docs: second release review fixes: what 0.9.0 reads, versioned flag claims, fixed review history

.github/workflows/staging-version.yml

@@ -18,6 +18,8 @@ permissions:
 
 jobs:
   version:
+    # Only staging: a manual run started from another branch tags nothing.
+    if: github.ref == 'refs/heads/staging'
     uses: nyuchi/.github/.github/workflows/reusable-staging-release.yml@924e5b4d0983d31379aedbec02b990793f29c792 # main, 2026-10-04
     with:
       bump: ${{ inputs.bump || '' }}

CHANGELOG.md

@@ -39,6 +39,13 @@ Store review; the site describes it as the next version until it is live.
   Attendance dashboard's details run in closed shadow roots in 0.9.0 on every
   page; the 6 October review's fixes reach schools in 0.9.0; each version
   difference says from which version.
+- **Second release review.** The 0.9.0 notes no longer say nothing new is
+  read (the data handling page lists each read, now including the teachers'
+  roles and photos the staff view shows); the flags summary, the search data
+  and the student privacy page say from which version flags are never hidden
+  and asked for each time; the first review's version is fixed at 0.8.2; the
+  terms and the product page say the cancelled-keys check is at most once a
+  day; the staging version workflow runs only on `staging`.
 - **A release to `main` is tagged as the next minor** (`main-version.yml`,
   the org's reusable auto-tag, with a GitHub release).
 - **The licence server's address is `licenses.nyuchi.com`.** The privacy

src/data/legal.ts

@@ -173,8 +173,7 @@ export const upgrade = {
  * Checked against the extension's SECURITY.md and docs/data-schema.md.
  */
 export const flags = {
-  summary:
-    "The extension never hides Toddle's own student flags: they show as Toddle shows them. When your screen is shown to a class, a parent or a visitor, one free switch conceals them across Toddle, so what a flag says cannot be read from across the room.",
+  summary: `From version ${next}, the extension never hides Toddle's own student flags: they show as Toddle shows them. When your screen is shown to a class, a parent or a visitor, one free switch conceals them across Toddle, so what a flag says cannot be read from across the room.`,
   reveal:
     'In the student sidebar, "Show flags" shows one student\'s flags when you need them.',
   limit:
@@ -203,7 +202,7 @@ export const extensionDataFacts = [
   {
     claim: "What it reads, feature by feature.",
     detail:
-      "Toddle answers with what the signed-in teacher's own account may see, and no more. The gradebook tools, when a teacher expands an assessment: its assessment tools as Toddle defines them (rubric criteria, descriptors and levels, grade scales and their colours, checklist items, scores, standards and learning goals), and each assigned student's name, email, student ID, submission status and results, including written responses and comments. No descriptor or level is written in the extension. The home page: each class's staff, to show its primary teacher and the My classes filter. A student's profile page: the teachers of each of the student's classes. The Attendance dashboard: each student's year group and the names of the periods, from Toddle's own request, and the primary teacher of the class each student is in now, for the “Now: class · teacher” line. The student sidebar, when a teacher opens a student or a class: the student's name, photo, year group and age (the date of birth is used to work out the age and is never shown), email, student ID and enrolment date; their family accounts and contacts, with names, relationships, phone numbers and emails; their homeroom advisor; the school's additional profile fields, of which only Student Group and Room number are ever shown; today's timetable and attendance marks; their active flags (see the next point); and each class's teachers, with their display titles and emails.",
+      "Toddle answers with what the signed-in teacher's own account may see, and no more. The gradebook tools, when a teacher expands an assessment: its assessment tools as Toddle defines them (rubric criteria, descriptors and levels, grade scales and their colours, checklist items, scores, standards and learning goals), and each assigned student's name, email, student ID, submission status and results, including written responses and comments. No descriptor or level is written in the extension. The home page: each class's staff, to show its primary teacher and the My classes filter. A student's profile page: the teachers of each of the student's classes. The Attendance dashboard: each student's year group and the names of the periods, from Toddle's own request, and the primary teacher of the class each student is in now, for the “Now: class · teacher” line. The student sidebar, when a teacher opens a student or a class: the student's name, photo, year group and age (the date of birth is used to work out the age and is never shown), email, student ID and enrolment date; their family accounts and contacts, with names, relationships, phone numbers and emails; their homeroom advisor; the school's additional profile fields, of which only Student Group and Room number are ever shown; today's timetable and attendance marks; their active flags (see the next point); and the teachers of each class, of today's blocks and of the homeroom, with their display titles, roles and emails, and their photos where Toddle gives them, which the sidebar's staff view shows when a teacher's name is clicked (it asks Toddle for nothing more).",
   },
   {
     claim:
@@ -277,7 +276,8 @@ export const security = {
     {
       date: "2026-10-01",
       label: "1 October 2026",
-      version: extensionVersions.current,
+      /** Fixed: review history does not move when `current` does. */
+      version: "0.8.2",
       findings: "1 to 12",
     },
     {

src/data/releases.ts

@@ -121,7 +121,7 @@ export const releases: Release[] = [
         items: [
           "The flags switch, the student sidebar, My classes and teacher names, the gradebook's toolbar and controls, and the Attendance dashboard's details now run in the extension's own part of the browser, inside closed shadow roots that no script on Toddle's page can read or click into. Whether each one runs is decided by your switches and licence, never by Toddle's page.",
           "Each rebuilt part was given its own security review on 6 October 2026, as were flag visibility and the sidebar's new staff and class views. Everything they found is fixed, each with a test. The Security page has the details.",
-          "Nothing new is read from Toddle, and the extension sends nothing new anywhere. The one change is Chrome's: it now syncs your licence key through your own Chrome account, never to Nyuchi.",
+          "Everything it reads, including what is new in this release, comes from Toddle, as you, and stays in your browser; the data handling page lists each read. The extension sends nothing new anywhere. The one change is Chrome's: it now syncs your licence key through your own Chrome account, never to Nyuchi.",
         ],
       },
     ],

src/pages/legal/data.astro

@@ -134,8 +134,10 @@ const subprocessors = [
         work out the age and is never shown), email, student ID, enrolment date, family
         accounts and contacts with relationship, phone numbers and email, homeroom advisor,
         the school's additional profile fields (only Student Group and Room number are ever
-        shown), today's timetable and attendance marks, and each class's teachers with
-        their display titles and emails.
+        shown), today's timetable and attendance marks, and the teachers of each class, of
+        today's blocks and of the homeroom, with their display titles, roles and emails, and
+        their photos where Toddle gives them, which the sidebar's staff view shows when a
+        teacher's name is clicked (it asks Toddle for nothing more).
       </li>
       <li>
         <strong class="text-foreground">Student flags.</strong> From version {extensionVersions.next}, the extension no longer hides Toddle's own flags, and a staff member can choose

src/pages/legal/security.astro

@@ -512,7 +512,7 @@ const severityClass: Record<string, string> = {
       that runs in Toddle's page against the claims made about it. It found two
       medium-severity issues and two low (findings {secondReview.findings}). All were fixed
       in version {secondReview.version}, and the fixes are in every release after it,
-      including {security.next}. None was in version {security.version}. Each later
+      including {security.next}. None was in version 0.8.2. Each later
       step of the rebuild (the student sidebar, the home page, the gradebook's toolbar and
       the Attendance dashboard's details) was reviewed the same way as
       it was made, and what those reviews found about the page's limits is set out below.

src/pages/legal/student-privacy.astro

@@ -86,7 +86,9 @@ const privacyMail = `mailto:${legal.privacyEmail}`;
       so what a flag says cannot be read from across the room. {flags.reveal}
     </p>
     <p class="mt-4 text-body text-muted-foreground text-pretty">
-      The sidebar reads a student's active flags from Toddle each time it opens, shows them
+      From version {extensionVersions.next}, the sidebar reads a student's active flags from
+      Toddle each time it opens. {flags.before} In that version, while flags are hidden, it
+      asks only when someone presses its eye button. The sidebar shows them
       in that teacher's browser only, and forgets them when it closes. They are never
       stored and never sent anywhere. {flags.limit}
     </p>

src/pages/legal/terms.astro

@@ -128,7 +128,7 @@ const description =
       address, and may also name who it is for: the buyer's email, for the Toddle account
       with that address, or for an organisation licence the school's email domain, for
       Toddle accounts on that domain. Where it does, the comparison happens in your browser
-      only. {licenceSync.short} While a key is entered, the extension downloads once a day a signed list of
+      only. {licenceSync.short} While a key is entered, the extension downloads at most once a day a signed list of
       cancelled keys, sending nothing about you; a key we have cancelled stops unlocking the
       licensed features once the extension has seen that list. If the check cannot be made,
       the last result stands, so a network outage never switches a licence off. When a key

src/pages/toddle-enhancement-extension.astro

@@ -233,7 +233,7 @@ const schema = [
     publisher: { "@id": "https://learning.nyuchi.com/#organization" },
     featureList: [
       "Expands every Toddle assessment tool into per-criterion columns",
-      "Conceals student flags across Toddle with one free switch, for a shared screen; never hides Toddle's own flags",
+      "Conceals student flags across Toddle with one free switch, for a shared screen; from version 0.9.0 never hides Toddle's own flags",
       "CSV export of results and submission status",
       "A My classes filter on the Toddle home page",
       "A student sidebar anywhere a student appears in Toddle: photo, grade, email, contacts, where they are now, today's timetable and attendance",
@@ -593,7 +593,7 @@ const schema = [
       automatically, usually within a minute of paying. It is checked on your own machine, so activating it contacts
       nothing and works offline — and one key covers your laptop and your classroom
       desktop. From version {extensionVersions.next} it follows your Chrome account, so you
-      enter it once; Chrome's sync carries it, and it is never sent to us. While a key is entered, the extension checks once a day for cancelled keys,
+      enter it once; Chrome's sync carries it, and it is never sent to us. While a key is entered, the extension checks at most once a day for cancelled keys,
       sending nothing about you.
     </p>
     <p class="mt-3 text-caption text-muted-foreground max-w-2xl text-pretty">