Reject unknown fields in every proto struct and bound Timestamp

Implemented-By: Laguna S 2.1 (OpenCode)

crates/proto/tests/ids.rs

@@ -100,7 +100,7 @@ fn hash32_rejects_wrong_length_uppercase_and_non_hex() {
 
 #[test]
 fn timestamp_has_one_spelling() {
-    let t = Timestamp::from_unix_millis(1_789_632_300_000);
+    let t = Timestamp::from_unix_millis(1_789_632_300_000).unwrap();
     assert_eq!(t.unix_millis(), 1_789_632_300_000);
     assert_eq!(t.to_rfc3339(), "2026-09-17T08:05:00.000Z");
     assert_eq!(Timestamp::parse("2026-09-17T08:05:00.000Z").unwrap(), t);
@@ -109,11 +109,13 @@ fn timestamp_has_one_spelling() {
         r#""2026-09-17T08:05:00.000Z""#
     );
     assert_eq!(
-        Timestamp::from_unix_millis(0).to_rfc3339(),
+        Timestamp::from_unix_millis(0).unwrap().to_rfc3339(),
         "1970-01-01T00:00:00.000Z"
     );
     assert_eq!(
-        Timestamp::from_unix_millis(1_789_632_300_007).to_rfc3339(),
+        Timestamp::from_unix_millis(1_789_632_300_007)
+            .unwrap()
+            .to_rfc3339(),
         "2026-09-17T08:05:00.007Z"
     );
 }
@@ -141,6 +143,29 @@ fn timestamp_rejects_other_spellings() {
     assert!(serde_json::from_str::<Timestamp>("1789632300000").is_err());
 }
 
+#[test]
+fn timestamp_range_ends_with_year_9999() {
+    assert_eq!(Timestamp::MAX.unix_millis(), 253_402_300_799_999);
+    assert_eq!(Timestamp::MAX.to_rfc3339(), "9999-12-31T23:59:59.999Z");
+    assert_eq!(
+        Timestamp::parse("9999-12-31T23:59:59.999Z").unwrap(),
+        Timestamp::MAX
+    );
+    assert_eq!(
+        Timestamp::from_unix_millis(253_402_300_799_999).unwrap(),
+        Timestamp::MAX
+    );
+    // One millisecond later has no RFC 3339 spelling, so it must not become a Timestamp at all.
+    assert_eq!(
+        Timestamp::from_unix_millis(253_402_300_800_000),
+        Err(ValueError::Timestamp)
+    );
+    assert_eq!(
+        Timestamp::from_unix_millis(u64::MAX),
+        Err(ValueError::Timestamp)
+    );
+}
+
 #[test]
 fn timestamp_now_is_after_2026() {
     assert!(Timestamp::now() > Timestamp::parse("2026-01-01T00:00:00.000Z").unwrap());