STATUS.json and the README status line name 4.15.2 (they said 4.10.0 through five releases); test/package.test.js holds them to package.json (#128)

ddiff --git a/README.md b/README.md
iindex 862ac17..e8cb420 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Versioned UI, the OpenVibe Frame (the navbar, footer and "shipped" views every site sits in), SEO, legal and release-client packages every OpenVibe site renders.
  
--**Status:** alpha, v4.10.0 (every release is a tag; see [CHANGELOG.md](CHANGELOG.md)). Every deployed
++**Status:** alpha, v4.15.2 (every release is a tag; see [CHANGELOG.md](CHANGELOG.md)). Every deployed
  consumer installs a tagged release and none keeps a vendored copy
  ([docs/migration-plan.md](docs/migration-plan.md) is done); each repository's `package.json` names
  the tag it pins.
ddiff --git a/STATUS.json b/STATUS.json
iindex e19b67b..bdfa989 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -4,7 +4,7 @@
    "code": true,
    "wave": "W2",
    "package": "openvibe-shared",
--  "version": "4.10.0",
++  "version": "4.15.2",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026)",
    "deployed": false,
    "deployment": "none of its own: a package released as git tags; OpenVibe.Network serves /shared/* from its pinned tag, and a site can serve its own pinned copy (openvibe-shared/serve)",
@@@ -26,5 +26,5 @@
      "browser harness and perf budgets for tests",
      "a CONFIRMATION_REQUESTED notification type: an agent owner is told when a sensitive-capability confirmation awaits them"
    ],
--  "updated": "2026-10-26"
++  "updated": "2026-10-27"
  }
ddiff --git a/test/package.test.js b/test/package.test.js
iindex 26de140..a8526e5 100644
---- a/test/package.test.js
++++ b/test/package.test.js
@@@ -47,3 +47,12 @@ console.log(`package: ${Object.keys(pkg.exports).length} exports resolve`);
      assert.strictEqual(OpenVibeAuthClient.prototype.verifyTokenInternal, undefined, 'verifyTokenInternal is removed');
      assert.strictEqual(OpenVibeAuthClient.prototype.getUserProfile, undefined, 'getUserProfile is removed');
  }
++
++// STATUS.json and the README status line say which release this is (Contracts' docs-currency check reads both): a
++// release PR that bumps package.json bumps them too. They said 4.10.0 through five releases (4.11-4.15).
++{
++    const status = JSON.parse(fs.readFileSync(path.join(ROOT, 'STATUS.json'), 'utf8'));
++    assert.strictEqual(status.version, pkg.version, `STATUS.json version ${status.version} is not package.json's ${pkg.version}`);
++    const line = fs.readFileSync(path.join(ROOT, 'README.md'), 'utf8').split('\n').find((l) => l.startsWith('**Status:**')) || '';
++    assert.ok(line.includes(`v${pkg.version} `), `the README status line names v${pkg.version}: ${line.slice(0, 60)}`);
++}