openvibe-shared v4.201.0 (was v4.200.0) (#265)

ddiff --git a/README.md b/README.md
iindex e17624f..2c2ebda 100644
---- a/README.md
++++ b/README.md
@@@ -234,6 +234,6 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by
  <!-- versions:start -->
  - openvibe-contracts: v0.399.0
  - openvibe-sdk: v0.147.0
--- openvibe-shared: v4.200.0
++- openvibe-shared: v4.201.0
  - openvibe-publishing: v1.7.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 15d6229..498b36b 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -10,12 +10,12 @@
    "domain": "openvibe.design",
    "contracts": "openvibe-contracts v0.399.0",
    "sdk": "openvibe-sdk v0.147.0",
--  "shared": "openvibe-shared v4.200.0",
++  "shared": "openvibe-shared v4.201.0",
    "packages": [
      "openvibe-contracts v0.399.0",
      "openvibe-publishing v1.7.0",
      "openvibe-sdk v0.147.0",
--    "openvibe-shared v4.200.0"
++    "openvibe-shared v4.201.0"
    ],
    "summary": "The service skeleton for openvibe.design: Network sign-in as OAuth client `design` (PKCE S256, httpOnly design_at/design_rt cookies) and a theme API proxy to OpenVibe.Network's /api/themes. The proxy serves the public catalogue (cached 5 minutes), one theme, the person's active theme and custom variables, saving a theme with source 'studio', its history and a restore by id, and a submission to the gallery. Writes need this site's own Origin; Network 4xx answers pass through and a Network failure is 502. The studio is designed: a gallery, previews on a Live channel, a Chat room and a shop's grid (with colour-vision views), a six-colour editor that derives the full token set, WCAG checks that gate Use, sharing to the gallery, and History with Restore. The Arena queues one prompt for three models through OpenVibe.AI (client credentials, ai.run.create), stores sanitized HTML with reported model/provider/cost/time/tokens, renders it only in sandboxed CSP-capped iframes, draws blind pairs, records one vote per person per round, and keeps Elo ratings per category plus median cost and time. The prompts, outputs and votes are an open JSONL dataset; rounds and votes follow ADR-033 export and deletion.",
    "works": [
ddiff --git a/package-lock.json b/package-lock.json
iindex e2360c7..1dbae6a 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -19,7 +19,7 @@
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.399.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.7.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.147.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.200.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.201.0",
          "pg": "^8.23.1",
          "subset-font": "^2.9.0",
          "wawoff2": "^2.0.1"
@@@ -1476,9 +1476,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.200.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.200.0",
--      "integrity": "sha512-MkGUNbiLM7RbuYhYZlmQXX660x5hQWkwlG0skuxjShlXxqbPAMNpAM+OMu+BbQieMpXq8HfQyTJH6nr6O6lM7w==",
++      "version": "4.201.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.201.0",
++      "integrity": "sha512-dZuifDLCoMlg+Qg/2G7IE3NbCqd2fZuk0G32JODgFRWS+CaHHTUTwWBBieJkuaUa1IV2xETe8qtbdLwekhvatg==",
        "license": "MIT",
        "dependencies": {
          "clean-css": "^5.3.3",
ddiff --git a/package.json b/package.json
iindex e73bddd..463f43c 100644
---- a/package.json
++++ b/package.json
@@@ -25,7 +25,7 @@
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.399.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.7.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.147.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.200.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.201.0",
      "pg": "^8.23.1",
      "subset-font": "^2.9.0",
      "wawoff2": "^2.0.1"
ddiff --git a/test/changes.test.js b/test/changes.test.js
iindex 76ce4c3..b1d12f7 100644
---- a/test/changes.test.js
++++ b/test/changes.test.js
@@@ -105,8 +105,12 @@ const { PUBLIC_DIR } = require('../server/assets');
              assert.strictEqual(body.pinned.version, changes.SHARED_VERSION);
              assert.strictEqual(body.releases.length, all.length);
              assert.strictEqual(body.releases[0].version, all[0].version);
--            assert.deepStrictEqual(body.releases[0].pages.map((p) => p.key), ['brand', 'menu', 'search-pill', 'dock']);
--            assert.ok(body.releases[0].rules.some((x) => x.id === 'button-becomes-its-tab' && x.n > 0));
++            // 4.200.0 is the curated release here: a new pin adds a release at the head, it does not change
++            // the pages and rules that release already names. Read it by version, not by its index.
++            const curated = body.releases.find((r) => r.version === '4.200.0');
++            assert.ok(curated, '4.200.0 is in the archive');
++            assert.deepStrictEqual(curated.pages.map((p) => p.key), ['brand', 'menu', 'search-pill', 'dock']);
++            assert.ok(curated.rules.some((x) => x.id === 'button-becomes-its-tab' && x.n > 0));
          });
  
          await check('/api/v1/changes supports limit and before without changing the default shape', async () => {