docs(research): mark codemap watch (PR #47) shipped + bump fallow snapshot date (#48)

- fallow.md status snapshot date 2026-05-02 → 2026-05-03; new 'codemap watch' bullet under 'Adjacent shipped' covering the chokidar selection, three shapes, prime-gating + in-flight drain robustness fixes (CodeRabbit caught two heavy bugs on PR #47).
- competitive-scan-2026-04.md: 'Watch mode (codemap watch) — still backlog' line replaced with shipped row pointing at PR #47 (impl) + PR #46 (plan).
- Anchor cross-ref bumped to match the new fallow.md heading.

Author: SutuSebastian

docs/research/competitive-scan-2026-04.md

@@ -73,8 +73,8 @@ Items the scan called out as "watch / defer / future" — most still live in [do
 - ✅ **Targeted-read CLI (`codemap show <symbol>`)** — shipped as `show` + `snippet` siblings in PR [#39](https://github.com/stainless-code/codemap/pull/39).
 - ✅ **`--format sarif` + `--format annotations`** — shipped in PR [#43](https://github.com/stainless-code/codemap/pull/43). GitHub Code Scanning + PR-inline annotations for any recipe row-set.
 - ✅ **HTTP API (`codemap serve`)** — shipped in PR [#44](https://github.com/stainless-code/codemap/pull/44). Same tool taxonomy as MCP, `POST /tool/{name}`, loopback default, optional `--token`.
-- See [`research/fallow.md` § Status snapshot](./fallow.md#status-snapshot-as-of-2026-05-02) for the full ship summary.
-- Watch mode (`codemap watch`) — still backlog
+- ✅ **Watch mode (`codemap watch`)** — shipped in PR [#47](https://github.com/stainless-code/codemap/pull/47), planned in PR [#46](https://github.com/stainless-code/codemap/pull/46). Standalone + `mcp --watch` / `serve --watch` killer combos; chokidar v5 backend.
+- See [`research/fallow.md` § Status snapshot](./fallow.md#status-snapshot-as-of-2026-05-03) for the full ship summary.
 - Cross-agent handoff artifact (speculative) — still backlog
 
 The scan's "PASS" list (dead-code / dupes / complexity / boundaries / fix actions, runtime/V8 coverage merging, framework plugins, PageRank summarization, skyline visualization, daemon process, embedded intent classification) has been folded into [roadmap.md § Non-goals](../roadmap.md#non-goals-v1) — that's the canonical home; do not duplicate here.

docs/research/fallow.md

@@ -7,7 +7,7 @@
 
 ---
 
-## Status snapshot (as of 2026-05-02)
+## Status snapshot (as of 2026-05-03)
 
 Adoption-candidate ship status. The tier tables in § 1 are preserved as the original assessment record; this snapshot is the single source of truth for "what's open." Update on every PR that closes a row.
 
@@ -34,6 +34,7 @@ Adoption-candidate ship status. The tier tables in § 1 are preserved as the ori
 - **Doc-governance Rule 10** added during PR [#29](https://github.com/stainless-code/codemap/pull/29) — every core-surface change must update both `templates/agents/` (ships to npm) and `.agents/` (this clone) in lockstep.
 - **`cli/*` → `application/*` engine lift (internal)** — PR [#41](https://github.com/stainless-code/codemap/pull/41) closed the last layer-reversal imports `application/mcp-server.ts` had on `cli/*` (called out in the PR #35 self-audit). New engines `context-engine` / `validate-engine`; `query-recipes` moved to `application/`; envelope builders + helpers consolidated in `audit-engine` / `show-engine`. Pure refactor — no behavior or public API change — but unblocks the HTTP transport (B-tier `serve`) since that engine reuse is now clean.
 - **`codemap serve` HTTP API** — PR [#44](https://github.com/stainless-code/codemap/pull/44). Same tool taxonomy as `codemap mcp` over `POST /tool/{name}` for non-MCP consumers (CI scripts, simple `curl`, IDE plugins). Loopback default (`127.0.0.1:7878`); optional `--token` for Bearer auth. Bare `node:http` (no Express/Fastify dep). Tool bodies + resource fetchers live in shared `application/{tool,resource}-handlers.ts` — both transports dispatch the same pure handlers. CSRF + DNS-rebinding guard rejects `Sec-Fetch-Site: cross-site|same-site`, mismatched `Host` (loopback bind), and any `Origin` header — defends against malicious local webpages `fetch`-ing the API while the dev browses. Per-tool Zod validation at the HTTP boundary; ToolResult error arm carries `status?: 400|404|500` so unknown recipe / baseline → 404 and engine throws → 500.
+- **`codemap watch` (live reindex)** — PR [#47](https://github.com/stainless-code/codemap/pull/47), planned in PR [#46](https://github.com/stainless-code/codemap/pull/46). The biggest agent-UX win in the roadmap: eliminates the "is the index stale?" friction every CLI / MCP / HTTP query rides on today. Three shapes: standalone `codemap watch`, plus killer combos `codemap mcp --watch` and `codemap serve --watch` (also `CODEMAP_WATCH=1`). Chokidar v5 backend (selected via 6-watcher audit on PR #46 — pure JS, no Bun N-API quirks, identical on Bun + Node). Sliding-window debouncer (default 250 ms) + path-segment exclude scan + project-local recipe glob. Optional `onPrime` opt runs an incremental catch-up BEFORE flipping `isWatchActive()` true so `handleAudit` only skips its prelude when the index is genuinely fresh. Stop drains in-flight reindex (serialized via inFlight chain) before close so SIGINT/SIGTERM never leaves a half-written DB. Backend errors clear the active flag so a dying chokidar re-enables the audit prelude immediately.
 
 **Open-questions resolution** (from § 6 below):