docs(plugin-webhooks): re-anchor the dead tracker citation to the commit that decided it (#20850)

Part of #20596
Clause-②: no

## What changed

This is the sixteenth stage of the `domain:services` lane of the
dead-citation sweep. It covers `packages/plugins/plugin-webhooks/src/**`
and nothing else. By the seat's claim (`5909908590`), it is the next of
the three single-site packages left in the lane, taken one package per
stage. Later stages cover the other packages, so this PR says `Part of`
and the card stays open.

Every comment or docblock site in scope that cited a tracker number
answering 404 has been rewritten in ruling C+D's form C (comment
5749154545 on #19123), by the method of stages 1 to 15 (the latest is PR
#20836, landed as `bbe03f406`). That is **1 site on 1 line in 1 file,
covering 1 number**:

- `src/translations/index.ts:26`, the census's one site in this package
at the base. No test comment, test string, source string or
gate-invisible spelling in this package carries a dead number (see the
supplementary reading below), so the census site is the whole
population.

The rewritten line now cites the commit in this repository that decided
what it describes: **1 commit sha**. No ADR or ruling record records
that decision (see the per-number table), so ruling C's commit rung
applies. No number was dropped.

Only a comment changed. The file keeps its line count (1 line out, 1
in), so no line citation into it moves. No code token moves (see the
guard below). **No citation number is added**: the only tracker number
on the added line is the live `#12069`, which already stood on it.

The rewritten line is byte-identical to the line the six sibling
translation sets already carry (`plugin-approvals:26`,
`plugin-audit:28`, `plugin-security:26`, `plugin-sharing:26`,
`service-messaging:29`, `service-storage:29`), landed by stages 1, 2, 4,
6, 7 and 9.

**No changeset.** The rewritten docblock does not reach `dist`, and
`dist` is byte-identical with and without the rewrite (see Changeset
below), so this PR takes `skip-changeset`.

## Census: `plugin-webhooks`, before and after

**Instrument (A1).** The gate's own `node
scripts/check-issue-citations.mjs --census --json`, read-only and
unchanged. The count below is its `allocated-but-absent` findings under
`packages/plugins/plugin-webhooks/`. Each run counts as a reading only
because its board frontier equals the newest issue or pull-request
number, read by a separate request just before and just after the run.

| reading | tree | board | whole-repo `allocated-but-absent` |
plugin-webhooks sites | lines | files | numbers |
|---|---|---|---|---|---|---|---|
| before | base `bbe03f406`, run 2026-09-30T11:09:05Z to 11:12:38Z |
enumerated, 187 pages, frontier #20841 (newest #20841 before and after)
| 748 | **1** | 1 | 1 | 1 |
| after | head `01312906e`, run 11:26:38Z to 11:30:05Z | enumerated, 187
pages, frontier #20843 (newest #20842 before; #20843 after, a pull
request opened 11:29:02Z inside the run, so the frontier equals the
newest at the run's end) | 747 | **0** | 0 | 0 | 0 |

The whole-repo drop is 1, exactly this diff's census site. The
`resolves` tally is 33,194 in both runs, and `resolves-as-pull-request`
(1,985) and `cross-repo-unjudged` (1,018) did not move either. Neither
run was truncated or discarded: both enumerations read 187 pages at the
newest frontier. The seat's census counted 1 here at `6bff748b`, and the
base agrees: `6bff748b` is an ancestor of the base, and the one commit
between them that touches this package's `src` (`7184436a4`, a
re-translation of generated object leaves) does not touch
`translations/index.ts:26`.

**Supplementary instrument, the whole scope.** The census does not read
test files or strings. So a second reading runs the gate's own exported
`extractCitations` (whole-file and comment-prose projections) and
`namesThisRepository` over every `.ts` file under `plugin-webhooks/src`
(34 files). It takes its verdicts from the before census's own board
reading rather than from a second enumeration: a number is dead when
that census reported it `allocated-but-absent`, and alive when the
gate's own census-scope extraction judged it and the census did not
report it. 4 numbers are covered by neither, because they stand only in
test files. Each was read on its own through the read-only tools:
`#10619` answers as an issue; `#8556`, `#13565` and `#15687` answer as
pull requests. The probe's controls: `#11671` and the known issue
`#10619` answer 404 on the pull-request endpoint.

| reading | citations | dead | src comment | test comment | src string |
test string |
|---|---|---|---|---|---|---|
| before, `bbe03f406` | 369 | **1** | 1 | 0 | 0 | 0 |
| after, `01312906e` | 368 | **0** | 0 | 0 | 0 | 0 |

Its src-comment column equals the census's 1, which is the control on
the second instrument. The 368 live citations are the same in both
readings (363 by the census's judgement, 5 by the single reads), none is
cross-repo, none is unjudged, and the drop of 1 citation is exactly the
rewritten site. A third, raw reading (every `#` followed by 2 to 6
digits, whatever surrounds it) finds 378 occurrences before and 377
after, the same drop of 1. The 9 tokens beyond the gate's grammar are
the same before and after, and none is dead (see Acceptance notes).

## Per-number table

Sites and files count every dead occurrence in scope at the base
(comments and strings, tests included).

| number | sites / files | rewritten / left | anchor: what it decided |
|---|---|---|---|
| `#11671` | 1/1 | 1/0 | `09b4f4e4e` (PR #12557): the extract command's
`--source-hashes` option writes a per-locale provenance companion,
`LOCALE.source-hashes.generated.ts`, beside the generated translation
bundles, recording for each leaf the source revision it is still a byte
copy of, per maintainer ruling #12069 Option A. That is exactly what
`:25-26` say. Its message names `#12069` but not `#11671`; its own diff
names `#11671` on 16 added lines, the first of them its changeset's
headline. `git blame` puts `:26` in `30928a615` (PR #12724, which wires
the serving-time read of that companion into all nine bundle sets), a
descendant of the anchor. Reused: stages 1, 2, 4, 6, 7 and 9 gave the
identical line in six sibling packages this anchor |

The sha matches exactly one commit (`git rev-parse --disambiguate`,
count 1) and is an ancestor of the base (`merge-base --is-ancestor`,
exit 0; reverse leg, base against the anchor, exit 1; control legs exit
0: stage 1's landing `422db788a`, and the repository's root commit,
15,200 commits deep against the anchor's 3,802; the history is complete,
`--is-shallow-repository` false, 15,201 commits). `#11671` answers 404
on the issues endpoint and on the pull-request endpoint, read one by
one.

No ADR, `scripts/adr-anchors/` file or ruling record names `#11671`,
`#12069` or the source-hash companion (`git grep` over `docs/adr` and
`scripts/adr-anchors`: one unrelated `source-hash cache` hit in
ADR-0080), so ruling C's first rung is empty.

## Wordings to check

- **Tag swap in place.** 「(maintainer ruling #12069 Option A, #11671)」
became 「(maintainer ruling #12069 Option A, commit 09b4f4e)」. It is
the form, and the byte-identical line, the six sibling translation sets
carry.

## Sites left

- **In `src`: none.** No test title, assertion message, operator log
string, runtime refusal, quoted maintainer ruling or generated file in
this package carries a dead number.
- **Outside `src`, listed and left, not edited in this stage:**
- `scripts/i18n-extract.config.ts:17` names the dead `#11671` (beside
the live `#12069`); the anchor for whoever next edits it is `09b4f4e4e`.
The file is outside `files[]` and outside the census surface.
- `tsconfig.scripts.json:1` names the dead `#11351` (404 on the issue
and pull-request endpoints).
- `tsconfig.test.json:3` and `:56` name the dead `#13176` (404 on both
endpoints; stage 4 measured it dead).
- The other numbers in those files and in `vitest.config.ts` are live:
`#12069`, `#12559`, `#10868`, `#10756`, `#5475`, `#14062`, `#5286`,
`#5449`, `#12542`, `#10772`, `#10374`, `#12642`.
  - The release-owned `CHANGELOG.md` names `#11671` on 2 lines.
- `package.json`, `tsconfig.json` and `tsup.config.ts` name none.
`files[]` lists `README.md`, but the package has none.

## Mechanical guard: no code token moves

The guard compares, base `bbe03f406` against head, over the one touched
`.ts` file:

- **Reading 1**, the TypeScript parser's leaf nodes (a `forEachChild`
walk, so comments are trivia and JSDoc nodes are never visited). String
and template literals are therefore read in full.
- **Reading 2**, the full token stream in parser context (a
`getChildren` walk, so punctuation and keywords are included; JSDoc
nodes skipped).

Results:

- Real run at the head `01312906e`: 50 base leaf tokens, **0 files with
a token change** on either reading (exit 0).
- Comment control (「Recording alone changes nothing a user sees」 to 「...
alters ...」): 0 files changed, as expected (exit 0).
- Positive control, a code token renamed (`undefined,
zhCNGeneratedSourceHashes)` to `...SourceHashesX)`): DIFFER on the
identifier in both readings (exit 1).
- Positive control, a string-literal key changed (`'es-ES'` to
`'es-EZ'`): DIFFER on the string literal in both readings (exit 1).

Every mutation went through `scripts/ablation-replace.mjs` (wrap mode)
under a shell trap that restores by absolute path, and each landed
(anchor 1 to 0, blob changed). Each restore was proven byte-identical to
the HEAD blob (`929fa19989e2`), with `git diff HEAD` empty and a clean
tree afterwards.

## Changeset: none (`skip-changeset`)

`files[]` is `dist`, `README.md` and `CHANGELOG.md`, and the package is
not private. Measured on the built package (A3), after `pnpm --filter
'@objectstack/plugin-webhooks...' build` at `01312906e`, where the
package's own `tsup` ran and cleaned its output folder:

- The rewritten line, its whole docblock (`:22-55`, which sits on the
unexported `const enSource`) and the old number appear in no `dist` file
(0 in all 20, source maps included). Nor do its neighbours `:23`, `:25`,
`:27` and `:30`, or a never-written negative phrase.
- Positive controls, text that does ship: `WebhooksTranslations` from
this same file is in `index.js`, `index.cjs` and both translations
chunks (8), and `zhCNGeneratedSourceHashes` is in both translations
chunks (4). A docblock line of this package, `auto-enqueuer.ts:33`
(「Enqueue callback into the shared `service-messaging` HTTP outbox
(ADR-0018 M3).」), is in `index.d.ts` and `index.d.cts`.
- **Byte identity.** The package was rebuilt with the base line put back
(through `scripts/ablation-replace.mjs`, with the file proven equal to
the base blob `686646fac51d` during the leg), and again after the proven
restore. The sha256 of all 20 `dist` files is identical in all three
builds: JS entries, declaration files, chunks and source maps.

So nothing this PR rewrites is published, and a changeset would announce
a change no consumer can observe. No `.changeset/*` file is added or
touched.

## Gates (head `01312906e`)

- **Citation judging, as CI runs it:** `node
scripts/check-issue-citations.mjs` exits 0 (「every citation this change
adds resolves」). `pnpm check:issue-citations` exits 0 (self-test, 114
cases, 8 batteries).
- **Doc authoring:** `pnpm check:doc-authoring` exits 0 (the
sibling-package prose-id baseline holds, no growth).
- **Derived gates:** `node scripts/pm/dispatch-gates.mjs --commands
--repo objectstack-ai/objectstack` at `01312906e` (change set derived
from git: 1 path against the merge base `bbe03f406`) derived 50
commands, all among the dispatch list's 65.
- All 65 of the dispatch list ran, each with its exit code captured
before any pipe, and all 65 exit 0; none exited 3.
- `--ran`, fed each command with its exit code, reports 50 derived, 50
run, 0 NOT MEASURED (a derived zero), 0 unrun, and exits 0.
- A full `turbo run build` over `./packages/*` and `./packages/*/*` ran
first under the shared verify lock (71 of 71 tasks), so no gate hit an
unbuilt workspace.
- **Roster families the derivation lists outside its commands** (their
rosters sit in a directory this diff touches): `pnpm
check:authz-resolver`, `pnpm check:error-code-casing` and `pnpm
check:filter-alias-parity`, plus `node
scripts/check-changeset-fixed.mjs`, which the dispatch named. Each exits
0.
- **Tests and typecheck, under the verify lock, at `01312906e`:**
- `pnpm --filter @objectstack/plugin-webhooks test`: 13 files pass and
160 tests pass, which is every tracked test file under `src/`.
- `pnpm --filter @objectstack/plugin-webhooks typecheck` exits 0, and
`tsc --noEmit --listFiles` puts the touched file in the program (the
config includes `src` and excludes no test file).
- `pnpm --filter @objectstack/plugin-webhooks check:test-typecheck`
exits 0 (0 files held in the package's debt ledger).
- **Lint, as a proven narrowing:** eslint with inline config disabled,
over the touched `.ts` file, gives 1 file, 0 errors and 0 warnings (its
`--format json` output). The file is in eslint's own population (not
reported ignored; `dist/index.js`, the control, reads ignored).
`eslint.config.mjs` never enables type-aware linting (no
`parserOptions.project`, as its own lines 327-328 state), so a comment
edit here cannot move the verdict on any untouched file. The repo-wide
`pnpm lint` is CI's run.
- **Control bytes:** `pnpm check:nul-bytes` exits 0, and a raw scan of
the changed file for control bytes finds none.

## Acceptance notes

- **The gate-invisible spellings, grepped as the claim asked** (#20636,
including the `clause #N` position). At the base and at the head,
`#N-word` is on 0 lines. `#A/#B` is on 8 lines (8 second numbers), and
every second number is live: `#8022` (3 lines), `#7986` (2) and `#8043`
(2) by the census's own judgement, and `#8565` read on its own as a pull
request. `option #N`, `clause #N` and URL-spelled links are on 0 lines.
So the claim's 0 / 8 / 0 / 0 / 0 hold, and nothing dead hides behind
them. The one other raw token beyond the grammar is `PD #12` at
`auto-enqueuer.ts:919`, a Prime Directive ordinal the extractor excuses
on purpose.
- **Outside-`src` residue.** Three dead numbers in files outside `src`
and outside `files[]` (`#11671`, `#11351`, `#13176`, listed above) are
left, as stages 13 to 15 left theirs. They ship nothing and move no
gate.
- **The census instrument did not truncate in this stage.** Both
enumerations read 187 pages at the newest frontier.
- **Anchor for the next stages:** `#11671` → `09b4f4e4e`.
`service-realtime/src/translations/index.ts:27` still carries the dead
number in the identical sentence.
- **Base.** The branch is on `main` at `bbe03f406`. `main` has since
moved five commits (to `688ddef3c`). None touches
`packages/plugins/plugin-webhooks`, `scripts/check-issue-citations.mjs`,
`scripts/pm/dispatch-gates.mjs` or `.changeset/config.json`. No merge
was taken; the merge queue rebuilds on the merged generation.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/plugins/plugin-webhooks/src/translations/index.ts

@@ -23,7 +23,7 @@ import { esESGeneratedSourceHashes } from './es-ES.source-hashes.generated.js';
  * ## The provenance companions are READ here, not merely recorded
  *
  * `os i18n extract --source-hashes` writes `<locale>.source-hashes.generated.ts`
- * beside these bundles (maintainer ruling #12069 Option A, #11671). A record
+ * beside these bundles (maintainer ruling #12069 Option A, commit 09b4f4e4e). A record
  * says: "this locale's leaf at that path is still a byte copy of THAT source
  * revision". Recording alone changes nothing a user sees — the substitution is
  * what {@link withSourceFallback} does, and until it was wired here this set