Reject unknown fields in every proto struct and bound Timestamp

Implemented-By: Laguna S 2.1 (OpenCode)

crates/proto/src/audit.rs

@@ -23,6 +23,7 @@ pub enum DecisionRecord {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct AuditRecord {
     pub seq: u64,
     pub time: Timestamp,

crates/proto/src/ids.rs

@@ -128,8 +128,14 @@ fn hex_val(c: u8) -> Result<u8, ValueError> {
 pub struct Timestamp(u64);
 
 impl Timestamp {
-    pub fn from_unix_millis(ms: u64) -> Self {
-        Timestamp(ms)
+    /// 9999-12-31T23:59:59.999Z, the last instant RFC 3339 can spell with a four-digit year.
+    pub const MAX: Timestamp = Timestamp(253_402_300_799_999);
+
+    pub fn from_unix_millis(ms: u64) -> Result<Self, ValueError> {
+        if ms > Self::MAX.0 {
+            return Err(ValueError::Timestamp);
+        }
+        Ok(Timestamp(ms))
     }
 
     pub fn unix_millis(&self) -> u64 {
@@ -141,7 +147,7 @@ impl Timestamp {
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap_or_default();
         let ms = u64::try_from(dur.as_millis()).unwrap_or(u64::MAX);
-        Timestamp(ms)
+        Timestamp::from_unix_millis(ms).unwrap_or(Timestamp::MAX)
     }
 
     pub fn to_rfc3339(&self) -> String {
@@ -157,7 +163,7 @@ impl Timestamp {
             .duration_since(std::time::UNIX_EPOCH)
             .map_err(|_| ValueError::Timestamp)?;
         let ms = u64::try_from(dur.as_millis()).map_err(|_| ValueError::Timestamp)?;
-        let parsed = Timestamp(ms);
+        let parsed = Timestamp::from_unix_millis(ms)?;
         if parsed.to_rfc3339() != s {
             return Err(ValueError::Timestamp);
         }

crates/proto/src/log.rs

@@ -5,6 +5,7 @@ use serde::{Deserialize, Serialize};
 use crate::{CallId, DataClass, Epoch, Hash32, SessionId, Timestamp};
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ToolCall {
     pub id: String,
     pub name: String,