docs: release review fixes: the licence host per version, one legal date, the changelog cut to 0.1.0

CHANGELOG.md

@@ -1,6 +1,15 @@
 # Changelog
 
-## Unreleased
+From this release the site's versions are its git tags, under the org's
+versioning policy: each merge into `staging` is a patch tag (from
+v0.0.1, 2026-10-04), each release to `main` the next minor. The 3.x and 2.x
+numbers below were the site's earlier, hand-kept numbering and are retired; the
+`version` in package.json is not the release version.
+
+## 0.1.0 — 2026-10-07
+
+Released with the Toddle Enhancement Extension 0.9.0, which is in Chrome Web
+Store review; the site describes it as the next version until it is live.
 
 ### Added
 
@@ -18,12 +27,26 @@
 
 ### Changed
 
+- **0.9.0's last changes, on the Releases page and the legal pages.** Text
+  and icons at the right size on Toddle, a flag's text drawn from its
+  Markdown, the Excusals tab's Time out column, and a licence key that
+  follows the teacher's own Chrome account (also kept in Chrome's synced
+  storage, never sent to Nyuchi). Every page that said the key stays on the
+  device says so; the wording lives once, in `licenceSync`
+  (`src/data/legal.ts`). The pricing section shows individual licence holders
+  the upgrade: code BXXF20VA, US$7 off the organisation licence only.
+- **One account of 0.9.0 across the site.** The gradebook's toolbar and the
+  Attendance dashboard's details run in closed shadow roots in 0.9.0 on every
+  page; the 6 October review's fixes reach schools in 0.9.0; each version
+  difference says from which version.
+- **A release to `main` is tagged as the next minor** (`main-version.yml`,
+  the org's reusable auto-tag, with a GitHub release).
 - **The licence server's address is `licenses.nyuchi.com`.** The privacy
   policy, the data and security pages, the vulnerability disclosure scope,
   the extension page's allowlist note, llms.txt and SECURITY.md name the new
-  host for the daily check for cancelled keys, and say that earlier versions
-  of the extension ask `licences.nyuchi.dev`, the same server, which still
-  answers. The legal pages' date moves to 7 October 2026.
+  host for the daily check for cancelled keys from version 0.9.0, and say
+  that 0.8.2, on the store today, asks `licences.nyuchi.dev`, the same
+  server, which still answers. The legal pages' date moves to 7 October 2026.
 - **@bundu/ui 0.5.0** (was 0.1.1): the kit's updated tokens. The page
   background is a cooler, neutral off-white; layout, type, buttons and the
   Nyuchi brand colours are unchanged. Every check and test passes as before.
@@ -63,7 +86,8 @@
     Toddle's admin portal. My classes switches on and off at once.
   - For schools: the Admin console, Group Policy, Intune and macOS steps,
     the organisation key pasted in once by each teacher, and allowing
-    `licences.nyuchi.dev`, summarised on the extension page; the full guide
+    the licence server (now `licenses.nyuchi.com`, and `licences.nyuchi.dev`
+    for 0.8.2), summarised on the extension page; the full guide
     on request. A link to the help centre's "How to use" collection.
   - The data schema (the extension's `docs/data-schema.md`) is described on
     the data handling page and the extension page, available on request.
@@ -82,7 +106,9 @@
   PDPA is no longer named. The facts live once, in `dataProtection`
   (`src/data/legal.ts`).
 - **The legal pages match the extension's code, for 0.8.2 and 0.8.4**, and
-  are dated 6 October 2026. Checked against the extension's data schema
+  were dated 6 October 2026. (Superseded within this release: the pages now
+  describe 0.9.0, say flags are concealed rather than hidden, and are dated
+  7 October 2026; see the entries above.) Checked against the extension's data schema
   (`docs/toddle-data-fields.md`) and its code:
   - Student flags: from 0.8.4 they are shown as Toddle shows them, and the
     free switch hides them everywhere; versions before 0.8.4 hid them by

README.md

@@ -9,7 +9,7 @@
 ![Astro](https://img.shields.io/badge/Astro-7-BC52EE?style=flat-square&logo=astro&logoColor=white)
 ![Vercel](https://img.shields.io/badge/Vercel-deployed-000000?style=flat-square&logo=vercel&logoColor=white)
 
-**Version:** 3.0.0 | **Live:** [learning.nyuchi.com](https://learning.nyuchi.com) | **Default branch:** `main` | **Deploy:** Vercel
+**Version:** the latest git tag (see [CHANGELOG.md](CHANGELOG.md)) | **Live:** [learning.nyuchi.com](https://learning.nyuchi.com) | **Default branch:** `main` | **Deploy:** Vercel
 
 ---
 

public/llms.txt

@@ -81,7 +81,8 @@ community-based platforms. Nyuchi Web Services is its development division.
   processed by Formspree; no student data, no page address, no licence key.
   (2) Only while a licence is entered, at most once a day, the background
   worker makes one plain request to https://licenses.nyuchi.com/v1/revocations
-  (licences.nyuchi.dev, the same server, for earlier versions),
+  (from version 0.9.0; version 0.8.2, on the store today, asks
+  licences.nyuchi.dev, the same server),
   sending no licence key, no identifiers, no cookies and no Toddle data; it
   downloads a Nyuchi-signed list of SHA-256 fingerprints of cancelled keys
   and checks its own key locally. Cloudflare sees the IP address as with any
@@ -135,7 +136,7 @@ community-based platforms. Nyuchi Web Services is its development division.
 
 ## Legal
 
-All dated 6 October 2026. Operated by Nyuchi Web Services, the development
+All dated 7 October 2026. Operated by Nyuchi Web Services, the development
 division of Nyuchi Africa (Private) Limited, Harare, Zimbabwe.
 
 - [Privacy policy](https://learning.nyuchi.com/legal/privacy): what the

src/data/legal.ts

@@ -61,7 +61,7 @@ export const dataProtection = {
   },
 } as const;
 
-/** The date above as people write it: "6 October 2026". */
+/** The date above as people write it: "7 October 2026". */
 export const updatedLabel = new Date(
   `${legal.updated}T00:00:00Z`,
 ).toLocaleDateString("en-GB", {
@@ -246,8 +246,7 @@ export const extensionDataFacts = [
   {
     claim:
       "Outside connection two, only while a licence is entered: a daily check for cancelled keys.",
-    detail:
-      "At most once a day, and only while a licence key is entered, the extension's background worker makes one plain request to https://licenses.nyuchi.com/v1/revocations (earlier versions ask licences.nyuchi.dev, the same server); a key just entered is checked within 5 minutes. It sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, checks its own key against that list on your machine, and keeps only the result. Cloudflare, which runs the server, sees your IP address as with any web request; Nyuchi does not log it. If the list cannot be fetched, the last result stands, so a network outage never switches a licence off.",
+    detail: `At most once a day, and only while a licence key is entered, the extension's background worker makes one plain request to https://licenses.nyuchi.com/v1/revocations (from version ${next}; version ${current}, on the Chrome Web Store today, asks licences.nyuchi.dev, the same server); a key just entered is checked within 5 minutes. It sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, checks its own key against that list on your machine, and keeps only the result. Cloudflare, which runs the server, sees your IP address as with any web request; Nyuchi does not log it. If the list cannot be fetched, the last result stands, so a network outage never switches a licence off.`,
   },
   {
     claim: "Exports are local.",

src/pages/legal/data.astro

@@ -247,7 +247,8 @@ const subprocessors = [
       <li>
         <strong class="text-foreground">A daily check for cancelled keys,</strong> only while
         a licence is entered: one plain request from the extension's background worker to
-        <code class="break-all">https://licenses.nyuchi.com/v1/revocations</code> (earlier versions ask
+        <code class="break-all">https://licenses.nyuchi.com/v1/revocations</code> (from version
+        {extensionVersions.next}; version {extensionVersions.current}, on the store today, asks
         <code>licences.nyuchi.dev</code>, the same server), sending no licence key, no
         identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of
         the SHA-256 fingerprints of cancelled keys and checks its own key locally. Cloudflare

src/pages/legal/privacy.astro

@@ -142,8 +142,8 @@ const description =
       <li>
         <strong class="text-foreground">What is sent.</strong> One plain request to
         <code class="break-all">https://licenses.nyuchi.com/v1/revocations</code>, from the extension's
-        background worker (earlier versions ask <code>licences.nyuchi.dev</code>, the
-        same server). It carries no licence key, no identifiers, no cookies and no
+        background worker (from version {security.next}; version {security.version}, on the
+        store today, asks <code>licences.nyuchi.dev</code>, the same server). It carries no licence key, no identifiers, no cookies and no
         Toddle data.
       </li>
       <li>

src/pages/legal/security.astro

@@ -314,7 +314,8 @@ const severityClass: Record<string, string> = {
       <li>
         <strong class="text-foreground">A daily check for cancelled keys.</strong> At most
         once a day, only while a licence is entered, the background worker makes one plain request
-        to <code class="break-all">https://licenses.nyuchi.com/v1/revocations</code> (earlier versions ask
+        to <code class="break-all">https://licenses.nyuchi.com/v1/revocations</code> (from version
+        {extensionVersions.next}; version {extensionVersions.current}, on the store today, asks
         <code>licences.nyuchi.dev</code>, the same server). It
         sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a
         list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, and

src/pages/toddle-enhancement-extension.astro

@@ -199,7 +199,7 @@ const facts = [
   {
     label: "Its two outside connections",
     value:
-      "The Send feedback form, only when you press Send: what you typed and the version number, to our feedback form, processed by Formspree. And, only while a licence is entered, at most one request a day to licenses.nyuchi.com for a signed list of cancelled keys' fingerprints, which sends no key, no identifiers and no Toddle data; if it fails, the last result stands.",
+      `The Send feedback form, only when you press Send: what you typed and the version number, to our feedback form, processed by Formspree. And, only while a licence is entered, at most one request a day to licenses.nyuchi.com (licences.nyuchi.dev, the same server, in version ${extensionVersions.current}, on the store today) for a signed list of cancelled keys' fingerprints, which sends no key, no identifiers and no Toddle data; if it fails, the last result stands.`,
   },
   {
     label: "What it stores",
@@ -513,8 +513,8 @@ const schema = [
           it to staff; each teacher pastes it in once, from the welcome page or the
           toolbar menu's <em>Enter a licence key</em>. If your network filters outbound
           traffic, allow <code class="text-foreground">{toddleExtension.licenceHost}</code>
-          (and <code class="text-foreground">licences.nyuchi.dev</code>, which earlier versions
-          ask) so the daily check for cancelled keys can run. If it is blocked, licences keep
+          (and <code class="text-foreground">licences.nyuchi.dev</code>, which version
+          {extensionVersions.current}, on the store today, asks) so the daily check for cancelled keys can run. If it is blocked, licences keep
           working on the last result.
         </p>
         <p class="mt-3 text-body-sm text-muted-foreground text-pretty">