feat(#89): reactive recalc (stage 2/3) — cone walk, replay, alias re-point + surfaces

[paddymul]

The second landable increment of the reactive consumer (epic #89): the half
that acts. Stage 1 (PR #126) flags an entry as stale relative to its recorded
inputs but never recomputes; this walks the dependency cone and rebuilds it. The
hard prerequisites it rested on are all merged — #115 (cold-read content
faithfulness), #124 (#80/#96 LRU invalidation on reset), #121 (#88 determinism
attribution).

Design + mechanism: plans/recalc-mechanism.md (new), against
plans/reactive-staleness-recalc.md (Stage 2/3) and the ADR (#51).

What lands

• tallyman_xorq/recalc.py — recalc(project, roots, *, dry_run) walks the
  roots' topologically ordered descendant_cone and replays each entry's recipe
  through build_and_persist (the primitive catalog_revise already uses). A
  followed parent re-resolves to the advanced alias head (io.from_catalog →
  get_alias), so re-pointing a parent's alias before its children replay
  propagates the change down the cone. The walk is idempotent: an unchanged input
  replays to the same content_hash and build_and_persist early-returns, so an
  untouched node — and a hash-pinned (follow=False) child, whose literal-hash
  recipe re-resolves to the same parent — is a no-op with no alias move.
• MCP surfaces — catalog_scan_staleness (read-only) and catalog_recalc
  (dry_run defaults true; roots=None defaults to the directly-stale set).
• Companion surfaces — GET /{project}/api/staleness (the scan-on-load
  surface) and POST /{project}/api/recalc (preview + commit), which invalidates
  the companion caches, reloads buckaroo sessions, and publishes a recalc event.

Cascade failure + transaction

Stop-and-report (the plan's default): a build error halts the walk, leaves the
already-rebuilt prefix committed, and is flagged in the report rather than raised.
One checkpoint per walk (only when something changed), so a recalc is a single
revision reset_to undoes atomically. Checkpointing is arg-aware — recalc
self-checkpoints and both surfaces are exempt from their generic per-op checkpoint
— so a dry run takes zero revisions and a real run exactly one (neither
double-commits nor misses).

TDD

Red→green. First commit is the failing tests (the recalc module and the new
tools/routes are absent, so collection errors); the fix commit follows. Full
suite green locally: 566 passed.

Decision defaults exercised (confirm)

• Trigger — scan-on-load (passive flag) + explicit recalc; no
  auto-cascade-on-revise.
• Cascade failure — stop-and-report.
• off-mode source axis — unknown (Stage 1).
• Pinned child of an advanced alias — stays on its pin (replay is a no-op).

Note: the cheap-chain source leak

A cheap child inlines its parent's recipe, so the parent's source is recorded in
the child's own manifest.sources. A source edit therefore makes such a child
directly stale, not merely transitively. Expected (the #74 reconstruction
model); recalc rebuilds it either way. The pure transitive case shows up across an
expensive, snapshot-baked intermediate. Tests cover both.

Not in this PR

The React badge/affordance rendering (the backend /api/staleness data + entry
annotation are ready for it), and deletion-side semantics (archive / delete cone /
multi-parent unbind — ADR Q3/Q4).

🤖 Generated with Claude Code