fix(cpp): pin ThetaDataDxContract size and field offsets directly (#875)

The shared ThetaDataDxContract is embedded by value in every data event, but the generated C++ layout asserts pinned it only indirectly: each embedding event asserts the field after `contract` lands at offset 40, and the tagged wrapper asserts its embedded slot. A same-total-size permutation of the contract's internal fields would pass every existing assert yet silently misread contract.right, contract.strike, and contract.expiration on each event.

Emit direct static_asserts so the contract struct's total size AND every field offset are compile-time pinned to the Rust #[repr(C)] layout, the same way the tick mirrors are pinned in tick_layout_asserts.hpp.inc. The asserted numbers come from the generator's own align_to layout walk over a single contract field model, never hand-typed, so Rust and C stay locked together on regeneration.

Co-authored-by: preview <noreply@anthropic.com>

Author: userFRM

crates/thetadatadx/build_support_bin/fpss_events/cpp_asserts.rs

@@ -9,9 +9,37 @@
 use std::fmt::Write as _;
 
 use super::common::snake_case;
-use super::layout::{c_struct_offsets, c_struct_size, fpss_event_offsets, fpss_event_size};
+use super::layout::{
+    c_struct_offsets, c_struct_size, contract_field_offsets, contract_size, fpss_event_offsets,
+    fpss_event_size,
+};
 use super::schema::{sorted_control_events, sorted_data_events, EventDef, Schema};
 
+/// Emit direct size + per-field offset asserts for the shared
+/// `ThetaDataDxContract`. Every data event embeds this struct by value, so an
+/// internal field permutation that preserved the 40-byte total (swapping the
+/// `has_*` flags, say) would slip past the embedding events' offset asserts
+/// yet silently misread `contract.right` / `.strike` / `.expiration` on every
+/// tick. Pinning the contract's own size and each field offset closes that
+/// gap the same way the tick mirrors are pinned. Numbers come from the
+/// generator's layout walk, not hand-typed constants.
+fn render_contract_asserts(out: &mut String) {
+    writeln!(
+        out,
+        "static_assert(sizeof(ThetaDataDxContract) == {},\n              \"ThetaDataDxContract total size drifted\");",
+        contract_size()
+    )
+    .unwrap();
+    for (field_name, offset) in contract_field_offsets() {
+        writeln!(
+            out,
+            "static_assert(offsetof(ThetaDataDxContract, {field_name}) == {offset},\n              \"ThetaDataDxContract::{field_name} offset drifted\");"
+        )
+        .unwrap();
+    }
+    out.push('\n');
+}
+
 fn render_event_asserts(out: &mut String, event_name: &str, def: &EventDef) {
     let alias = format!("ThetaDataDxStream{event_name}");
     let field = snake_case(event_name);
@@ -54,6 +82,10 @@ pub(super) fn render_cpp_fpss_layout_asserts(schema: &Schema) -> String {
         "/* @generated DO NOT EDIT — regenerated by build.rs from fpss_event_schema.toml */\n\n",
     );
 
+    // Shared `ThetaDataDxContract` — pinned directly so an internal field
+    // permutation can't hide behind the embedding events' offset asserts.
+    render_contract_asserts(&mut out);
+
     // Per-variant struct asserts — data first, then control, mirroring
     // the Rust struct emission order in `ffi_rust.rs`.
     for (event_name, def) in sorted_data_events(schema) {

crates/thetadatadx/build_support_bin/fpss_events/layout.rs

@@ -27,6 +27,57 @@ pub(super) fn c_field_layout(ty: &str) -> CFieldLayout {
     }
 }
 
+/// Physical field layout of the shared `ThetaDataDxContract` struct, in
+/// C declaration order. The `Contract` column type is opaque to
+/// [`c_field_layout`] (it contributes a single 40-byte/align-8 slot to the
+/// embedding event structs), so the contract's own internal fields are
+/// modelled here once and consumed by both the size and per-field offset
+/// helpers. Keeping this list as the single source means the asserted
+/// numbers are computed by the same `align_to` walk that places every other
+/// FPSS field, never hand-typed. Order and widths mirror the C mirror in
+/// `ffi_c.rs::render_contract_struct_c` and the Rust `#[repr(C)]` struct in
+/// `ffi_rust.rs::render_contract_struct_rust`.
+fn contract_fields() -> [(&'static str, CFieldLayout); 9] {
+    [
+        // `const char* symbol` — borrowed NUL-terminated string pointer.
+        ("symbol", CFieldLayout { size: 8, align: 8 }),
+        ("sec_type", CFieldLayout { size: 4, align: 4 }),
+        // Tagged-optional `bool has_*` flags + their payloads. C has no
+        // `Option<T>`, so presence rides a leading `bool`.
+        ("has_expiration", CFieldLayout { size: 1, align: 1 }),
+        ("expiration", CFieldLayout { size: 4, align: 4 }),
+        ("has_right", CFieldLayout { size: 1, align: 1 }),
+        // `char right` — `'C'` / `'P'` (NUL when `has_right` is false).
+        ("right", CFieldLayout { size: 1, align: 1 }),
+        ("has_strike", CFieldLayout { size: 1, align: 1 }),
+        ("strike", CFieldLayout { size: 8, align: 8 }),
+        ("strike_thousandths", CFieldLayout { size: 4, align: 4 }),
+    ]
+}
+
+/// Byte offset of each `ThetaDataDxContract` field, computed by the same
+/// `align_to` walk as every other FPSS struct so the emitted asserts pin the
+/// contract's internal layout directly rather than inferring it from the
+/// embedding events.
+pub(super) fn contract_field_offsets() -> Vec<(&'static str, usize)> {
+    let fields = contract_fields();
+    let mut offsets = Vec::with_capacity(fields.len());
+    let mut size = 0;
+    for (name, layout) in fields {
+        size = align_to(size, layout.align);
+        offsets.push((name, size));
+        size += layout.size;
+    }
+    offsets
+}
+
+/// Total size, in bytes, of the shared `ThetaDataDxContract` struct, computed
+/// from [`contract_fields`]. Must equal the opaque 40-byte slot
+/// [`c_field_layout`] reserves for an embedded `Contract` column.
+pub(super) fn contract_size() -> usize {
+    c_layout(contract_fields().into_iter().map(|(_, layout)| layout))
+}
+
 /// Expand a schema column list into the physical C field layout. The
 /// only column type that splits into >1 physical fields is `Vec<u8>`
 /// which becomes `(<name>: *const u8, <name>_len: size_t)`.

sdks/cpp/include/fpss_layout_asserts.hpp.inc

@@ -1,5 +1,26 @@
 /* @generated DO NOT EDIT — regenerated by build.rs from fpss_event_schema.toml */
 
+static_assert(sizeof(ThetaDataDxContract) == 40,
+              "ThetaDataDxContract total size drifted");
+static_assert(offsetof(ThetaDataDxContract, symbol) == 0,
+              "ThetaDataDxContract::symbol offset drifted");
+static_assert(offsetof(ThetaDataDxContract, sec_type) == 8,
+              "ThetaDataDxContract::sec_type offset drifted");
+static_assert(offsetof(ThetaDataDxContract, has_expiration) == 12,
+              "ThetaDataDxContract::has_expiration offset drifted");
+static_assert(offsetof(ThetaDataDxContract, expiration) == 16,
+              "ThetaDataDxContract::expiration offset drifted");
+static_assert(offsetof(ThetaDataDxContract, has_right) == 20,
+              "ThetaDataDxContract::has_right offset drifted");
+static_assert(offsetof(ThetaDataDxContract, right) == 21,
+              "ThetaDataDxContract::right offset drifted");
+static_assert(offsetof(ThetaDataDxContract, has_strike) == 22,
+              "ThetaDataDxContract::has_strike offset drifted");
+static_assert(offsetof(ThetaDataDxContract, strike) == 24,
+              "ThetaDataDxContract::strike offset drifted");
+static_assert(offsetof(ThetaDataDxContract, strike_thousandths) == 32,
+              "ThetaDataDxContract::strike_thousandths offset drifted");
+
 static_assert(offsetof(ThetaDataDxStreamMarketValue, contract) == 0,
               "ThetaDataDxStreamMarketValue::contract offset drifted");
 static_assert(offsetof(ThetaDataDxStreamMarketValue, ms_of_day) == 40,