A code glob watches nothing until somebody verifies the document

A code: glob is a promise that docir check will say something when the code under it moves. It only does once the document is --verified: verified_code is written by that flag and by nothing else, so a document nobody has reviewed carries no digest, and code-changed skips it without a word.

What that costs, measured¶

In docir's own store, 99 documents name the code they govern and not one of them had ever been --verified. code-changed could fire on none of them: every glob named its code, watched it, and reported nothing when it moved.

Nothing tells those 99 that they are inert. The glob renders on every read view, docir query --code finds them, and unmatched-code still fires if a pattern stops matching — so the feature looks live from every angle except the one it exists for.

Why the obvious fix is the wrong one¶

Fingerprinting on the write that declares a glob would close it, and writing that digest into verified_code would be laundering: the field means somebody read this, and a write that fills it in makes the review clock a side effect of running a command. That is the rule A verification records what the code looked like states and Staleness as data (owner + verified + review cadence) exists for.

The way out is that these are two different claims. "The code moved since somebody read this" needs a reviewer. "The code moved since this document said it governs this" needs only the write that said it — and it is the claim that can be made automatically, because it asserts nothing about anybody having read anything.

What the shape of the fix has to satisfy¶

Storage in the file, not the index: the index is gitignored and rebuilt, so a baseline living only there would reset on every reindex and never fire.

Minted once per pattern and never refreshed by a mechanical write. Re-declaring a glob through --set-code reads nothing, so re-basing there would hand every write a way to clear a drift nobody looked at — the same laundering through a cheaper door.

And the two findings have to partition the patterns rather than overlap, or one moved file is reported twice under two names.