chore(docs): audit every screenshot for identity and branding leaks

[hokiepokedad2]

Pre-release housekeeping: an audit of every committed screenshot, and one duplicated changelog entry.

The screenshot audit — 70 of 70, checked visually

Two images were recently found carrying the deployment's site title and a real Discord avatar. The other 68 had never been looked at. All 70 have now been opened and inspected individually.

Six images leaked, across eight paths (areas.png and pokemon-add-dialog.png are byte-identical between docs/screenshots/ and the help assets). All six carried the "PoGO Alerts Network" title and the custom back-to-map nav link; four carried a real Discord avatar photo.

The avatar cases share one cause, and it is the finding worth recording: an earlier anonymisation pass pasted a grey circle about four pixels too small and offset up-left, leaving skin, hair and background visible in a crescent around the rim. It reads as clean at a glance, which is exactly why it survived a previous "these are anonymised" pass.

No real names anywhere. No hostnames — none of the images capture browser chrome.

How each was fixed

Three dialog shots were retaken on the dev instance with a self-minted anonymous token (username: Trainer, no avatarUrl), title reset and nav link removed before capture. Those also fix a staleness problem: their sidenav predated Pokéstop Events.

areas.png and both copies of user-menu.png got a toolbar-band splice instead — re-shooting areas.png would have traded a configured pin, three places and four selected areas for an empty-state page. The paste was verified to differ from the original in exactly three column runs (title text, nav icon, avatar) and nothing else.

Every produced image was read back and looked at.

A second pass, after bad test data was spotted

Two of the retakes captured a Pikachu card reading "IV 200-100%" — stray test data of mine on the dev account, created while verifying a v2 endpoint and wrongly believed not to have been written. Deleted (uid 36471).

The images were retaken with a sensible demo rule (Pikachu, min_iv: 90) which was removed afterwards; the account is back to zero pokemon rules. That sweep turned up a third affected file — assets/help/pokemon-add-dialog.png was a byte-identical copy of the old docs shot. The other 67 images are clean of the artifact.

Worth carrying to the upstream report: v2 accepted min_iv: 200 with a 200 and no complaint, when IV is 0–100.

The duplicated changelog entry

[Unreleased] carried two near-identical "The PoracleNG version compatibility page has been rewritten" bullets. They differed in one place: one said "5.1.0 versus 5.2.0 and newer", the other "5.1.0 versus 5.2.1".

Every capability gate in the code compares against 5.2.0. The 5.2.1 wording was the stale phrasing the documentation audit had specifically corrected, so deleting the wrong one would have reintroduced that error into the published release notes. The 5.2.0 variant is kept. 36 bullets, no duplicates.

Found but deliberately not acted on

Geography. Real locations appear far more widely than the one image previously flagged. Richmond, Virginia recurs across nine images by area name, and dashboard.png's coverage panel draws polygons over it with Lynchburg, Roanoke, Blacksburg and Petersburg labelled. Sharper: three images show street-level maps with legible road names in Glen Allen, VA, while the address caption beside them reads the fake "123 Main Street, Springfield, IL" — the caption was anonymised and the map underneath was not. Separately, areas.png and places-section.png show a San Francisco pin and three saved places at precise coordinates labelled parents, the gym and work.

None of that is on the current anonymisation list. It is a maintainer decision, not something to change silently.

A real UI inconsistency, filed separately: profiles.png shows "5 Duplicates" in the summary chip against "Duplicates 13" in the filter chip, on the same page at the same moment. Every other count on that screen reconciles.

Documentation quality, not leaks: dashboard-bottom.png and dashboard-weather.png are pixel-identical to dashboard.png despite their names; some images greet "DocUser" and others "Trainer"; and site titles vary across the set ("PoracleWeb.NET", "DM Alerts"), so the collection does not read as one instance.