openvibe-shared v4.223.0 (was v4.217.0) (#297)

ddiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
iindex 6426ae1..db0b178 100644
---- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
@@@ -14,4 +14,4 @@ jobs:
        test: OV_ALLOW_SUITE=1 npm test
    # Secret scan (gitleaks) and dependency audit, shared by every OpenVibers repo (Track Q).
    security:
--    uses: OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@15b927b7d9fe35fe64ee4b7f3b4792b46ebdbddb
++    uses: OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@8a353d9e7557bfeed2b43deb51271171f8e48fc6
ddiff --git a/README.md b/README.md
iindex e294905..fdcf7ec 100644
---- a/README.md
++++ b/README.md
@@@ -234,6 +234,6 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by
  <!-- versions:start -->
  - openvibe-contracts: v0.406.0
  - openvibe-sdk: v0.150.0
--- openvibe-shared: v4.217.0
++- openvibe-shared: v4.223.0
  - openvibe-publishing: v1.7.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 18fdfbf..92a73eb 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -10,12 +10,12 @@
    "domain": "openvibe.design",
    "contracts": "openvibe-contracts v0.406.0",
    "sdk": "openvibe-sdk v0.150.0",
--  "shared": "openvibe-shared v4.217.0",
++  "shared": "openvibe-shared v4.223.0",
    "packages": [
      "openvibe-contracts v0.406.0",
      "openvibe-publishing v1.7.0",
      "openvibe-sdk v0.150.0",
--    "openvibe-shared v4.217.0"
++    "openvibe-shared v4.223.0"
    ],
    "summary": "The service skeleton for openvibe.design: Network sign-in as OAuth client `design` (PKCE S256, httpOnly design_at/design_rt cookies) and a theme API proxy to OpenVibe.Network's /api/themes. The proxy serves the public catalogue (cached 5 minutes), one theme, the person's active theme and custom variables, saving a theme with source 'studio', its history and a restore by id, and a submission to the gallery. Writes need this site's own Origin; Network 4xx answers pass through and a Network failure is 502. The studio is designed: a gallery, previews on a Live channel, a Chat room and a shop's grid (with colour-vision views), a six-colour editor that derives the full token set, WCAG checks that gate Use, sharing to the gallery, and History with Restore. The Arena queues one prompt for three models through OpenVibe.AI (client credentials, ai.run.create), stores sanitized HTML with reported model/provider/cost/time/tokens, renders it only in sandboxed CSP-capped iframes, draws blind pairs, records one vote per person per round, and keeps Elo ratings per category plus median cost and time. The prompts, outputs and votes are an open JSONL dataset; rounds and votes follow ADR-033 export and deletion.",
    "works": [
ddiff --git a/package-lock.json b/package-lock.json
iindex c1d821e..d55d0fe 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -19,7 +19,7 @@
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.406.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.7.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.150.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.217.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.223.0",
          "pg": "^8.23.1",
          "subset-font": "^2.9.0",
          "wawoff2": "^2.0.1"
@@@ -1476,9 +1476,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.217.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.217.0",
--      "integrity": "sha512-g/0RZxFLO1PDUL5lErHSkg5CfwOxQGHzzuqYlvJiVDYFtzq1lZOJjTyf8suJu+adkoNxO2xBTLZGprETmzSM1g==",
++      "version": "4.223.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.223.0",
++      "integrity": "sha512-l1woGnTQxcgpSr3OdpODwtWC8MNVIF/SbJrudnLIlZEwWreid2tucAi15AaPi1aFLWi8MvYLfCaD81IWRbxRHA==",
        "license": "MIT",
        "dependencies": {
          "clean-css": "^5.3.3",
@@@ -1487,7 +1487,8 @@
          "terser": "^5.51.2"
        },
        "bin": {
--        "openvibe-build-assets": "scripts/build-assets.js"
++        "openvibe-build-assets": "scripts/build-assets.js",
++        "ov-icon-audit": "scripts/icon-audit.js"
        }
      },
      "node_modules/p-limit": {
ddiff --git a/package.json b/package.json
iindex 82c723d..7cdd34c 100644
---- a/package.json
++++ b/package.json
@@@ -25,7 +25,7 @@
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.406.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.7.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.150.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.217.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.223.0",
      "pg": "^8.23.1",
      "subset-font": "^2.9.0",
      "wawoff2": "^2.0.1"
ddiff --git a/server/glyphs/suggest.js b/server/glyphs/suggest.js
iindex bb73865..9f66426 100644
---- a/server/glyphs/suggest.js
++++ b/server/glyphs/suggest.js
@@@ -6,7 +6,7 @@
   * META, its Font Awesome names and Design's synonyms (aliases.js). That is enough for "Deep dive" (compass, search,
   * binoculars), "Add to cart" (cart, plus, store) and most labels a person writes.
   *
-- * When the words are new ("hot tub", "gpu benchmark") and the free pass is weak, the caller may ask a small model to
++ * When the words are new ("hot tub", "throughput benchmark") and the free pass is weak, the caller may ask a small model to
   * rank the shortlist by meaning (`rank=1`). Only names that exist are returned; a model answer that invents one is
   * ignored. A signed-in person's allowance pays (OpenVibe.AI's `on_behalf_of`); signed out, Design's service does,
   * and OpenVibe.AI picks the cheapest route. Answers are cached for half an hour.
ddiff --git a/test/glyph-suggest.test.js b/test/glyph-suggest.test.js
iindex 05d2aec..358b5dd 100644
---- a/test/glyph-suggest.test.js
++++ b/test/glyph-suggest.test.js
@@@ -28,7 +28,8 @@ const ai = {
          });
  
          await check('new words ask a small model to rank the shortlist', async () => {
--            const r = await t.get('/api/v1/glyphs/suggest?label=gpu%20benchmark&rank=1', { headers: { 'sec-fetch-site': 'same-origin' } });
++            // A label the registry has no glyph for: shared v4.223.0 added a gpu glyph, so this must stay unclaimed.
++            const r = await t.get('/api/v1/glyphs/suggest?label=throughput%20benchmark&rank=1', { headers: { 'sec-fetch-site': 'same-origin' } });
              assert.equal(r.status, 200, r.text);
              const j = r.json();
              assert.equal(j.ranked, true);