diff --git a/.github/workflows/academy-courses-drift.yml b/.github/workflows/academy-courses-drift.yml
index 8c20185..13710ef 100644
--- a/.github/workflows/academy-courses-drift.yml
+++ b/.github/workflows/academy-courses-drift.yml
@@ -16,12 +16,11 @@ name: Academy course catalog drift watcher
# after the existing issue closes and drift recurs.
on:
- # TODO(2026-05-21): cron paused — Skilljar page structure changed, scraper
- # broken since 2026-05-16 (5 days, 8 consecutive fails). Re-enable after
- # fixing selectors in a dedicated session. Manual dispatch still available.
- # Original cadence: '15 */12 * * *' (every 12h)
- # schedule:
- # - cron: '15 */12 * * *'
+ # Re-enabled 2026-06-01: the scraper parses the current catalog correctly
+ # again (check-academy-courses.js passes after wiring the new course), so the
+ # 12-hour watch behind POSITIONING.md's "new course -> 48h" SLA is restored.
+ schedule:
+ - cron: '15 */12 * * *'
workflow_dispatch: # manual trigger from Actions UI
permissions:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4e33c7..7ee7a27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
## [Unreleased]
+## [3.5.39] - 2026-06-01
+
+### Security
+- **Page bridge + AI tutor scoped to `anthropic.skilljar.com`.** The Puter postMessage bridge (Gemini verification + Claude tutor) uses a nonce that any page-world script can read, so it must not run on Skilljar tenants we don't control. The bridge and the tutor sidebar now initialize only on the trusted Anthropic host; other AI-detected Skilljar tenants still get the dictionary + Google Translate, just not the bridge.
+
+### Fixed
+- Example-question chips lost their click handlers after opening and closing a sub-panel (History / Flashcards / Bookmarks / Continue) — `closeSubPanel` now re-binds them alongside the chat input.
+
+### Changed
+- Wired `ai-fluency-for-small-businesses` (18th live course) into `FLASHCARD_COURSE_MAP`, clearing the Academy course-drift check, and re-enabled the 12-hour drift cron (the catalog scraper parses correctly again).
+- Store listing updated to 18 courses; `RELEASE_CHECKLIST.md` refreshed for the current state (icon resolved, v3.5.39 artifacts).
+
## [3.5.38] - 2026-06-01
### Fixed — translation rendering & dark-mode polish (from a live debugging pass on anthropic.skilljar.com)
diff --git a/README.md b/README.md
index f9294f2..96007fa 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
-# SkillBridge — AI Course Translator v3.5.38
+# SkillBridge — AI Course Translator v3.5.39
> Available in multiple languages at the [project landing page](https://heznpc.github.io/skillBridge/).
diff --git a/docs/index.html b/docs/index.html
index e23c88b..105425f 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -6,7 +6,7 @@
SkillBridge — AI Course Translator for <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> Languages
-
+