fix(#80): clear companion LRUs on the cross-process reset notify path

A CLI `reset-to` runs `reset_to` (and the prune) in the short-lived CLI
process, then signals the long-lived companion via `POST /internal/notify
{kind: project_reset}`. That handler only reloaded buckaroo sessions; it never
cleared the companion's process-global `_build_compare_expr` / `cached_result_expr`
LRUs, so a warmed diff build kept pointing at a snapshot the prune deleted —
#80's "Communication gap", the path #80 calls the normal one ("reset is
normally run out-of-process").

- Hoist the in-server clear into `_invalidate_reset_caches()` and call it from
  BOTH reset paths (`/api/reset` and the `project_reset` branch of
  `/internal/notify`) so they can't drift. The clear is not gated on `buckaroo`:
  the LRUs are companion process memory, independent of the subprocess.
- Reframe the `reset_to` comment (#96): clearing the result-plan memo answers
  #96's literal "LRU outlives a prune", but for the dangling-read symptom it is
  belt to cached_result_expr's per-call exists() self-heal (ee0a90a). The
  load-bearing protection is the `_build_compare_expr` clear — the one LRU that
  bakes the resolved path into a serialized build with no per-call recheck.

Closes #80, #96.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: paddymul

src/tallyman_companion/app.py

@@ -212,6 +212,27 @@ def _build_compare_expr(project: str, a_hash: str, b_hash: str, keys: tuple[str,
     return build_path, overrides
 
 
+def _invalidate_reset_caches() -> None:
+    """Drop the companion's process-global result/compare caches after a reset.
+
+    A reset prunes baked snapshots (``catalog_state.reset_to`` →
+    ``prune_compute_cache``). ``_build_compare_expr`` serializes those snapshot
+    paths into a build with no per-call ``exists()`` recheck, so a warmed diff
+    pair would otherwise serve a build over a parquet the prune deleted —
+    buckaroo reads zero files → empty compare grid (#80). ``cached_result_expr``
+    self-heals on every read so clearing its memo is hygiene, not load-bearing,
+    but we clear it for parity. Blunt global clear is correct and cheap: entries
+    are content-addressed, so the next call rebuilds an identical expression.
+
+    Called from BOTH reset paths — the in-server ``/api/reset`` and the
+    cross-process CLI ``reset-to`` that arrives as a ``project_reset`` on
+    ``/internal/notify`` — so the two can't drift. (The in-server path having the
+    clear while the notify path lacked it was exactly #80's "Communication gap".)
+    """
+    _build_compare_expr.cache_clear()
+    cached_result_expr.cache_clear()
+
+
 def _annotate_entries(project: str, entries: list[dict]) -> list[dict]:
     """Add alias/version fields and sort: named entries (by alias) first, then scratch."""
     aliases = load_aliases(project)
@@ -1135,12 +1156,10 @@ async def api_reset(project: str, payload: dict):
             await run_in_threadpool(reset_to, project, ref)
         except RuntimeError as exc:
             raise HTTPException(404, str(exc))
-        # reset_to clears the result-plan memo; the compare-expr LRU is a
-        # companion-layer cache, so clear it here. It bakes each entry's snapshot
-        # path into a serialized build with no per-call exists() recheck, so a
-        # reset that pruned a snapshot would otherwise serve a build over a
-        # deleted parquet (#80). Cheap: a content-addressed pair rebuilds identically.
-        _build_compare_expr.cache_clear()
+        # reset_to ran in-process and cleared the result-plan memo; the
+        # compare-expr LRU is a companion-layer cache it can't reach, so invalidate
+        # the companion caches here (#80). Shared with the cross-process notify path.
+        _invalidate_reset_caches()
         reloaded = buckaroo.reload_project_sessions(project) if buckaroo else 0
         step = current_step(project)
         await publish({"kind": "project_reset", "step": step})
@@ -1163,6 +1182,13 @@ async def notify(payload: NotifyPayload):
             getattr(payload, "hash", None),
         )
         if payload.kind in ("post_processing_changed", "summary_stat_changed", "display_changed", "project_reset"):
+            if payload.kind == "project_reset":
+                # Out-of-process CLI `reset-to` ran reset_to in the CLI process, so
+                # this long-lived companion's result/compare LRUs are still warm and
+                # may point at snapshots the prune deleted. Clear them here, matching
+                # the in-server /api/reset path (#80). Not gated on `buckaroo`: the
+                # LRUs are process memory independent of the buckaroo subprocess.
+                _invalidate_reset_caches()
             if buckaroo:
                 reloaded = buckaroo.reload_project_sessions(project_name)
                 log.info("reloaded klasses in %d buckaroo session(s) for project %s", reloaded, project_name)

src/tallyman_core/catalog_state.py

@@ -344,12 +344,15 @@ def reset_to(project: str, ref: int | str) -> None:
         restore_from_bullpen(project)
         _gc_cas_clones(project)
         catalog.assert_catalog_consistent(project, set(read_tallyman_state(project)["entry_hashes"]))
-    # The prune above retires baked snapshots on disk; invalidate the in-process
-    # plan memo that points at them (#80 / #96). cached_result_expr re-checks a
-    # baked snapshot's existence on every call, but its memoised _resolve_result_plan
-    # half caches the resolved path, and downstream caches that bake it in (the
-    # companion's _build_compare_expr) have no such per-call recheck — so the reset
-    # layer invalidates the memo rather than relying on the self-heal. Blunt global
+    # The prune above retires baked snapshots on disk. Clear the in-process
+    # result-plan memo that resolved their paths: #96's literal complaint is that
+    # the LRU outlives the prune, so drop it. For the dangling-read *symptom* this
+    # clear is belt-and-suspenders — cached_result_expr re-checks path.exists()
+    # and self-heals on every read (ee0a90a), so its own reads already survive a
+    # prune. The load-bearing protection against the symptom is the companion's
+    # _build_compare_expr clear (#80): that is the one LRU that bakes the resolved
+    # path into a serialized build with no per-call recheck, and it lives in the
+    # companion layer (see app._invalidate_reset_caches), not here. Blunt global
     # clear is correct and cheap: entries are content-addressed, so the next read
     # rebuilds an identical plan. Lazy import avoids a core->xorq import cycle.
     from tallyman_xorq.result_cache import cached_result_expr  # noqa: PLC0415