Registry: the libraries' current release (sdk, shared, contracts) is the version Network installs, read from each package.json, instead of hand-written numbers that were three releases stale (v0.4.0 / v1.3.0 / v0.30.1). /status labels and /api/v1/registry/releases drift follow the pins; the tests compare against the installed versions

ddiff --git a/server/registry/exposure.js b/server/registry/exposure.js
iindex b2be7a63..d1c5e5ac 100644
---- a/server/registry/exposure.js
++++ b/server/registry/exposure.js
@@@ -38,6 +38,19 @@ const LABEL = {
  // 'placeholder' (a Sites/admin placeholder page) or null (no public domain).
  const SITE_PLACEHOLDER = 'the domain serves the OpenVibe.Sites placeholder page';
  const ADMIN_PLACEHOLDER = 'the domain serves the admin.openvibe.network placeholder page';
++
++// The libraries' release is the version Network itself installs (its pins move with every release),
++// so this never goes stale the way hand-written numbers did.
++function library(pkg, repo, note) {
++    let version = null;
++    try { version = require(`${pkg}/package.json`).version; } catch { /* not installed */ }
++    const release = version ? `v${version}` : null;
++    const out = { state: 'library', public_site: null, package: pkg, release,
++        distribution: release ? `https://codeload.github.com/OpenVibers/${repo}/tar.gz/refs/tags/${release}` : null };
++    if (note) out.note = note;
++    return out;
++}
++
  const EXPOSURE = {
      network: { state: 'live', public_site: 'service' },
      live: { state: 'live', public_site: 'service' },
@@@ -66,9 +79,9 @@ const EXPOSURE = {
      chat: { state: 'internal', public_site: null, note: 'serves Live\'s chat through Live; openvibe.chat serves the OpenVibe.Sites placeholder page' },
      ai: { state: 'internal', public_site: null, note: 'called by other services at 127.0.0.1:4700; ai.openvibe.network serves the OpenVibe.Sites placeholder page' },
  
--    sdk: { state: 'library', public_site: null, package: 'openvibe-sdk', release: 'v0.4.0', distribution: 'https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0' },
--    shared: { state: 'library', public_site: null, package: 'openvibe-shared', release: 'v1.3.0', distribution: 'https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0', note: 'also served at /shared/* by each site' },
--    contracts: { state: 'library', public_site: null, package: 'openvibe-contracts', release: 'v0.30.1', distribution: 'https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.30.1', note: 'schemas are also served by this registry at their $id URLs' },
++    sdk: library('openvibe-sdk', 'OpenVibe.SDK'),
++    shared: library('openvibe-shared', 'OpenVibe.Shared', 'also served at /shared/* by each site'),
++    contracts: library('openvibe-contracts', 'OpenVibe.Contracts', 'schemas are also served by this registry at their $id URLs'),
      examples: { state: 'repository', public_site: null, note: 'example apps with CI in OpenVibers/OpenVibe.Examples; not published as a package' },
  
      realtime: { state: 'placeholder', public_site: null },
ddiff --git a/test/registry-exposure.test.js b/test/registry-exposure.test.js
iindex f798fa1f..66d35f89 100644
---- a/test/registry-exposure.test.js
++++ b/test/registry-exposure.test.js
@@@ -45,8 +45,8 @@ const ready = [200, { ready: true, status: 'ready', failed: [], degraded: [], ch
          assert.strictEqual(exposure.EXPOSURE[id].public_site, 'placeholder', `${id}'s domain serves a placeholder`);
          assert.strictEqual(exposure.publicOriginOf(contracts.services.get(id)), null, `${id} has no public origin`);
      }
--    assert.strictEqual(exposure.exposureOf('sdk').release, 'v0.4.0');
--    assert.strictEqual(exposure.exposureOf('shared').release, 'v1.3.0');
++    assert.strictEqual(exposure.exposureOf('sdk').release, `v${require('openvibe-sdk/package.json').version}`);
++    assert.strictEqual(exposure.exposureOf('shared').release, `v${require('openvibe-shared/package.json').version}`, 'the release is the installed version');
      assert.strictEqual(exposure.exposureOf('nope').state, 'unknown', 'an unclassified id is unknown, not public');
  
      // 2. Registry and status over fake loopback services.
@@@ -84,7 +84,7 @@ const ready = [200, { ready: true, status: 'ready', failed: [], degraded: [], ch
      assert.strictEqual(by.ai.runtime.status, 'up', 'AI is polled on loopback although its pinned manifest says placeholder');
      assert.strictEqual(by.ai.runtime.basis, 'ready');
      assert.strictEqual(by.sdk.runtime.status, 'not-running');
--    assert.strictEqual(by.sdk.runtime.reason, 'library, released v0.4.0');
++    assert.strictEqual(by.sdk.runtime.reason, `library, released v${require('openvibe-sdk/package.json').version}`);
      assert.strictEqual(by.examples.runtime.reason, 'repository, nothing to run');
      assert.strictEqual(by.realtime.runtime.reason, 'placeholder');
      assert.strictEqual(by.live.runtime.scope, 'public');
@@@ -100,7 +100,7 @@ const ready = [200, { ready: true, status: 'ready', failed: [], degraded: [], ch
      assert.strictEqual(sBy.news.planned_origin, 'https://openvibe.news');
      assert.strictEqual(sBy.live.label, 'up');
      assert.strictEqual(sBy.live.origin, 'https://openvibe.live');
--    assert.strictEqual(sBy.shared.label, 'not running (library, released v1.3.0)');
++    assert.strictEqual(sBy.shared.label, `not running (library, released v${require('openvibe-shared/package.json').version})`);
      assert.deepStrictEqual(st.exposure_summary, { live: 13, internal: 12, library: 3, repository: 1, placeholder: 1 });
  
      // The page: no row for a service whose domain serves a placeholder shows a bare "Up".
ddiff --git a/test/registry-topics.test.js b/test/registry-topics.test.js
iindex c17f9c90..3f883c2c 100644
---- a/test/registry-topics.test.js
++++ b/test/registry-topics.test.js
@@@ -54,8 +54,10 @@ const rel = (contractsVersion, packages) => [200, { service: 'x', release: 'abcd
      assert.strictEqual(by['deals.watch.matched'].payload_contract.$id, 'https://openvibe.network/contracts/events/payloads/deals.watch.matched.v1.json');
  
      // 3. over HTTP
--    const svc = await fakeService({ '/api/ready': ready, '/ready': ready, '/api/health': [200, {}], '/health': [200, {}], '/healthz': [200, {}], '/release.json': rel('0.28.0', { 'openvibe-shared': '1.3.0', 'openvibe-sdk': '0.3.1', 'evil-pkg': '9.9.9' }) });
--    const cur = await fakeService({ '/api/ready': ready, '/api/health': [200, {}], '/release.json': rel('0.30.1', { 'openvibe-shared': '1.3.0', 'openvibe-sdk': '0.4.0' }) });
++    // The libraries' current release is the version Network installs (server/registry/exposure.js).
++    const INSTALLED = { shared: require('openvibe-shared/package.json').version, sdk: require('openvibe-sdk/package.json').version, contracts: require('openvibe-contracts/package.json').version };
++    const svc = await fakeService({ '/api/ready': ready, '/ready': ready, '/api/health': [200, {}], '/health': [200, {}], '/healthz': [200, {}], '/release.json': rel('0.28.0', { 'openvibe-shared': INSTALLED.shared, 'openvibe-sdk': '0.3.1', 'evil-pkg': '9.9.9' }) });
++    const cur = await fakeService({ '/api/ready': ready, '/api/health': [200, {}], '/release.json': rel(INSTALLED.contracts, { 'openvibe-shared': INSTALLED.shared, 'openvibe-sdk': INSTALLED.sdk }) });
      const eco = createEcosystemRegistry({ issuer: 'https://openvibe.network', internalOverrides: { network: cur.url, live: svc.url, media: 'http://127.0.0.1:1', events: svc.url } });
      await eco.pollAll();
      const app = express();
@@@ -129,6 +131,9 @@ const rel = (contractsVersion, packages) => [200, { service: 'x', release: 'abcd
  
      // 4. scripts/contracts-drift.js: warns, never fails; reports an unpublished pin.
      const tags = ['v0.28.0', 'v0.29.0', 'v0.30.0', 'v0.30.1'];
++    // What GitHub lists in the CLI checks below: up to the contracts Network installs.
++    const LATEST = `v${INSTALLED.contracts}`;
++    const ghTags = [...new Set([...tags, LATEST])];
      const found = drift.assess([
          { service: 'a', repo: 'O/A', package: 'openvibe-contracts', spec: 'https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.28.0' },
          { service: 'b', repo: 'O/B', package: 'openvibe-contracts', spec: 'https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.30.1' },
@@@ -143,14 +148,14 @@ const rel = (contractsVersion, packages) => [200, { service: 'x', release: 'abcd
      const out = { log: (s) => lines.push(s) };
      const fakeGithub = async (url) => {
          const u = String(url);
--        if (u.startsWith('https://api.github.com/repos/OpenVibers/OpenVibe.Contracts/tags')) return new Response(JSON.stringify(tags.map(name => ({ name }))), { status: 200 });
++        if (u.startsWith('https://api.github.com/repos/OpenVibers/OpenVibe.Contracts/tags')) return new Response(JSON.stringify(ghTags.map(name => ({ name }))), { status: 200 });
          if (u.includes('/OpenVibers/OpenVibe.Live/HEAD/package.json')) return new Response(JSON.stringify({ dependencies: { 'openvibe-contracts': 'https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.28.0' } }), { status: 200 });
--        if (u.includes('raw.githubusercontent.com')) return new Response(JSON.stringify({ dependencies: { 'openvibe-contracts': 'https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.30.1' } }), { status: 200 });
++        if (u.includes('raw.githubusercontent.com')) return new Response(JSON.stringify({ dependencies: { 'openvibe-contracts': `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/${LATEST}` } }), { status: 200 });
          return new Response('{}', { status: 404 });
      };
      let code = await drift.main([], { fetchImpl: fakeGithub, env: { GITHUB_ACTIONS: 'true' }, out });
      assert.strictEqual(code, 0, 'drift is a warning, not a failure');
--    assert.ok(lines.some(l => l.startsWith('::warning title=openvibe-contracts drift::live (OpenVibers/OpenVibe.Live) pins v0.28.0, latest is v0.30.1')), lines.join('\n'));
++    assert.ok(lines.some(l => l.startsWith(`::warning title=openvibe-contracts drift::live (OpenVibers/OpenVibe.Live) pins v0.28.0, latest is ${LATEST}`)), lines.join('\n'));
      assert.ok(!lines.some(l => l.includes('::warning') && l.includes('OpenVibe.Media')));
      lines.length = 0;
      code = await drift.main(['--strict'], { fetchImpl: fakeGithub, env: {}, out });
@@@ -159,8 +164,8 @@ const rel = (contractsVersion, packages) => [200, { service: 'x', release: 'abcd
      lines.length = 0;
      code = await drift.main(['--registry', base], { fetchImpl: (u, o) => (String(u).startsWith(base) ? fetch(u, o) : fakeGithub(u, o)), env: {}, out });
      assert.strictEqual(code, 0);
--    assert.ok(lines.some(l => l.startsWith('WARN openvibe-contracts live: pins v0.28.0, latest is v0.30.1')), lines.join('\n'));
--    assert.ok(lines.some(l => l.includes('network: pins v0.30.1 (latest)')));
++    assert.ok(lines.some(l => l.startsWith(`WARN openvibe-contracts live: pins v0.28.0, latest is ${LATEST}`)), lines.join('\n'));
++    assert.ok(lines.some(l => l.includes(`network: pins ${LATEST} (latest)`)), lines.join('\n'));
  
      eco.stop(); srv.close(); svc.srv.close(); cur.srv.close();
      console.log('registry topics, releases and drift: all checks passed');
ddiff --git a/test/status.test.js b/test/status.test.js
iindex b16182b8..b0dfa4c6 100644
---- a/test/status.test.js
++++ b/test/status.test.js
@@@ -75,7 +75,7 @@ const rel = (release) => [200, { service: 'x', release, released_at: '2026-09-22
      assert.strictEqual(by.realtime.status, 'not-running');
      assert.strictEqual(by.realtime.label, 'not running (placeholder)');
      assert.strictEqual(by.contracts.status, 'not-running');
--    assert.strictEqual(by.contracts.label, 'not running (library, released v0.30.1)');
++    assert.strictEqual(by.contracts.label, `not running (library, released v${require('openvibe-contracts/package.json').version})`);
      for (const s of r.body.services) assert.ok(s.checked_at, `${s.id} says when it was checked`);
      assert.strictEqual(r.body.summary.up + r.body.summary.degraded + r.body.summary.down + r.body.summary['not-running'] + r.body.summary.unknown, contracts.services.manifests.length);