fix: refresh vendored data-connect tarballs and cross-repo pin

.github/cross-repo-pins.json

@@ -5,16 +5,16 @@
     "data-connect": {
       "owner": "PDP-Connect",
       "repo": "data-connect",
-      "sha": "9ef24d461dab0ee536abf4a15685c4b896d0d5be",
+      "sha": "9155e57ae47ab145214eb10551ed2c2185d7098a",
       "branch": "main",
-      "note": "Post-activation head of PDP-Connect/data-connect main as of 2026-08-20, verified via `gh api repos/PDP-Connect/data-connect/branches/main` at pin time. This is the merge commit of the activation PR (#29) that flipped consumer_pin_required false -> true in .github/consumer-drift-signal-config.json. Supersedes the prior b31bf312 pin (PR #26, move-r-collector-runtime): the branch field now points at main because the coordinated cutover is live and the consumer-side enforcement this pin backs (data-connect's own pin-required check) is active. Source of truth for drift jobs (a) collector-definitions snapshot, (b) vendored connector sources, (c) tarball digests."
+      "note": "Head of PDP-Connect/data-connect main as of 2026-08-20, verified via `gh api repos/PDP-Connect/data-connect/branches/main` at pin time. This is the merge commit of PR #30, which ports three hunks pdpp's own rebase of fix/preservation-fixes-0819 had dropped (bare-specifier package validation, iMessage fixture date fix, connector-spawn tsx-resolution hardening). Supersedes the prior 9ef24d46 pin (PR #29, consumer-pin-required activation): only packages/collector-runtime changed between the two pins (see this repo's vendor/SHA256SUMS refresh in the same PR that updated this field). Source of truth for drift jobs (a) collector-definitions snapshot, (b) vendored connector sources, (c) tarball digests."
     },
     "pdpp": {
       "owner": "PDP-Connect",
       "repo": "pdpp",
-      "sha": "a0924e9a4338550f945bd50a02fa1cf0cd4e8cec",
+      "sha": "5eacd82e2f9822b555bda869429b842be66b1ff7",
       "branch": "main",
-      "note": "Post-activation head of PDP-Connect/pdpp main as of 2026-08-20, verified via `gh api repos/PDP-Connect/pdpp/branches/main` at pin time. This is the merge commit of the activation PR (#170) that flipped consumer_pin_required false -> true in .github/consumer-drift-signal-config.json. Supersedes the prior dc5c878e pin (PR #155, move-r-pdpp-removal): the branch field now points at main because the coordinated cutover is live and the consumer-side enforcement this pin backs (pdpp's own pin-required check) is active. Source of truth for drift job (d) reference-contract stand-in comparison, and for the integration job's RI-server checkout."
+      "note": "Head of PDP-Connect/pdpp main as of 2026-08-20, verified via `gh api repos/PDP-Connect/pdpp/branches/main` at pin time. This is the merge commit of PR #171, which refreshed pdpp's own vendor/pdpp-collector-runtime-0.0.1.tgz to match data-connect's new pin above (both moves are part of the same coordinated data-connect PR #30 repin). Required here: drift job (c) (vendored tarball digests) checks pdpp's vendor/SHA256SUMS against a fresh repack from the data-connect pin too, and pdpp's tarball at the PRIOR a0924e9a pin predates PR #171, so it would fail that comparison without this move. packages/reference-contract (what this pin otherwise backs, for drift job (d)) did not change in PR #171. Supersedes the prior a0924e9a pin (PR #170, consumer-pin-required activation)."
     }
   }
 }

packages/polyfill-connectors/vendor/README.md

@@ -2,7 +2,7 @@
 
 `@pdpp/collector-runtime` and `@pdpp/connector-protocol` live in
 [PDP-Connect/data-connect](https://github.com/PDP-Connect/data-connect), pinned at commit
-`177adedcf169a03c3bd75c315304238aa1ccc181` (see `.github/cross-repo-pins.json`). This package
+`9155e57ae47ab145214eb10551ed2c2185d7098a` (see `.github/cross-repo-pins.json`). This package
 needs them at build/test time, but they are not published to any registry yet.
 
 ## Why a checked-in `.tgz`, not a git dependency
@@ -22,12 +22,12 @@ rejected outright rather than treated as a partial win.
 
 - `pdpp-collector-runtime-0.0.1.tgz` / `pdpp-connector-protocol-0.0.1.tgz`: built with
   `npm run build` then packed with `npm pack` from a clean checkout of
-  `PDP-Connect/data-connect@177adedcf169a03c3bd75c315304238aa1ccc181`, workspace packages
-  `packages/collector-runtime` and `packages/connector-protocol`. Resynced 2026-08-18 after
-  `check-tarball-digest-drift.sh`'s new content-manifest comparison (see that script's own
-  comment for why raw tarball digest equality across npm versions was replaced) caught the
-  previously-committed tarballs still carrying a stale `"prepare": "npm run build"` package.json
-  field that data-connect's own `ab2146c` removed before the pin above was set.
+  `PDP-Connect/data-connect@9155e57ae47ab145214eb10551ed2c2185d7098a`, workspace packages
+  `packages/collector-runtime` and `packages/connector-protocol`. Resynced 2026-08-20 to pick up
+  data-connect PR #30 (port of pdpp's dropped preservation-fixes-0819 hunks: bare-specifier
+  package validation, iMessage fixture date fix, connector-spawn tsx-resolution hardening).
+  Only collector-runtime's contents changed; connector-protocol's tarball is byte-identical to
+  the prior vendored copy.
 - `pdpp-reference-contract-0.0.1.tgz`: **not** the real `@pdpp/reference-contract` package.
   `@pdpp/collector-runtime`'s own `package.json` (inherited from the pnpm monorepo) declares
   `@pdpp/connector-protocol` and `@pdpp/reference-contract` as dependencies at bare `"*"`, which
@@ -79,7 +79,7 @@ rejected outright rather than treated as a partial win.
   `package-lock.json` once installed):
 
   ```
-  34443a3576f16c48049922fe53438e890cdfbbde67c0725a3a7fdca17ded042e  pdpp-collector-runtime-0.0.1.tgz
+  e78fecd8c4ef74860cbeb3eb356b6c738e396f8d00fee21d5fdb8269604215e5  pdpp-collector-runtime-0.0.1.tgz
   0173b91526c4ee5a8ebe8c8c67848758b4112d46cadbd72bb7cf1c90f5389905  pdpp-connector-protocol-0.0.1.tgz
   b636fbddb849ea17d66c7e010d9773e97b922de653c54ab4d9d9ba0db53e0c9e  pdpp-reference-contract-0.0.1.tgz
   ```

packages/polyfill-connectors/vendor/SHA256SUMS

@@ -1,3 +1,3 @@
-34443a3576f16c48049922fe53438e890cdfbbde67c0725a3a7fdca17ded042e  pdpp-collector-runtime-0.0.1.tgz
+e78fecd8c4ef74860cbeb3eb356b6c738e396f8d00fee21d5fdb8269604215e5  pdpp-collector-runtime-0.0.1.tgz
 0173b91526c4ee5a8ebe8c8c67848758b4112d46cadbd72bb7cf1c90f5389905  pdpp-connector-protocol-0.0.1.tgz
 b636fbddb849ea17d66c7e010d9773e97b922de653c54ab4d9d9ba0db53e0c9e  pdpp-reference-contract-0.0.1.tgz