What a PDS lists isn't taken on its word: an announcement, or a review, whose record doesn't check against its writer's signed repository (`getRecord`'s proof signed by another key) isn't added, nor shown.
a library from a release its author announced: `@handle/geo@1.0.0` is found among their records, fetched by hash from the servers the record names, and kept by their DID, so an upgrade reads their announcements (and nobody's who takes the handle after)
a library is another codebase's release (or namespace, by hash), mounted read-only: code uses it like its own, its packages stay its own, it's removed only when nothing uses it, and it travels with history
attestations: anyone reviews or writes an advisory about a release, signed in their own repository; only its author yanks it. `tcm lib add` and `tcm lib` show what its author says, and what the people the codebase trusts say (`tcm lib trust`, kept in its history).
what a library's code reaches outside itself is worked out from the code, a package's included, and said when it's added, listed, and upgraded (what's new then)
a library comes from any of its sources, tried in turn: a mirror answers when the author's codebase is gone, and any codebase that has a library can serve it by hash
a library moves to another release as one update, its API's changes said first: code using it follows, what no longer typechecks is to do, and code using what the new release doesn't have keeps it from moving
A tcm library (`npm: false`): released only if its namespace holds everything its code uses, so a codebase that adds it has every definition named; a package of its codebase that uses it carries its code rather than depending on it from npm; and it isn't packed itself.