docker build, TUI checker and eval runner no longer write to the project

[ako]

Closes #961.

Before (measured)

Whole-tree sha256 + mtime diff before/after, on copies of testdata/testapp (11.14, real mx from ~/.mxcli/mxbuild/11.14.0). The v1 copy was made with mx update-widgets.

Path	v1	v2
docker build	TestApp.mpr rewritten (mtime; content too when widgets are stale). theme-cache/web/, deployment/ (~680 files), 160 javasource/ proxies, .classpath, .project added. TestApp.launch content changed.	Same, plus every mprcontents/*.mxunit rewritten and restored with new mtimes.
TUI checker (mx check -j … -w -d)	theme-cache/web/ and deployment/sass/ added. Model untouched.	same
eval runner (mx check)	same	same

Fix

1. docker build (and docker run / docker reload, which call Build): new buildOnCopy runs mx update-widgets, mx check and MxBuild on one temporary copy. It reuses fix: docker check never modifies the project; atomic catalog cache save (#951) #956's helper, renamed copyProjectToTemp. Only the PAD output directory is written (absolute path, default .docker/build). The output says so up front. MxBuild still gets the widget-normalised model, from the copy.
   • Output equivalence. On the testapp, v1 and v2, the new PAD has the same file list as the in-place build. It differs in 9 files. Control: two in-place builds of identical copies, old binary, differ in exactly the same 9 files (cache-bust stamps in index.html etc., operationIds, ModelRuntimeCompatibilityHash/model.mdp, and the absolute paths in native/metro.config.js/styles.js). So the outputs are equivalent up to MxBuild's own nondeterminism.
   • Rebuild time is unchanged (59s old, 58s new): a PAD build gains nothing from the project's deployment/.
   • Dropped: runUpdateWidgets (the v2-only snapshot) has no caller left, so it is removed with its 4 tests. snapshotStorageFormat stays for harvest.go.
   • Behaviour change: the project's deployment/ is no longer refreshed by docker build. Nothing reads it there: run --local runs its own deploy build. --help, docs-site/.../docker-build.md and mxcli fix widgets --help (which still described the old snapshot) are updated.
2. TUI checker and 3. eval runner: new exported docker.MxCheckOnCopy(mxPath, mpr, args, stdout, stderr) runs mx check on a copy and rewrites output paths. Both callers use it. They also gain PrepareMxCommand (FreeType LD_PRELOAD), which they lacked.

Other mx/mxbuild invocations against a project (classified)

Code path	Writes	Verdict
docker check (check.go)	copy since #956	fixed earlier
docker build / run / reload, testrunner's docker build --skip-check	copy now	fixed here
TUI checker, eval mx_check	copy now	fixed here
mxcli fix widgets / fix design-properties (RunToolPreservingFormat)	model, harvested to keep v2	expected (the point of the command)
marketplace install (mx module-import, cmd_marketplace_install.go)	model	expected (installing a module). Its v2 handling was not re-audited here
marketplace/scratch.go (create-project, module-import)	a scratch project	not the user's project
mxcli new (create-project, SettleGeneratedSources = mxbuild --target=deploy)	the new project	expected
SyncJavaDependencies (mx sync-java-dependencies)	vendorlib/	expected (the point of it)
run --local (mxbuild --serve, deploy target)	deployment/, javasource/ proxies	expected build output of a local run

Test plan

• TestBuildOnCopy_DoesNotModifyProject (v1, v2 × default / --no-update-widgets / --skip-check / --dry-run). Stub update-widgets, check and MxBuild write into their target the way the real tools do. The test asserts:
  • the tree outside .docker/ is byte- and mtime-identical
  • no tool was pointed at the project
  • the PAD lands in the output dir
  • MxBuild saw the normalised model exactly when update-widgets ran
  • output names the project path, not the copy
  • the copy is cleaned up
• TestBuildOnCopy_CheckFailureStopsBeforeMxBuild
• TestRunMxCheck_DoesNotModifyProject (tui; stub mx script on PATH, v1/v2, JSON result still parsed)
• TestCheckMxCheck_DoesNotModifyProject (evalrunner; v1/v2 × pass/fail, detail names the project path)
• Integration, real mx: TestMxCheckOnCopy_LeavesProjectUntouched (11.14, v1+v2). TestBuild_LeavesProjectUntouched is a full MxBuild, v1+v2. It ran with 11.13, because 11.14's blank app needs JDK 25, which this box lacks, so it skips there. Existing TestBuild_PreservesMPRv2StorageFormat and TestCheck_LeavesProjectUntouched pass.
• Revert checks:
  • build, unit: pointing buildOnCopy back at the project fails with changed App.mpr, theme-cache, .launch, added deployment/…, javasource/…/proxies, .classpath, and removed mprcontents/… on v2.
  • build, integration: restoring main's build.go + update_widgets.go fails TestBuild_LeavesProjectUntouched on v1 and v2: App.mpr changed, 370 mprcontents changed, 992 deployment added, 216 javasource added, .launch/.classpath/.project added.
  • tui / evalrunner: restoring main's checker.go / checks.go fails both tests with theme-cache/web/theme.compiled.css and deployment/sass/main.scss added.
• Manual, after the fix: mxcli docker build on the v1 and v2 testapp copies. The only change in the project is .docker/ (4647 files added). Both exit 0.
• go test ./cmd/mxcli/docker/ ./cmd/mxcli/tui/ ./cmd/mxcli/evalrunner/ ./cmd/mxcli/, make build, make lint, make check-conformance, make check-findings

Finding appended to cmd-mxcli.jsonl. docs-wiki/bug-patterns/package-operations-damage.md gets a paragraph on the recurring class (#763 → #808 → #951 → #961). CHANGELOG entry under Unreleased/Fixed.

Follow-ups

• marketplace install's bare mx module-import on the project was not re-audited for the v2→v1 collapse here.
• The PAD's native/metro.config.js now carries the temporary copy's path instead of the project's. Neither path exists inside the container, and the web runtime does not use these files.

🤖 Generated with Claude Code