Improve WordPress.org listing and screenshots

Author: Tsvetan Stoychev

docs/audits/checklist.md

@@ -119,14 +119,16 @@ operator-journey defect, P3 = minor/polish.
   backoffice with a time expectation) and "No data is arriving" checklist
   (admin tracking off, consent mode with no adapter, wrong CookieYes
   category, stale caches). (UX 3 / BR-DOC-08, BR-DOC-09, walkthrough-06)
-- [ ] P2 Lifecycle docs: purge caches after disabling/deactivating (cached
+- [x] P2 Lifecycle docs: purge caches after disabling/deactivating (cached
   pages keep the loader; browser-cached HTML cannot be purged at all);
   what deactivation keeps vs uninstall removes; multisite
   guidance. (UX 8 / BR-DOC-13, BR-DOC-17, BR-DOC-18, BR-DOC-20)
-- [ ] P2 wp.org listing: add the four screenshots or drop the section;
-  fix Installation step order; add a Support section; align page-type
-  lists with the detector; replace the stock `plugins/basicrum/README.md`
-  stub. (privacy 6+7, UX 7 / DISC-08, DISC-09, BR-DOC-11, BR-DOC-14,
+- [x] P2 wp.org screenshots: add four current settings captures and matching
+  numbered `readme.txt` captions. (UX 7 / BR-DOC-11)
+- [x] P2 wp.org listing: fix Installation step order; add a Support section;
+  align page-type lists with the detector; replace the stock
+  `plugins/basicrum/README.md`
+  stub. (privacy 6+7, UX 7 / DISC-08, DISC-09, BR-DOC-14,
   BR-DOC-19)
 - [ ] P3 Soften or verify the "reviewed against Complianz" claim in the
   integrations README. (UX residual)

docs/audits/evidence.md

@@ -87,7 +87,7 @@ to the original privacy report:
 | CI-05 (UX 2, RESOLVED AFTER AUDIT) | major | `examples/integrations/cookieyes.js:4` | static | At audited ref: `sed -n '1,6p' examples/integrations/cookieyes.js` | At audited ref: `consentCategory='analytics'` was hard-coded with no warning in the file. Current packaged adapter includes the wrong-category warning. | medium |
 | BR-DOC-13 (UX 8) | major | no purge caveat on any shipped surface | static | `grep -ni 'purge\|cached' plugins/basicrum/readme.txt; echo exit=$?` | Exit 1; the non-shipped examples README does warn about cache clearing, the shipped surfaces do not | medium |
 | issue-http-strictness-inverted (UX 5, verifier-downgraded to minor) | minor | `Page.php:384,390`; `readme.txt:72-74` | static | `sed -n '384p;390p' plugins/basicrum/src/Admin/Settings/Page.php` | Label "HTTP Strictness" on a checkbox that relaxes strictness; readme FAQ repeats the inversion | medium |
-| BR-DOC-11 (UX 7, verifier-downgraded to minor) | minor | `readme.txt:76-81`; `wordpress-org-assets/` | static | `sed -n '76,81p' plugins/basicrum/readme.txt; ls wordpress-org-assets/` | Four screenshot captions, zero screenshot files in the repo | high |
+| BR-DOC-11 (UX 7, RESOLVED AFTER AUDIT) | minor | `readme.txt`; `wordpress-org-assets/` | static | `find wordpress-org-assets -maxdepth 1 -name 'screenshot-*.png'; sed -n '/== Screenshots ==/,/== Frequently Asked Questions ==/p' plugins/basicrum/readme.txt` | Current tree contains four WordPress 7.0.2 settings screenshots and four matching captions. | high |
 
 ## Runtime capture appendix
 

docs/audits/operator-experience-audit.md

@@ -124,27 +124,27 @@ settings screen. (issue-backoffice-unlinked, walkthrough-05, BR-DOC-16)
 
 ## 7. Repair the wp.org listing surfaces
 
-- [ ] readme.txt promises 4 screenshots; `wordpress-org-assets/` contains
-  none. Capture screenshot-1..4.png or remove the section. (BR-DOC-11)
-- [ ] Installation steps 4-5 are in the reverse order of the UI dependency
+- [x] Add four current settings screenshots to `wordpress-org-assets/` and
+  matching numbered captions to `readme.txt`. (BR-DOC-11)
+- [x] Installation steps 4-5 are in the reverse order of the UI dependency
   (fields unlock only after Enable is checked). (BR-DOC-14)
-- [ ] Add a Support section (wp.org forum, basicrum.com contact).
+- [x] Add a Support section (wp.org forum, basicrum.com contact).
   (BR-DOC-19)
-- [ ] Align page-type lists across surfaces with the detector (also privacy
+- [x] Align page-type lists across surfaces with the detector (also privacy
   audit item 6). (BR-DOC-22)
-- [ ] Replace the stock-template `plugins/basicrum/README.md` stub (also
+- [x] Replace the stock-template `plugins/basicrum/README.md` stub (also
   privacy audit item 7). (BR-DOC-21)
-- [ ] Keep the dev file `phpstan.neon.dist` out of the release ZIP.
+- [x] Keep the dev file `phpstan.neon.dist` out of the release ZIP.
   (BR-DOC-23)
 
 ## 8. Document the operating lifecycle
 
-- [ ] State that disabling or deactivating Basicrum does not immediately
+- [x] State that disabling or deactivating Basicrum does not immediately
   stop the script on cached pages; tell operators to purge page/CDN caches
   (documentation side of privacy audit item 3). (BR-DOC-13)
-- [ ] State what deactivation keeps (settings) and uninstall removes.
+- [x] State what deactivation keeps (settings) and uninstall removes.
   (BR-DOC-17)
-- [ ] Add multisite guidance; network activation leaves every subsite
+- [x] Add multisite guidance; network activation leaves every subsite
   unconfigured. (BR-DOC-20)
 
 ## 9. Small engineering fixes

docs/audits/wporg-submission-checklist.md

@@ -59,42 +59,39 @@ refuters. 84 claims audited: 52 clean, 24 upheld findings, 8 overturned.
   itself: self-hosted collectors need no account. Reword: collector
   endpoint + Brum Site ID required; hosted account is one way to get
   them. (R24, C04)
-- [ ] Vocabulary bridge: the compliance FAQ says "immediate and
+- [x] Vocabulary bridge: the compliance FAQ says "immediate and
   consent-controlled loading" while the settings radios say "Monitor
   without consent" / "Require consent before monitoring". Bridge both
-  vocabularies once, then use the radio labels. (C02)
-- [ ] Define the server-side nouns once: collector (receives beacons) vs
+  vocabularies once, then use the radio labels. Resolved by removing the
+  competing terminology. (C02)
+- [x] Define the server-side nouns once: collector (receives beacons) vs
   backoffice (dashboard where the Brum Site ID lives) vs account (hosted
-  option); "backoffice" is currently undefined jargon. (C15)
-- [ ] Disambiguate "Basicrum" = plugin vs company vs service in the
+  option); "backoffice" is currently undefined jargon. Resolved by using
+  collector, Beacon URL, and hosted service consistently. (C15)
+- [x] Disambiguate "Basicrum" = plugin vs company vs service in the
   query-string FAQ: data goes only to the operator-configured Beacon URL;
   the plugin makes no requests to basicrum.com. (C16)
-- [ ] HTTP Strictness FAQ still inverts the semantics (enabling
+- [x] HTTP Strictness FAQ still inverts the semantics (enabling
   "Strictness" relaxes enforcement). Rewrite the FAQ to lead with the
   default (auto-upgrade to HTTPS) and what the toggle actually allows;
   the label rename remains open from the operator-experience audit. (C08)
 - [ ] "eligible pages" in the contributed privacy-policy text
   (Privacy.php immediate-mode sentence) is undefined for site owners;
   spell out: frontend pages, admins excluded unless Track Admin Users.
   (C12)
-- [ ] Define "connected" CookieYes at first use (linked to the CookieYes
-  web app so its browser consent API is present). (C07)
-- [ ] Replace "fails closed" jargon: "keeps monitoring switched off until
-  its consent API reports a decision". (C19)
-- [ ] "How it works" step 2 orders enable-before-Site-ID, contradicting
-  Installation steps 4-5 and triggering the enabled-but-inactive notice;
-  align the order. (C22)
-- [ ] "after the configured Script Position" forward-references an
-  undefined setting; name it: Basicrum > Performance > Script Position
-  (header or footer). (C23)
+- [x] Define "connected" CookieYes at first use. Resolved by removing the
+  ambiguous implementation detail from the customer-facing overview. (C07)
+- [x] Replace "fails closed" jargon with plain language. (C19)
+- [x] Align the installation order with the enabled-field dependency and
+  remove the redundant "How it works" sequence. (C22)
+- [x] Remove the undefined Script Position forward reference from the
+  consent overview. (C23)
 
 ## 4. Optional but recommended
 
-- [ ] Screenshots: the section was correctly removed (no files existed),
-  but an image-free listing forces users to imagine the settings-driven
-  consent workflow. Capture screenshot-1..N.png using the exact current
-  labels (Visitor Consent, Consent Tool Connection) and restore a
-  matching section. (C24)
+- [x] Screenshots: four current WordPress 7.0.2 settings captures use the exact
+  Visitor Consent and Consent Tool Connection labels, privacy-safe example
+  values, and matching numbered captions in `readme.txt`. (C24)
 - [ ] Spot-check the two basicrum.com URLs (home, /contact/) resolve;
   reviewers click them. (R45)
 - [ ] CookieYes "modern ... runtime" - one refuter pair split on this;