Entries already merged by #123 stay silently misattributed; nothing detects or reports them

[TheAmericanMaker]

Summary

#127 stops new cross-project appends but does nothing about libraries that already have one, and index.yaml keeps asserting a single source_repo for a version history that spans two codebases.

Reproduction

1. On any build before fix: refuse a publish that would append to another project's history #127, publish https://github.com/openai/whisper (lands as whisper v1).
2. Publish https://github.com/acme/whisper — same trailing segment, so the same slug, and it lands as v2 of the same entry.
3. Upgrade to a build with the fix: refuse a publish that would append to another project's history #127 guard.
4. Run codecarto library-reindex, or codecarto_library_list, or read index.yaml.

Expected behavior

Something says the entry's versions disagree about where they came from. Reindex is the natural place — it already walks every entry — and docs/library-format.md frames index damage as "a recoverable error: codecarto library-reindex repairs it."

Actual behavior

Reindex regenerates the index cleanly and reports nothing. buildIndexEntry (core/library.ts:774) reads only the newest version's metadata:

const latest = versions[versions.length - 1]!;
const latestMetaPath = join(entryDir, `v${latest}`, METADATA_FILE);
...
const entry: LibraryIndexEntry = {
    slug,
    latest_version: latest,
    versions: [...versions],        // every version, including the other project's
    source_repo: metadata.source_repo,   // only the newest one's provenance

So the entry advertises versions: [1, 2] under acme/whisper, and v1 — a different codebase — is attributed to it. A synthesis run that reads this entry gets one project's spec history presented as another's. The #127 guard cannot help: it only fires on the next publish, and it compares against the newest version, which is the one that is already wrong.

Environment

• Surface: Pi extension / MCP server (both — the damage is in the library on disk)
• CodeCartographer version: any library written before fix: refuse a publish that would append to another project's history #127 lands
• Node version: n/a
• OS: n/a

Additional context

Two separable pieces, and the second needs a decision rather than an implementation:

Detection. Reindex compares source_repo across all versions of an entry (using the sameSourceRepo comparison #127 added) and reports entries whose versions disagree. Cheap, read-only, and turns a silent condition into a visible one. Could also surface in codecarto_library_list.

Repair. Harder, and worth its own discussion before anyone writes code. Splitting a merged entry means inventing a slug for the evicted versions, renumbering them, and rewriting latest — all of which changes paths that docs/library-format.md calls ABI. Reporting and letting the operator split by hand may be the right stopping point.

Detection alone would close the loop that #127 opens. Filed separately because #127 is preventive by design and expanding it into a migration was out of its scope.

Related: #123 (the original bug), #127 (the fix).