heznpc · heznpc · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026
@@ -17,7 +17,7 @@
 
 **Translate the free AI courses at [anthropic.skilljar.com](https://anthropic.skilljar.com/) into your language — instantly.**
 
-Break the language barrier on these free AI courses. <!-- LANG_COUNT_START -->32 languages<!-- LANG_COUNT_END --> supported. The extension auto-activates on `anthropic.skilljar.com` and on any other Skilljar-hosted AI course it detects; non-AI Skilljar tenants are paused automatically.
+Break the language barrier on these free AI courses. <!-- LANG_COUNT_START -->32 languages<!-- LANG_COUNT_END --> supported. The extension auto-activates on `anthropic.skilljar.com` and on any other Skilljar-hosted AI course it detects (translation only on those — the AI Tutor runs on `anthropic.skilljar.com` exclusively); non-AI Skilljar tenants are paused automatically.
 
 [Install](#installation) · [Features](#features) · [Report Bug](https://github.com/heznpc/skillbridge/issues) · [Request Feature](https://github.com/heznpc/skillbridge/issues) · [Contributing](CONTRIBUTING.md)
 
@@ -91,7 +91,7 @@ Every text element on the page is translated, with AI-specific terms handled cor
 
 ### 🤖 AI Tutor
 
-A sidebar chatbot powered by **Claude Sonnet 4.6** via [Puter.js](https://docs.puter.com/). It knows which course and lesson you're on. Ask questions in your language, get streaming answers.
+A sidebar chatbot powered by **Claude Sonnet 4.6** via [Puter.js](https://docs.puter.com/). It knows which course and lesson you're on. Ask questions in your language, get streaming answers. The tutor and the Puter page bridge it relies on run **only on `anthropic.skilljar.com`** — on other detected Skilljar AI tenants the extension still translates (curated dictionary + Google Translate), but the AI Tutor stays off (its bridge nonce is readable by page-world scripts, so we never expose it on tenants we don't control).
 
 ### 🎬 Auto-Subtitles
 

@@ -1,7 +1,7 @@
 # SkillBridge TODO
 
 > Strategy & scope: see [POSITIONING.md](POSITIONING.md).
-> Last refreshed: 2026-05-15 (v3.5.34 + positioning rewrite — certificate-first, Korea-weighted)
+> Last refreshed: 2026-06-01 (v3.5.39 — learning companion shipped; bridge/tutor scoped to anthropic.skilljar.com)
 
 Items below are concrete engineering / ops work. Anything strategic — what
 markets we enter, what we charge, what features we accept — belongs in
@@ -11,7 +11,7 @@ The "Now" section tracks the [Blockers before outreach](POSITIONING.md#blockers-
 gate — these have to clear before any Korea / Japan growth push or
 Ambassador submission is worth the user-facing effort.
 
-## Learning companion — local-only & free (active: v3.5.36)
+## Learning companion — local-only & free (shipped: v3.5.36–3.5.39)
 
 Native Academy tracks enrollment/completion but skips learner conveniences:
 no global resume, course-level bookmark only (with no list view anywhere),
@@ -23,15 +23,15 @@ narrowed.
 
 - [x] **SRS scheduling for flashcards** (v3.5.36). Per-card due dates
   (box 0→1d / 1→3d / 2→7d) + "Review due (N)" mode. `chat-flashcards.js`.
-- [ ] **Lesson / position bookmarks.** Mark a specific lesson + scroll/video
-  position; bookmark list in the sidebar. (Native bookmark is course-level
-  only and has no aggregation view.)
-- [ ] **Global resume ("이어보기").** Track last-visited lesson + exact
-  position across courses; quick-resume launcher on the catalog / sidebar.
-  (Native home is a flat catalog; Resume is per-course only.)
-- [ ] **"My learning" overlay.** Bookmarks + resume + recently-viewed in one
-  friendly panel. (Native "Registrations" is a dense admin table.)
-- [ ] **In-lesson TOC + reading-progress bar.** DOM-only, no storage.
+- [x] **Lesson / position bookmarks** (v3.5.36). Mark a specific lesson +
+  scroll position; bookmark list in the sidebar. `bookmarks.js`.
+- [x] **Global resume ("이어보기")** (v3.5.36). Last-visited lesson + exact
+  position tracked across courses (SPA-safe URL poll); Continue/Recent
+  launcher in the sidebar. `resume.js`.
+- [x] **"My learning" overlay** (v3.5.36). Bookmarks + Continue + Recent are
+  grouped under the single "Tools" menu in the tutor header. `sidebar-chat.js`.
+- [x] **In-lesson TOC + reading-progress bar** (v3.5.36). DOM-only, no storage.
+  `reading-aid.js`.
 - [ ] **Highlights / notes.** Per-lesson, local.
 - [ ] (optional) **"Report wrong term"** — local queue + export. GitHub
   auto-link deferred (learner audience ≠ GitHub users).
@@ -42,23 +42,22 @@ narrowed.
   Puter.js stays the only model; free fallback only.
 - Any server-side feature.
 
-### Release / ops (v3.5.36)
+### Release / ops (v3.5.36–3.5.39)
 - [x] Icon redesign (v3.5.35, on `main`) — distinct mark.
-- [ ] Bundle the features above into `release/3.5.36`: version bump +
-  `npm run docs` resync + PR + `npm run build:zip`.
+- [x] Bundle the features above into releases (v3.5.36–3.5.39, all on `main`):
+  version bumps + `npm run docs` resync + PRs + `npm run build:bundle:zip`.
+  `store-assets/skillbridge-bundled.zip` rebuilt at 3.5.39.
 - [ ] **Upload the built zip to the CWS dashboard** (human-only). Store is
-  stuck at 1.0.1; everything since is repo-only.
+  stuck at 1.0.1; everything since is repo-only. See
+  [store-assets/RELEASE_CHECKLIST.md](store-assets/RELEASE_CHECKLIST.md).
 
 ## Now (Ambassador / outreach blockers)
 
-- [ ] **Add `ai-fluency-for-small-businesses` dictionary section.** The
-  academy-courses-drift watcher's first run (2026-05-14) flagged this 18th
-  course as unknown to `FLASHCARD_COURSE_MAP`. Add an `aiFluencySmallBiz`
-  section to all 10 premium-language dictionaries in `src/data/` (clone
-  `aiFluencyNonprofit` as a template — the AI Fluency series share
-  terminology). Add the slug row to `FLASHCARD_COURSE_MAP`. `npm run
-  check:dict-coverage` + `npm run check:academy` must both pass.
-  **Korea-first** — Korean translation lands first, others same week.
+- [x] **Wire `ai-fluency-for-small-businesses` (18th course)** (v3.5.39).
+  Mapped in `FLASHCARD_COURSE_MAP` to the shared `aiFluency` deck — the AI
+  Fluency series share terminology, so it reuses the existing deck rather than
+  a new `aiFluencySmallBiz` section (no dict gap). `check:academy` +
+  `check:dict-coverage` both pass; the 12h drift cron is re-enabled.
 - [ ] **CWS listing refresh (multilingual) — upload to dashboard.**
   Repo-side copy is ready: `store-assets/STORE_LISTING.md` rewritten on
   certificate-accessibility framing (v3.5.34), plus localized

@@ -18,12 +18,22 @@ Everything code-side is ready and pre-built.
 ## What's already prepared (no further action needed)
 
 - ✅ `manifest.json` v3.5.39 + `package.json` + 11 `src/data/*.json` `_meta.version` all bumped
-- ✅ `CHANGELOG.md` v3.5.34 section written (PR #135, #136, #137, #138, #139, #140, #142, #145 consolidated)
+- ✅ `CHANGELOG.md` v3.5.34–3.5.39 sections written (PRs #135–#157 consolidated)
 - ✅ `store-assets/skillbridge-bundled.zip` (minified, **rebuilt at v3.5.39** via `npm run build:bundle:zip`) — **this is the CWS upload artifact**
-- ✅ `store-assets/skillbridge.zip` (636 KB, raw source) — alternative upload if the bundled fails review
+- ⚠️ `store-assets/skillbridge.zip` (raw source) — fallback only if the bundled
+  build is rejected in review. **Run `npm run build:zip` immediately before
+  uploading it** — this artifact is gitignored, is not rebuilt by
+  `build:bundle:zip`, and will otherwise lag behind `manifest.json` (it was
+  found stale at 3.5.38 once while the bundle was 3.5.39).
 - ✅ All 11 Premium `_locales/*/messages.json` have `extDescription` nominative form
 - ✅ Nominative-use sweep clean (`SkillBridge — AI Course Translator`, no Anthropic-as-product-modifier)
-- ✅ Privacy URL `/privacy` (lowercase) — verified 200 from Googlebot UA
+- ✅ Privacy URL is `https://heznpc.github.io/skillBridge/privacy` — **capital "B"**.
+  GitHub Pages repo-path segments are case-sensitive: the lowercase
+  `/skillbridge/privacy` returns **404** (verified 2026-06-02), which the CWS
+  dashboard rejects with "개인정보처리방침 링크에 연결할 수 없습니다 / Cannot
+  connect to the privacy policy link". `github.com` links are case-insensitive,
+  so the homepage/support URLs are fine lowercase — only the `github.io` URL
+  must be capital-B.
 - ✅ Tests 488/488 + 17 e2e, ESLint + Prettier clean, all check-* scripts clean (incl. `check:academy`)
 - ✅ AI-content gate wired into `manifest.json:content_scripts[].js` (PR #145 hotfix)
 - ✅ CWS-drift watcher will keep this from drifting 3 months again
@@ -64,9 +74,42 @@ Open https://chrome.google.com/webstore/devconsole/a4725d38-81e7-41f5-bf21-5c11f
 | Privacy policy URL | `https://heznpc.github.io/skillBridge/privacy` |
 | Korean listing | paste from `store-assets/STORE_LISTING-ko.md` |
 | Japanese listing | paste from `store-assets/STORE_LISTING-ja.md` |
-| Icon (128×128) | upload current `assets/icons/icon128.png` |
+| Icon (128×128) | upload current `assets/icons/icon128.png` (half-sun + bridge). ⚠️ the **live listing still shows the OLD coral radial-spark icon** — the store-listing graphic is a separate asset from the package and must be re-uploaded here, or the infringing mark stays live. |
 | Promo tile + screenshots | upload current set (no change unless step 2 ran) |
 
+### 3b. Privacy tab (this is what blocked the last submit)
+
+Open the "개인정보 보호 / Privacy practices" tab. The published v1.0.1 answers are
+stale against v3.5.39 — fix these:
+
+- **Privacy policy URL** — must be the **capital-B** `github.io` URL (see the
+  Privacy-URL note above). The lowercase form 404s and the dashboard refuses to
+  submit ("개인정보처리방침 링크에 연결할 수 없습니다").
+- **"Are you using remote code?" → NO.** v1.0.1 loaded Puter.js from
+  `https://js.puter.com/v2/` (remote code → MV3 detailed review / delay).
+  v3.5.39 bundles it as `src/bridge/puter.js` and loads it via
+  `chrome.runtime.getURL` (`translator.js` sets `script.dataset.puterUrl =
+  chrome.runtime.getURL('src/bridge/puter.js')`); there is no remote fallback
+  (`page-bridge.js`: `if (!_puterUrl) reject`). So no remote code is loaded.
+  **Only flip this to NO after the v3.5.39 package is uploaded** — answering NO
+  while the published build still loads remote Puter would be a false statement.
+  (Puter's runtime calls to `api.puter.com` are data transfer, not remote code —
+  disclosed under data usage below.)
+- **Data usage → check "Website content".** Page text is sent to Google
+  Translate and lesson context (≤2,000 chars) is sent via Puter to Gemini/Claude.
+  Leaving it unchecked while the description says page text is sent off-device is
+  an inconsistency reviewers reject. Local-only data (bookmarks, resume,
+  flashcards, settings — `chrome.storage.local`, never leaves the device) is
+  NOT "collected", so location / browsing history / user activity stay unchecked.
+  Keep the three confirmations checked (transfer to a service provider to perform
+  the requested feature is an approved use case, not a sale).
+- **Permission justifications** — paste from `STORE_LISTING.md` "Permission
+  Justifications". v3.5.39 declares `storage` + `alarms` + four hosts
+  (`*.skilljar.com`, `*.youtube.com`, `translate.googleapis.com`,
+  `api.github.com`). The old `activeTab` / `tabs` justification fields disappear
+  after upload (those permissions are no longer in the manifest); `alarms` and
+  `api.github.com` are new and need a line each.
+
 ### 4. Flip CWS_PUBLICATION_PAUSED off (only if currently set)
 
 ```
@@ -96,7 +139,7 @@ the `cws-drift.yml` workflow via `workflow_dispatch` — it should report `OK`
 
 ## If trademark complaint comes back
 
-If Tracer / Anthropic IP enforcement files another complaint against v3.5.34:
+If Tracer / Anthropic IP enforcement files another complaint against v3.5.39:
 1. Check whether it cites the icon (then return to step 1 option B/C) or the
    listing copy (then re-sweep `store-assets/STORE_LISTING*.md` for any
    residual brand-as-product-modifier phrasing).
@@ -108,5 +151,5 @@ If Tracer / Anthropic IP enforcement files another complaint against v3.5.34:
 
 Drafts are queued in `store-assets/promotion/` (see `x-thread-italian.md` and
 `plugin-directory-submission.md`). Do not post until the CWS listing reflects
-v3.5.34 — posting before would point users at a listing missing all the work
+v3.5.39 — posting before would point users at a listing missing all the work
 the post talks about.
@@ -76,7 +76,7 @@ Ctrl+Shift+S (チューター切替)、Ctrl+Shift+F (フラッシュカード)
 
 対応講座
 anthropic.skilljar.com に現在公開されている 18 講座すべて。新しい講座が追加されると 48 時間以内に用語辞書が更新されます（オープンソースのドリフトウォッチャーが新しい slug を検出すると自動的に issue を起票）。コース名は互換性説明のための記述的な参照です:
-Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
+Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Fluency for Small Businesses · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━
 

@@ -76,7 +76,7 @@ Ctrl+Shift+S (튜터 토글), Ctrl+Shift+F (플래시카드), Ctrl+Shift+L (다
 
 지원 강의
 anthropic.skilljar.com 에 현재 공개된 18개 강의 전체. 새 강의가 추가되면 48시간 안에 용어 사전을 추가합니다(오픈 소스 드리프트 워처가 새 slug를 발견하면 자동으로 이슈를 엽니다). 강의 이름은 호환성 설명을 위한 서술적 참조입니다:
-Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
+Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Fluency for Small Businesses · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━