changes for default spellings and layout; no coverage of pages, translations, layout repointing #907: no more phantom changes (Boolean vs Boolean default false, String vs String(unlimited), @Position, flow layout). Pages, translations, layout repointing, security, navigation, settings and folders are all covered.
• diff ignores the statement verb: a plain create of an existing document diffs as unchanged #807: a plain create of an existing document is reported as Refused: exec would stop at this error, having written nothing: … already exists.
• Splice matching: other clauses with two parse paths; diff runs no earlier statements #856: statements that depend on earlier ones (a flow calling one the script creates first) now diff, because the earlier statements run first.

Design choices

• The scratch run always uses the file engine, also under --mcp. The script is executed for real, so only the copy may receive it.
• diff gets --no-check, --continue-on-error and --deprecations, matching exec, so it can predict a given exec invocation exactly. A new --exec-output flag also prints what exec reports while it runs.
• New summary format: Summary: N new, N modified, N removed — exec would write K unit(s) (or — exec would write nothing). The old unchanged count was per statement, and that has no meaning once the verdict is per unit.
• The statement-based differ is deleted (cmd_diff_mdl.go, cmd_diff_render.go, spliceVerdict), together with its unit tests. Two of them were in cmd_associations_storage_test.go. diff-local keeps the shared output formatters.
• File changes outside the model are listed (New file: javasource/…). mxcli's own caches (.mxcli/ and the generated widget docs in .claude|.ai-context/skills/widgets) are excluded, because any mxcli run may refresh them.
• Exit status is unchanged (0) when exec would refuse or stop. The verdict is in the output.
• Cost: about 0.4 s on PedApp and 1.7 s on TestApp (56 MB) for the repro.

No change of MDL meaning and no new rejection: diff writes nothing. The twice-exec rule is checked from diff's side. After an exec, diff reports exactly what a second exec writes, which is usually nothing.

Test plan

What I ran:

• go test ./mdl/scriptdiff/ (new, PedApp fixture, Studio Pro-authored):
  • an applied script diffs as exec would write nothing. The control is that the first run reports the entity as new and exec agrees;
  • a plain create of an existing element is refused with exec's error (diff ignores the statement verb: a plain create of an existing document diffs as unchanged #807);
  • earlier statements run first (Splice matching: other clauses with two parse paths; diff runs no earlier statements #856);
  • a page layout change shows as the Layout: line;
  • a folder move is reported. The control is that repeating the move writes nothing and diff reports nothing.
  • Every test also checks that diff did not touch the project, and that diff's set of written units equals exec's.
• go test -tags integration ./mdl/scriptdiff/ -run TestDiffFollowsExec_Examples (new property; PedApp; 9 doctype scripts: domain model, microflows, pages, security, constants, navigation, settings, folders, languages). Each script runs twice. diff's written-unit set equals exec's on both runs. 132 s.
• MXCLI_DIFF_LEGS=… go test -tags integration ./mdl/scriptdiff/ -run TestDiffFollowsExec_Legs on copies of the rehearsal-3 work trees: demo2, rest-head, captrack, ledger-head, f1 back and front, demo2-mdl0, rest-mdl0. 162 of 162 scripts agree; exec wrote in 26 of them. (Manual run, not CI.)
• go test -tags integration ./mdl/roundtrip/ -run 'TestPedAppSpliceParity_|TestFlowVerdictAgreement_|TestSpliceRerun_NoFolderClause' passes. These parity/verdict tests now go through the new diff, and their expected strings were updated.
• go test ./mdl/executor/, go test ./cmd/mxcli/ (skill line budgets), make build, make lint (includes check-conformance), make check-findings, make check-wiki-pages: all pass.

Revert checks

• Binary built from origin/main, run on the same PedApp copy:
  • mxcli diff disagrees with exec: phantom changes for default spellings and layout; no coverage of pages, translations, layout repointing #907 repro after exec: 0 new, 1 modified with the Boolean default false / String(unlimited) / @Position phantoms. New: exec would write nothing.
  • diff ignores the statement verb: a plain create of an existing document diffs as unchanged #807: old 0 new, 1 modified, 0 unchanged. New: Refused: … entity already exists.
  • Splice matching: other clauses with two parse paths; diff runs no earlier statements #856: old Could not diff: … microflow not found. New: both microflows new.
• Disabling the container comparison in Snapshot.Compare makes TestDiffReportsAMoveToAnotherFolder fail: the move is no longer reported.

Follow-ups (not in this PR)

• diff now shows real exec writes that the old differ hid. For example, re-executing PedApp's MyFirstModule.Home_Web describe rewrites the page (CanvasHeight/Width, PhoneWeight/PreviewWidth), and run 2 of several doctype scripts still writes units. Those are exec idempotency issues and are now visible through diff.
• Interrupting diff leaves its scratch folder in $TMPDIR.

🤖 Generated with Claude Code

[ako]

Independent review: pushed b7a48cc. diff ran the script for real on the copy, but a headerless script with connect local '<-p project>' wrote into the real project and reported exec would write nothing. A connect to another project (also from a nested execute script) wrote that project, and sql queries and import ran against real databases. Fix: Executor.SetStatementGuard runs on every statement in Execute, nested scripts included. diff redirects a connect to the project onto the copy and refuses anything else outside the copy with an error. Also, with TMPDIR inside the project, the scratch copy copied itself until 'file name too long'. Tests: mdl/scriptdiff/outside_test.go. Each test failed with the reported symptom before the fix. Re-ran: scriptdiff unit + integration, the roundtrip diff tests (PedAppSpliceParity, FlowVerdictAgreement incl. TestApp corpus, SpliceRerun handler/folder), go test ./mdl/executor/ ./cmd/mxcli/, make lint (incl. conformance), check-findings. The #907/#807 repros on a TestApp copy: diff matches exec, and the project was untouched.

🤖 Generated with Claude Code