Pin openvibe-publishing v1.1.0 and sync STATUS with pins (#5)

ddiff --git a/README.md b/README.md
iindex 4cef08b..f1735c8 100644
---- a/README.md
++++ b/README.md
@@@ -278,8 +278,9 @@ Production: `/opt/openvibe.wiki`, env `/etc/openvibe/wiki.env`, unit
  
  - PostgreSQL 18 and Valkey 9 (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through
    `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional: without `VALKEY_URL` they count per process).
--- `openvibe-publishing` v1.0.0 (async PostgreSQL stores), `openvibe-contracts` v0.76.0, `openvibe-shared` v2.3.1
--  (Frame, release, metrics, readiness, SEO helpers, legal pages), `openvibe-sdk` v0.19.0 (db, auth, PostgreSQL
++- `openvibe-publishing` v1.1.0 (async PostgreSQL stores, ingest and publication chassis), `openvibe-contracts`
++  v0.76.0, `openvibe-shared` v2.5.0
++  (Frame, release, metrics, readiness, SEO helpers, legal pages), `openvibe-sdk` v0.26.0 (db, auth, PostgreSQL
    events outbox, per-actor limits, testing) — pinned release tarballs.
  - OpenVibe.Network (SSO, JWKS, service principal `wiki`), OpenVibe.Events, OpenVibe.Community,
    OpenVibe.Sources, OpenVibe.Media, OpenVibe.VIP (VIP spaces and pages), OpenVibe.Search (consumer of
ddiff --git a/STATUS.json b/STATUS.json
iindex 3181236..2626ca9 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -9,9 +9,9 @@
    "domain": "openvibe.wiki",
    "contracts": "openvibe-contracts v0.76.0",
    "packages": [
--    "openvibe-publishing v1.0.0",
--    "openvibe-shared v2.3.1",
--    "openvibe-sdk v0.19.0"
++    "openvibe-publishing v1.1.0",
++    "openvibe-shared v2.5.0",
++    "openvibe-sdk v0.26.0"
    ],
    "capabilities": [
      "wiki.space.create",
@@@ -28,7 +28,7 @@
    "deployment": "Public at https://openvibe.wiki since 2026-09-23 (~03:00 UTC): deployed with `sudo ovhost deploy wiki`, /opt/openvibe.wiki, unit openvibe-wiki on 127.0.0.1:4800 behind the openvibe.wiki nginx vhost, principal wiki. On 2026-09-23 production held 1 space and the 10 seed pages (1 revision each), 0 person reviews, so every page was noindex and nothing public was in Search. Restore drill passed 2026-09-23.",
    "onOpenVibeSites": false,
    "seed": "official space \"openvibe\" (10 pages summarised with AI assistance from the repositories' README/STATUS files, cited; noindex until a person reviews each; 0 of 10 reviewed as of 2026-09-23)",
--  "updated": "2026-09-28",
++  "updated": "2026-10-03",
    "deployedAt": "2026-09-23",
    "features": [
      "spaces with page trees and roles",
ddiff --git a/package-lock.json b/package-lock.json
iindex e68e190..a81dd48 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "express-rate-limit": "^7.5.0",
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
--        "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.0.0",
++        "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.1.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
          "pg": "^8.23.0"
@@@ -1149,9 +1149,9 @@
        }
      },
      "node_modules/openvibe-publishing": {
--      "version": "1.0.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.0.0",
--      "integrity": "sha512-g4mU0PPtI4y38NcsdppEbrXTrCYp0rPmIYWyxLxh4GpEYhn48jMWq2+cMQA2uwZCeeZlB3UiXVrQNQyQLiliwg==",
++      "version": "1.1.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.1.0",
++      "integrity": "sha512-bJsVl82hDivazoiM/np9ckKJE4V5F4OxyIiDwB6xuhK8M6P42sGU+V88rFCkyiI4BVQiKv9xs4GVx8Fj3pyjsg==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
ddiff --git a/package.json b/package.json
iindex b5869db..e605047 100644
---- a/package.json
++++ b/package.json
@@@ -26,7 +26,7 @@
      "express-rate-limit": "^7.5.0",
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
--    "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.0.0",
++    "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.1.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
      "pg": "^8.23.0"
ddiff --git a/test/status-pins.test.js b/test/status-pins.test.js
nnew file mode 100644
iindex 0000000..9172a16
---- /dev/null
++++ b/test/status-pins.test.js
@@@ -0,0 +1,32 @@
++'use strict';
++/**
++ * STATUS.json and README name the release each openvibe package is pinned to; package.json is the
++ * truth. A pin bump that leaves the prose behind makes downstream repositories advertise a version
++ * this one does not run (OpenVibe.Publishing's STATUS.json lists consumers by pinned version).
++ */
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const root = path.join(__dirname, '..');
++const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
++const status = JSON.parse(fs.readFileSync(path.join(root, 'STATUS.json'), 'utf8'));
++
++/** The tag of a pinned release tarball, e.g. ".../v1.1.0" -> "1.1.0". */
++function pinnedTag(name) {
++    const url = pkg.dependencies[name];
++    assert.ok(url, `package.json does not depend on ${name}`);
++    const m = /\/tags\/v(\d+\.\d+\.\d+)$/.exec(url);
++    assert.ok(m, `${name} is not pinned to a release tag: ${url}`);
++    return m[1];
++}
++
++for (const entry of status.packages) {
++    const m = /^(\S+) v(\d+\.\d+\.\d+)$/.exec(entry);
++    assert.ok(m, `STATUS.json packages entry is not "<name> vX.Y.Z": ${entry}`);
++    assert.strictEqual(m[2], pinnedTag(m[1]), `STATUS.json says ${entry}, but package.json pins ${pinnedTag(m[1])}`);
++}
++assert.ok(/openvibe-contracts v\d+\.\d+\.\d+$/.test(status.contracts), 'STATUS.json contracts names a version');
++assert.strictEqual(status.contracts.split(' v')[1], pinnedTag('openvibe-contracts'), 'STATUS.json contracts matches package.json');
++
++console.log('status pins: all checks passed');