Remove docs/hosted.md (superseded design note)

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to DirXMLDevWeb are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Removed
+
+- docs/hosted.md, the hosted-mode design note of 2026-10-05: its body described the design before it
+  was built (one shared vault bind, compare-page pull requests, no merging on the page, decisions
+  still open), and hosted-mode.md, hosted-install.md, security.md, multi-user.md,
+  git-workflow.md and pull-requests.md cover what was built. Git history keeps it. The audit log's
+  rotation, which it promised and which wasn't built, is issue #161.
+
 ## [0.74.0] - 2026-10-22
 
 Needs DirXMLDev 0.50.0.

README.md

@@ -146,7 +146,6 @@ for developing it or for a quick look at a tree. Upgrading an install is running
 | [docs/development.md](docs/development.md) | running from a checkout, layout, tests, releasing |
 | [docs/limits.md](docs/limits.md) | what still goes through Operations or the CLI |
 | [docs/design.md](docs/design.md) | the assessment and the phases |
-| [docs/hosted.md](docs/hosted.md) | the hosted-mode design and its decisions |
 | [docs/event-logger.md](docs/event-logger.md) | design note: the Event Logger integration: events as simulator cases, an Events view, the logger as a package |
 | [docs/connections-ui.md](docs/connections-ui.md) | design note: the Connections page: one flow per vault (address, certificate, sign-in, driver set), required before optional, certificate pinning, rotated passwords made obvious and easy |
 | [docs/trace-viewer.md](docs/trace-viewer.md) | design note: the DirXML Trace Viewer in the workbench: a shared trace library, live and file trace with colours, filters, find and links into the tree |

docs/design.md

@@ -196,7 +196,7 @@ Each is usable on its own and stops cleanly.
 | **W4 simulator** | Cases, run, stage-by-stage output, comparison against another tree or stage |
 | **W5 provisioning** | PRD flow diagram (read, then edit through `flow.*`), form builder embedded, roles and resources |
 | **W6 packages** | Status, install, upgrade, build |
-| **W7 hosted mode** | OIDC, workspaces as git clones, server-side secrets, per-user audit, commit and pull request from the UI. Designed in [hosted.md](hosted.md); decisions pending |
+| **W7 hosted mode** | OIDC, workspaces as git clones, server-side secrets, per-user audit, commit and pull request from the UI. Built: [hosted-mode.md](hosted-mode.md) (configuration), [hosted-install.md](hosted-install.md), [security.md](security.md), [multi-user.md](multi-user.md) |
 | optional | The static viewer; the CheerpJ simulator spike |
 
 W0 through W3 already replace the daily Designer loop for driver work. W2 and

docs/hosted-mode.md

@@ -7,7 +7,7 @@ install (`serve <tree>`, local mode) has none of this; docs/security.md sets the
 side. This page is the configuration
 reference for both; [quickstart.md](quickstart.md) sets it up for one person on localhost
 (`identity=token`), [hosted-install.md](hosted-install.md) for a team on a host
-(`identity=oidc`), [hosted.md](hosted.md) is the design.
+(`identity=oidc`).
 
 `bin/idmweb serve --hosted hosted.properties` runs the same server for a team: people sign in,
 each opens a **branch** of the team's git repository as a workspace of their own (a checkout
@@ -19,7 +19,7 @@ deploys come from the base branch only, as the repository holds it. The server h
 definitions (`environments.file`, no secrets) with the driver secrets beside them, and each
 person's bind DN and password in their own file under `data.dir/users/<subject>/`
 (docs/multi-user.md); it writes an audit line per sign-in, write, deploy, driver action, trace
-change, commit and push. Roles come from groups: *readers* look; *editors* read, edit and commit;
+change, commit and push (`data.dir/audit.log`, not rotated yet: issue #161). Roles come from groups: *readers* look; *editors* read, edit and commit;
 *deployers* also deploy, control drivers, set trace levels and read the engine's trace file, and
 change the shared environments and driver secrets. Watching a live trace is open to anyone
 signed in.