The vendor’s call (public)

Where a CRM calls on change — the address the setup call handed out. Public by construction: the HMAC-signed address names the tenant and the connection, and the call is trusted the vendor’s way (HubSpot v3 signature, Pipedrive basic auth, Bitrix24 auth[application_token], Kommo / custom ?token= or X-Brain-Signature). The events name entity + id (+ deleted); the engine fetches those records through the records door as a queued source_sync job (202) — or inline without a queue (200, summary). The webhook never carries data into memory. 404 for an unknown address or a connection whose webhook is off; 401 for a call the scheme rejects. Records (docs/roadmap/crm-sources-2026-09.md): a CRM row enters as FACTS — its mapped attributes become deterministic candidates under the record’s own id, never prose a model re-extracts. Source plane operator surface (docs/roadmap/raw-evidence-sources-2026-09.md) — answers a bare 404 until SOURCE_PLANE_ENABLED=1.