Spine v3.40.0

Briefs stop pointing at code and start showing it

investigate and root-cause told you where to look and nothing more. They rendered the
knowledge graph's index — symbol names, file:line, caller counts — and contained zero lines
of source. So a reader opened the files the brief had already located, which is the work the
brief existed to save.

Each landing site now carries the code at its line, and says whether a test reaches it:

- **web** · `ActiveAuctions` (Type, 0 caller(s) · **no test reaches this**) — …/ActiveAuctions.razor:1

  ```razor
  @page "/activeauctions"
  <AuctionCoilsUi
      PageTitleText="@SSConstants.ActiveAuctionPageTitle"
      AuctionStatus="@AuctionStatus.BiddingStarted.ToString()"
      GridId="active-auctions-grid" />

Source shown for 1 of 10 landing(s) — the rest carry their location only.

A root-cause report quotes its fault site too, so *"ranked by evidence, not asserted"* now means
the evidence is on the page rather than a claim about it.

### Two rules that came from reading the output, not designing it

Both were found by rendering real briefs and reading them as a reader. Both changed the code.

**A landing the brief itself calls *weak* gets neither an excerpt nor a coverage note.** The
first implementation spent two of three excerpts on DTOs the brief had already labelled *"weak:
only `auct`, which other files use too"* — twelve lines each of a row the tool doubts, costing
exactly the attention that should have gone to a strong one.

**Where the graph cannot answer, the brief says nothing rather than accusing.** *"No test
reaches this"* appeared in **bold on all ten rows** of a real brief, including model fields
nobody would test. A signal that fires on every row has stopped being one. And for a language
with no call graph it is now silent: a front-end that emits no `CALLS` edges has not *proven* an
absence of tests.

### Multi-repo briefs read project knowledge

`investigate --repos` omitted "Relevant project knowledge" entirely — `episteme/` belongs to one
repository and a merged brief has no single owner for it. Correct in isolation, and the
consequence was that **the mode a cross-cutting ticket needs was the only mode with no project
knowledge at all**: on a two-repo pair with both knowledge bases committed, the brief still
reported the section absent.

It now reads each repository the ticket lands in, under its key — not every declared repository,
since a brief that landed in one should not put another service's domain model in front of its
reader. The budget is split across them rather than multiplied, and a declared repository whose
bank is missing is **named, not skipped**: silence there reads as "nothing to say" when it means
nobody ran `understand` there.

### For anyone building on this

`excerpt.source_at(root, "file:line")` is the module's first public entry point: N lines centred
on a location, with a fence hint, or `None`. **Every failure returns `None` and nothing raises**
— a deleted path, a line past the end of a file that shrank, a binary blob, a permission error.
A line past the end is *refused, not clamped*; clamping quotes the wrong code confidently.

### What this release does *not* add

**A precedent lookup** — *"where else does this pattern already exist"* — was scoped as the
highest-value addition and then measured. On the ticket that motivated it, the precedent is an
attribute **value** in markup (`FilterComponentType="…RangeDouble"`); the graph holds
declarations and edges, not values, and a name query returns **0 nodes**. It is deferred with
that number attached rather than half-built.

So: the briefs now give you the code at the right lines. They do not give you the argument — a
reader still decides what it means.

### Upgrading

Nothing to do. No configuration, no new dependency, no migration. Briefs are longer by roughly
fifteen lines and byte-identical for a given commit, as before.

---
<!-- Release notes generated using configuration in .github/release.yml at 155634350b53cafc431f0ad32f3011db324c8734 -->

## What's Changed
### Other changes
* fix(sdlc): a merged brief reads each landed-in repo's own episteme by @ssmith-synaptixs in https://github.com/synaptixs/spine/pull/416
* feat(sdlc): briefs quote the code they located by @ssmith-synaptixs in https://github.com/synaptixs/spine/pull/417
* chore(release): cut 3.40.0 by @ssmith-synaptixs in https://github.com/synaptixs/spine/pull/418
* Promote develop → main: 3.40.0 by @ssmith-synaptixs in https://github.com/synaptixs/spine/pull/419


**Full Changelog**: https://github.com/synaptixs/spine/compare/v3.39.0...v3.40.0