fix(citations): repair 4 drifted performance sources

src/content/spec/performance/http1-workarounds.md

@@ -15,9 +15,9 @@ sources:
   - title: "MDN — Evolution of HTTP"
     url: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Evolution_of_HTTP"
     publisher: "MDN"
-  - title: "web.dev — HTTP/2 and you"
-    url: "https://web.dev/articles/performance-http2"
-    publisher: "web.dev"
+  - title: "MDN — Connection management in HTTP/1.x"
+    url: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Connection_management_in_HTTP_1.x"
+    publisher: "MDN"
 ---
 
 ## What it is

src/content/spec/performance/no-vary-search.md

@@ -9,9 +9,9 @@ appliesTo: [all]
 relatedSlugs: [cache-control, canonical-url, speculation-rules, view-transitions, url-structure]
 updated: "2026-07-09T00:00:00.000Z"
 sources:
-  - title: "No-Vary-Search — WICG editor's draft"
-    url: "https://wicg.github.io/nav-speculation/no-vary-search.html"
-    publisher: "WICG"
+  - title: "draft-ietf-httpbis-no-vary-search — The No-Vary-Search HTTP Caching Extension"
+    url: "https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-no-vary-search"
+    publisher: "IETF"
   - title: "MDN — No-Vary-Search"
     url: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/No-Vary-Search"
     publisher: "MDN"

src/content/spec/performance/resource-hints.md

@@ -7,11 +7,11 @@ status: recommended
 order: 100
 appliesTo: [all]
 relatedSlugs: [preload-prefetch-preconnect, early-hints, font-loading, critical-css]
-updated: "2026-06-18T00:00:00.000Z"
+updated: "2026-07-23T00:00:00.000Z"
 sources:
-  - title: "W3C — Resource Hints"
-    url: "https://www.w3.org/TR/resource-hints/"
-    publisher: "W3C"
+  - title: "WHATWG HTML — Link types"
+    url: "https://html.spec.whatwg.org/multipage/links.html#linkTypes"
+    publisher: "WHATWG"
   - title: "MDN — <link>: The External Resource Link element"
     url: "https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/link"
     publisher: "MDN"
@@ -25,7 +25,7 @@ sources:
 
 ## What it is
 
-Resource hints are `<link rel>` declarations that tell the browser to do work earlier than the HTML parser would otherwise discover it. The W3C Resource Hints specification defines four; HTML adds two more (`preload`, `modulepreload`).
+Resource hints are `<link rel>` declarations that tell the browser to do work earlier than the HTML parser would otherwise discover it. All five live in one place: the WHATWG HTML Standard's link types. There is no separate "Resource Hints" specification any more — the W3C document of that name was discontinued and its URL now redirects into HTML.
 
 | Hint | What it does | Use when |
 |---|---|---|

src/content/spec/performance/server-timing.md

@@ -10,7 +10,7 @@ relatedSlugs: [core-web-vitals, cache-control, conditional-requests]
 updated: "2026-06-18T00:00:00.000Z"
 sources:
   - title: "Server Timing — the Server-Timing header field"
-    url: "https://w3c.github.io/server-timing/#the-server-timing-header-field"
+    url: "https://www.w3.org/TR/server-timing/#the-server-timing-header-field"
     publisher: "W3C"
   - title: "MDN — Server-Timing"
     url: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing"
@@ -58,5 +58,5 @@ for (const { name, duration, description } of nav.serverTiming) {
 ## Common mistakes
 
 - **Expecting cross-origin metrics to appear in JavaScript.** `PerformanceServerTiming` is same-origin only. For a CDN or third-party host, the response must send [`Timing-Allow-Origin`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Timing-Allow-Origin) naming your origin, or `nav.serverTiming` is empty — the DevTools display still works, but automated collection silently does not.
-- **Leaking infrastructure detail.** The header is visible to anyone. Internal service names, query counts, and host identifiers are an information-disclosure surface; the [spec warns about this](https://w3c.github.io/server-timing/#privacy-and-security). Send coarse labels publicly, or gate richer metrics behind authentication.
+- **Leaking infrastructure detail.** The header is visible to anyone. Internal service names, query counts, and host identifiers are an information-disclosure surface; the [spec warns about this](https://www.w3.org/TR/server-timing/#privacy-and-security). Send coarse labels publicly, or gate richer metrics behind authentication.
 - **Sending it as a trailer expecting the Fetch API to read it.** `Server-Timing` as an HTTP trailer is consumed only by DevTools, not by `fetch()` or the Performance API.