openvibe-shared v4.228.0 (was v4.225.0) (#278)

ddiff --git a/README.md b/README.md
iindex df4b9bf..d90788a 100644
---- a/README.md
++++ b/README.md
@@@ -510,5 +510,5 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by [
  <!-- versions:start -->
  - openvibe-contracts: v0.417.0
  - openvibe-sdk: v0.161.0
--- openvibe-shared: v4.225.0
++- openvibe-shared: v4.228.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex c387c5f..7767df6 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -11,7 +11,7 @@
    "database": "PostgreSQL 18 through PgBouncer (transaction mode) as the system of record, Valkey 9 for shared state (per-actor limits, overlay fan-out, overlay stream slots), ADR-035: database ov_tips from OpenVibe.Host's data role, schema in migrations/ (0001_initial expand, 0002_drop_legacy_import contract), async on openvibe-sdk/db v0.28.0, money paths serializable with row locks, PostgreSQL outbox and inbox.",
    "contracts": "openvibe-contracts v0.417.0",
    "sdk": "openvibe-sdk v0.161.0",
--  "shared": "openvibe-shared v4.225.0",
++  "shared": "openvibe-shared v4.228.0",
    "notes": "Runtime, API, SSR pages, overlays, the Billing settlement consumer and the events outbox are built, tested and deployed, together with /metrics (loopback only), truthful /api/ready (Billing and Events checks), supporter privacy (anonymous, hidden amount, private message), goal and supporter-page settings, export and erasure (tips.interaction.erased), moderation (word filter, hide/show, invited moderators, tips.interaction.moderated) and per-actor limits. Capabilities (18 tips.*) and payload schemas are in openvibe-contracts. Billing is the money ledger since the cutover (2026-10-17). A written internal threat review (docs/threat-review.md) with its fixes and test/security.test.js. Paid sounds (creators upload up to 12, supporters pay to play one on the overlay) since 2026-10-17. Not done: an independent security review.",
    "features": [
      "tips, paid messages, TTS and media requests settled by OpenVibe.Billing (never Tips' own money)",
ddiff --git a/package-lock.json b/package-lock.json
iindex 76acf24..bace9a2 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.417.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.161.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.225.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.228.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -1243,9 +1243,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.225.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.225.0",
--      "integrity": "sha512-zuZIgYODwJJ7UpDBTVnT+czEI5l6YFWqt1nbfbPeEsW6/NlmDZHJWPSGpBv223jRpvhJYH7Duea6nuRr8KZ3sg==",
++      "version": "4.228.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.228.0",
++      "integrity": "sha512-HR0Hac/K+qKmwMf2QZWCFxW+uVja36nyAtxVbNFgPGUDFdmWhmb6RMoP/CkU0+GSCPsC50k6aTS+oPx2czDgGg==",
        "license": "MIT",
        "dependencies": {
          "clean-css": "^5.3.3",
ddiff --git a/package.json b/package.json
iindex ae0a8ce..62ae66c 100644
---- a/package.json
++++ b/package.json
@@@ -27,7 +27,7 @@
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.417.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.161.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.225.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.228.0",
      "pg": "^8.23.0"
    },
    "engines": {
ddiff --git a/server/render/short.js b/server/render/short.js
iindex 3283390..edc6f87 100644
---- a/server/render/short.js
++++ b/server/render/short.js
@@@ -1,4 +1,5 @@
  'use strict';
++const { pick } = require('openvibe-shared/showcase');
  /**
   * The home on a phone (the owner's short-pages rule, 2026-10-30): one or two screens, app-like.
   *
@@@ -20,15 +21,11 @@ const esc = (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</
   *
   *   pickBlock({ key, label, head, panes })   panes: [{ id, label, html }]
   */
--function pickBlock({ key, label, head = '', panes }) {
--    // A pane with nothing to show is left out, so the chips and the rules that show them match the page.
--    panes = (panes || []).filter((p) => p.html);
--    if (!panes.length) return '';
--    const chips = panes.map((p) => `<a class="pick-chip" href="#${esc(p.id)}">${esc(p.label)}</a>`).join('');
--    // The pane carries the id the page already links to (an anchor in the hero, for instance), so a link to it still
--    // opens that pane on a phone (the CSS shows the pane a link points at).
--    const body = panes.map((p) => `<div class="pick-pane" id="${esc(p.id)}">${p.html}</div>`).join('');
--    return `<div class="pick" id="pick-${esc(key)}"><div class="pick-bar"><div class="pick-head"><h2>${esc(head || label)}</h2></div><nav class="pick-row" aria-label="${esc(label)}">${chips}</nav></div><div class="pick-body">${body}</div></div>`;
++// 4.228.0: Shared's showcase.pick() draws the block (tabs on a phone, every pane in the page, a link to a pane opens
++// it); this copy only jumped to a pane with chips, so a phone showed them all (the owner, 11-12). The ids are this
++// site's own, so its links keep working.
++function pickBlock({ key, label, head = '', headId = '', bodyClass = '', panes, checked = '' }) {
++    return pick({ key, label, head, headId, bodyClass, checked: checked ? checked : '', panes: (panes || []).map((p) => ({ id: p.id, label: p.label, html: p.html })) });
  }
  
  
ddiff --git a/test/asset-cache.test.js b/test/asset-cache.test.js
iindex 9507abd..89b8697 100644
---- a/test/asset-cache.test.js
++++ b/test/asset-cache.test.js
@@@ -18,10 +18,10 @@ const { assetVersion } = require('../server/web/layout');
          assert.strictEqual(good.headers.get('cache-control'), cache.IMMUTABLE);
          const wrong = await get(`/${rel}?v=deadbeefdeadbeef`);
          assert.strictEqual(wrong.status, 200);
--        assert.strictEqual(wrong.headers.get('cache-control'), 'public, max-age=300, stale-while-revalidate=86400');
++        assert.strictEqual(wrong.headers.get('cache-control'), 'public, max-age=300, stale-while-revalidate=300');
          const bare = await get(`/${rel}`);
          assert.strictEqual(bare.status, 200);
--        assert.strictEqual(bare.headers.get('cache-control'), 'public, max-age=300, stale-while-revalidate=86400');
++        assert.strictEqual(bare.headers.get('cache-control'), 'public, max-age=300, stale-while-revalidate=300');
      });
  
      await check('robots.txt: the shared html policy at the same window', async () => {
ddiff --git a/test/home-short.test.js b/test/home-short.test.js
iindex eb1d95d..10ed0b2 100644
---- a/test/home-short.test.js
++++ b/test/home-short.test.js
@@@ -12,19 +12,19 @@ const { boot, check, done } = require('./helpers/app');
  (async () => {
      const t = await boot();
      try {
--        await check('the home is one pick block: a chip per part, the first picked, every part in the page', async () => {
++        await check('the home is one pick block: a tab per part, the first picked, every part in the page', async () => {
              const r = await t.call('GET', '/', { token: null });
              assert.strictEqual(r.status, 200, r.text);
              const page = r.text;
              const block = page.slice(page.indexOf('<div class="pick" id="pick-parts">'), page.indexOf('<div class="pick" id="pick-parts">') + 60000);
              assert.ok(block.startsWith('<div class="pick" id="pick-parts">'), 'the pick block is on the home');
--            assert.match(block, /<nav class="pick-row" aria-label="What Tips does">/);
--            const chips = [...block.matchAll(/<a class="pick-chip" href="#(?:pp-parts-)?([a-z-]+)">()([^<]+)<\/a>/g)];
--            assert.ok(chips.length >= 5, `a chip per part (${chips.length})`);
--            assert.ok(!/type="radio"/.test(block), 'no chip is a radio: nothing is picked, every pane shows');
--            // Every part stays in the page, with the id its chip picks.
++            assert.match(block, /<div class=\"ov-parts ov-parts--front\" data-parts=\"\d+\">/, 'its parts are tabs on a phone');
++            const chips = [...block.matchAll(/<label for="ovp-[a-z0-9]+-(?:pp-parts-)?([a-z-]+)">()([^<]+)(?: <span class="ov-parts-n">[^<]*<\/span>)?<\/label>/g)];
++            assert.ok(chips.length >= 5, `a tab per part (${chips.length})`);
++            assert.ok(/<input type=\"radio\" class=\"ov-parts-r\"[^>]* checked>/.test(block), 'the first part is open on a phone (Shared pick(): tabs, 11-12)');
++            // Every part stays in the page, with the id its tab opens.
              const panes = [...block.matchAll(/<div class="pick-pane" id="([a-z-]+)">/g)].map((m) => m[1]);
--            assert.deepStrictEqual(panes, chips.map((m) => m[1]), 'every part is in the page, one per chip');
++            assert.deepStrictEqual(panes, chips.map((m) => m[1]), 'every part is in the page, one per tab');
              // The parts themselves are all there: nothing was removed.
              for (const title of ['What you can send', 'For creators', 'Other ways to support', 'How it works', 'What it costs to send']) {
                  assert.ok(page.includes(title), `${title} is on the page`);