library format: the documented confidentiality vs visibility comparison is not implemented

[TheAmericanMaker]

Summary

docs/library-format.md describes a publish-time comparison between an entry's confidentiality and the library's visibility. No such comparison exists in the code.

Reproduction

1. Create a library whose marker has "visibility": "public".
2. Publish an entry with confidentiality: internal.
3. The publish succeeds with no error and no warning.

Expected behavior

The doc makes the claim twice:

• Marker field table: visibility is "a defense-in-depth hint when CodeCartographer compares against per-entry confidentiality."
• Metadata field table: confidentiality is "internal (default), shared, or public. Compared against library visibility at publish time."

Actual behavior

Nothing reads marker.visibility. Every marker. access in core/library.ts is .namespaced or .name. visibility appears only in its type declaration, the initLibrary default, and a string inside a core/synthesis.ts error message. confidentiality is only ever declared, copied through buildMetadata, read back in normalizeMetadata, and propagated into the index.

So a documented confidentiality control is absent, and the field reads as a label rather than a check.

Environment

• Surface: both
• CodeCartographer version: 0.16.0 (77262ad)

Additional context

Two ways to close it, and the choice is a product call rather than a bug fix:

1. Implement the comparison. Refuse, or warn, when an entry's confidentiality is more restrictive than the library's visibility, since that is the direction that leaks. Ordering would be internal < shared < public.
2. Drop the claim from the doc and describe both fields as advisory labels.

Worth deciding rather than leaving, because the doc currently offers a guarantee that a shared or public library does not have.