[jcombs-pointblue]

The docs review's recommendations, all of them.

Removed (built; git history keeps them):

• architecture-view.md, trace-viewer.md, simple-install.md: features.md, quickstart.md and upgrading.md describe what was built.
• event-logger.md: its two unbuilt steps are now issues Event Logger as a catalog package (P1 of the event-logger plan) #164 (the logger as a catalog package) and Library resource pbt-eventlog.js: capture samples at a policy stage (R1 of the event-logger plan) #165 (pbt-eventlog.js).
• Pointers: code comments, the idmweb usage text, a test and the smoke script pointed at these notes. They now point at quickstart.md, features.md, or DirXMLDev's event-store.md. README rows removed.

Rewritten as user references:

• pull-requests.md: creating one, providers and settings, whose account (your token, else the project's with "Opened by"), token scopes, the workstation's gh / glab, roles and audit, and the API with its required fields and an example.
• multi-user.md: what's yours and what's shared, the files under data.dir/users/<subject>/ (now including Git and agent tokens), the start-up refusal, the page, the API (field names checked against CredentialService), and old trace recordings.

Corrected:

• data-model.md:

  • per-person connections, Git tokens and agent tokens as entities;
  • sessions;
  • the overrides file's drivers/<d>.name, servers.<name> and job keys;
  • overrides/<env>.known.json;
  • the per-object environments / planned lists;
  • the pinned certificate and fromAnyBranch.

  Also removes the "Per-person environments (Per-user or per-role vault environments #47) would add…" line (Per-user or per-role vault environments #47 is closed) and the claim that the bind password lives in the shared environments file.

• design.md: status W0–W7 built. A box marks it historical (the server is bin/idmweb serve, per-person vault access, agents). The W3 row no longer says rollback, secrets and driver deletion "stay with the CLI".

• connections-ui.md: a status line saying it's built (0.61.0, Connections screen is confusing: refactor the UI #131). Its layout rules still apply.

• limits.md: the trace view keeps 50,000 records and shows 15,000 by default, both adjustable. It used to say 5,000 lines.

• development.md: release assets include THIRD-PARTY.md; run the three smoke tests from main before tagging; the image build fetches DirXMLSimulator for sim and the agent kit.

• hosted-install.md: the old §6 is removed. It published Point Blue's lab in this public repo: internal IP, SSH user, Harbor robot account, Keychain item names, a stale 0.11.0 example. §1 already covers pushing to your own registry. Also: "the repository itself stays private" is removed (it's public), example tags are now <version>, and §7 becomes §6.

• README: doc table descriptions updated; design.md labelled historical.

Checks:

• every relative link and anchor in README, SECURITY.md and docs/*.md resolves (script);
• tsc, vitest (54) and mvn package pass;
• the Mermaid ER diagram is checked by its rendering on GitHub.

One reference outside this repo: DirXMLDev docs/event-store.md points at the removed event-logger note. That's fixed in a separate DirXMLDev PR.

🤖 Generated with Claude Code