docs: the privacy claim gets stronger, so the documents have to say so

Removing BetterTTV took out the plugin's only outbound network call, and five
documents were still describing it as present. PRIVACY.md led with "one outbound
network call exists by design" -- the opposite of what shipped an hour ago, and
the one claim in that file people actually check.

PRIVACY.md now opens with none at all. The section that described the call is
kept and marked as removed rather than deleted, so the claim can be read against
what it replaced: the startup fetch meant BetterTTV saw an IP as soon as the
plugin loaded, whether an emote ever appeared or not. Worth leaving visible.
BetterTTV also comes out of the third-party table, which now lists only the two
parties nobody using this plugin through Dalamud can avoid.

SECURITY.md listed the EmoteCache HTTP client as in scope for reports. There is
nothing there to report on.

THIRD_PARTY_NOTICES.md named the call as current; both entries it has ever
carried are now historical.

README dropped the pointer to the outbound call and the switch for it, a
stability bullet about a crash fix in code that no longer exists, and the line in
the Chat 2 migration that moved an emote cache directory nothing reads.

ROADMAP gained 2.0.1 and 2.0.2, and a section for what the 2.0.0 push left
behind: 47 overlong comment blocks, channel names translated in only ten of the
25 languages, an orphaned EmoteCacheV1 directory on anyone who ran an older
build, and the deprecated GlobalScaleSafe call that is the last compiler warning
in the build.

docs/ROADMAP.md

@@ -12,6 +12,18 @@ be a poor fit for the plugin's privacy-first scope during brainstorming.
 
 ## Released
 
+**v2.0.2 — Emotes out, placeholders fixed (2026-08-19)** removed BetterTTV emote
+support entirely. Its shared-emote endpoint went behind authentication and that was
+where nearly all of them came from; what remained was 54 mostly static images, one
+of them animated at 492 frames. With it went the plugin's only outbound network
+call. Also fixed five settings descriptions that printed `{0}` instead of the
+plugin name, and replaced the preview images, which were older than every cycle in
+2.0.0.
+
+**v2.0.1 — Hotfix (2026-08-19)** lifted MessagePack to 3.1.7 and repaired the
+release workflow, which built the 2.0.0 archive successfully and then failed to
+attach it.
+
 **v2.0.0 — Rebuilt, Repaired, Reset (2026-08-19)** ships everything that was
 developed as v1.6.0 through v1.15.0. Those versions were never published on their
 own: the whole window layer was being rewritten from ImGui defaults to custom
@@ -66,6 +78,25 @@ follows.
 Native-speaker review of the AI-assisted v1.5.3 translations (13 legacy Crowdin locales) runs in
 parallel as a continuous correction pass, gathered via the Hellion Forge Discord.
 
+### Carried over from the 2.0.x cycle
+
+Small items that surfaced during the 2.0.0 release and were deliberately left for
+a later pass rather than rushed into a patch:
+
+- **Comment length.** 47 comment blocks run to 12 lines or more, the longest at 41.
+  The task codes and personal names came out in 2.0.0; trimming the long ones needs
+  judgement rather than a pattern, since several carry reasoning that is now the
+  basis of the style reference.
+- **Channel names are only translated in 10 of 25 languages.** Spanish had two of
+  three translated and one left in English, which was corrected. The other 15 sit
+  fully in English, which is correct for anyone on an English client — FFXIV ships
+  four client languages — but inconsistent where a language does have its own.
+- **An orphaned `EmoteCacheV1/` directory** stays on disk for anyone who ran a
+  version before 2.0.2. Nothing reads or writes it. A one-time cleanup on load
+  would be tidier than asking people to delete it by hand.
+- **`Metrics.Scale` uses the deprecated `ImGuiHelpers.GlobalScaleSafe`**, which is
+  the only compiler warning left in the build.
+
 ---
 
 ## v1.5.6 — Settings Overhaul + Filter & Notification Polish (released 2026-05-23)

docs/THIRD_PARTY_NOTICES.md

@@ -55,13 +55,12 @@ history, including the close of active cherry-picking in the v1.4.x cycle.
 ## Components that touch the network
 
 Of everything listed above, **none** of the bundled or NuGet components opens network connections on
-their own. All outbound traffic is initiated explicitly by HellionChat's own source files and is
-documented in `PRIVACY.md` under "Outbound network calls":
+their own, and as of v2.0.2 neither does HellionChat itself. Both calls this list used to name are
+gone:
 
-- `HellionChat/EmoteCache.cs` → BetterTTV API + CDN (opt-out via setting)
-
-The earlier Square Enix Lodestone font download (`FontManager.cs`) was removed in v1.0.4 — it was a
-leftover from upstream's removed webinterface feature and was no longer consumed.
+- `HellionChat/EmoteCache.cs` → BetterTTV API + CDN, removed in v2.0.2 along with the emote feature.
+- The Square Enix Lodestone font download (`FontManager.cs`), removed in v1.0.4 — a leftover from
+  upstream's removed webinterface feature that was no longer consumed.
 
 ---