docs(research): add PR #39 (show + snippet) to fallow.md + mark closed items in competitive-scan §4-§5 (#40)

Two stale spots fixed:

1. fallow.md 'Adjacent — also shipped post-refresh' block: added PR #39 (targeted-read CLI: show + snippet + security hygiene fixes).

2. competitive-scan-2026-04.md § 4 'What moved to the roadmap': marked Recipes-as-content registry (PR #37) and Targeted-read CLI (PR #39) as ✅ shipped. Both were sitting as 'still backlog' even though their roadmap entries were removed at ship time. Updated § 5 'Open questions': 'Should recipes own their description?' is settled (PR #37 file-pair shape).

No code change; pure docs honesty.

Author: SutuSebastian

docs/research/competitive-scan-2026-04.md

@@ -68,10 +68,11 @@ All shipped under PR [#23](https://github.com/stainless-code/codemap/pull/23) as
 
 Items the scan called out as "watch / defer / future" — most still live in [docs/roadmap.md § Backlog](../roadmap.md#backlog); items shipped after this scan are linked to their PRs.
 
-- ✅ **MCP server wrapping `query`** — shipped as `codemap mcp` (agent-transports v1) in PR [#35](https://github.com/stainless-code/codemap/pull/35). Tool taxonomy, output shape, and resource catalog reserved for HTTP API to inherit. See [`research/fallow.md` § Status snapshot](./fallow.md#status-snapshot-as-of-2026-05-01) for the full ship summary.
+- ✅ **MCP server wrapping `query`** — shipped as `codemap mcp` (agent-transports v1) in PR [#35](https://github.com/stainless-code/codemap/pull/35). Tool taxonomy, output shape, and resource catalog reserved for HTTP API to inherit.
+- ✅ **Recipes-as-content registry + project-local recipes (`.codemap/recipes/`)** — shipped in PR [#37](https://github.com/stainless-code/codemap/pull/37). Catalog gains `source` / `body` / `shadows` fields so agents see project overrides at session start.
+- ✅ **Targeted-read CLI (`codemap show <symbol>`)** — shipped as `show` + `snippet` siblings in PR [#39](https://github.com/stainless-code/codemap/pull/39).
+- See [`research/fallow.md` § Status snapshot](./fallow.md#status-snapshot-as-of-2026-05-01) for the full ship summary.
 - HTTP API (`codemap serve`) — still backlog
-- Recipes-as-content registry + project-local recipes (`.codemap/recipes/`) — still backlog
-- Targeted-read CLI (`codemap show <symbol>`) — still backlog
 - Watch mode (`codemap watch`) — still backlog
 - Cross-agent handoff artifact (speculative) — still backlog
 
@@ -85,7 +86,7 @@ The scan's "PASS" list (dead-code / dupes / complexity / boundaries / fix action
 
 These were not resolved in PR #23 and warrant their own design conversations:
 
-- **Should recipes own their description?** — JordanCoin couples skills + content tightly via YAML frontmatter; we currently keep recipes as code constants. Moving to one `recipes/<id>.{sql,md}` pair on disk (read at runtime via Bun `import.meta.glob` / Node `readdirSync`) makes them more discoverable and contributable. Tracked under "Recipes-as-content registry" in [roadmap.md § Backlog](../roadmap.md#backlog).
+- ✅ **Should recipes own their description?** — Settled in PR [#37](https://github.com/stainless-code/codemap/pull/37): file-pair `<id>.{sql,md}` in `templates/recipes/` (bundled) and `<projectRoot>/.codemap/recipes/` (project-local), loaded at runtime via `node:fs/readdirSync`. YAML frontmatter on `.md` carries the per-row `actions` template.
 - **Daemon vs one-shot** — JordanCoin's daemon is the only way they get sub-100ms hooks. Our CLI startup is ~50–100 ms cold (Node) and lower on Bun; we may not need a daemon at all. Worth measuring once MCP/HTTP land. Roadmap lists "persistent daemon" as a non-goal **for now** with this caveat.
 
 ---

docs/research/fallow.md

@@ -30,6 +30,7 @@ Adoption-candidate ship status. The tier tables in § 1 are preserved as the ori
 
 - **MCP server (agent-transports v1)** — `codemap mcp` ships every CLI verb (plus MCP-only `query_batch`) as JSON-RPC tools over stdio with four lazy-cached resources. PR [#35](https://github.com/stainless-code/codemap/pull/35). Output shape verbatim from each tool's CLI `--json` envelope (no re-mapping). HTTP API (`codemap serve`) stays in roadmap backlog — design points (tool taxonomy, output shape) reserved in [`architecture.md` § MCP wiring](../architecture.md#cli-usage).
 - **Recipes-as-content registry** — bundled recipes are now `<id>.{sql,md}` file pairs in `templates/recipes/`; project teams ship internal SQL via git-tracked `<projectRoot>/.codemap/recipes/<id>.{sql,md}`. PR [#37](https://github.com/stainless-code/codemap/pull/37). Catalog gains `source` / `body` / `shadows` fields so agents see project overrides at session start; YAML frontmatter actions on `.md` mean project recipes feel first-class. Load-time DML/DDL deny-list + runtime `PRAGMA query_only=1` backstop.
+- **Targeted-read CLI** — `codemap show <name>` + `codemap snippet <name>` for precise lookup-by-symbol-name without composing SQL. PR [#39](https://github.com/stainless-code/codemap/pull/39). Both verbs share the same flag set (`--kind`, `--in <path>`) and an agent-friendly `{matches, disambiguation?}` envelope; `snippet` adds `source` / `stale` / `missing` per match (read + flag, no auto-reindex side-effects). Registered as MCP tools too — every read verb maps to a tool. PR also shipped defence-in-depth security fixes (LIKE-wildcard escape on `--in`, path-traversal rejection in `agents-init`, non-blocking `bun audit` CI job).
 - **Doc-governance Rule 10** added during PR [#29](https://github.com/stainless-code/codemap/pull/29) — every core-surface change must update both `templates/agents/` (ships to npm) and `.agents/` (this clone) in lockstep.
 
 **Open-questions resolution** (from § 6 below):