fix(fpss): correct derived-bar accounting and escalate write failures to reconnect

[userFRM]

Three correctness and liveness fixes in the FPSS streaming path, each with a test that fails on the prior behavior.

Derived-bar double-count on trade corrections

An out-of-order trade correction carries a nonzero records_back: the print refers to a trade already reported earlier in the stream, so its size and trade are already inside the running bar. The derived OHLCVC accumulator never received that field, so every correction re-added its size and bumped the count, double-counting volume and trade count on the derive path. The accumulator now takes records_back; a correction adjusts only the high, low, and close, never volume or count. A correction also never opens a fresh bar. Two tests cover the new-high correction and the low-adjust-without-reset case, plus a fresh print after a correction resuming from the un-corrupted totals.

Swallowed write failures defer reconnect

Both command-drain paths logged a write failure and kept going. The steady-state drain then kept reading on a socket whose write side had broken, deferring recovery to the next read timeout while the queued subscribe or command was lost. The post-reconnect drain ran a session whose queued command never reached the server. Both now escalate a write error the same way the re-subscribe replay does: the in-session drain publishes Disconnected and breaks to the reconnect decision, and the post-reconnect drain re-enters the session loop.

Unbounded login handshake

The handshake looped on read with no wall-clock bound and an unbounded pending-control buffer. A peer streaming Connected/Ping/Restart without ever sending Metadata reset the per-read socket timeout on every frame and grew the buffer without limit, wedging the reconnect thread. The handshake now has a wall-clock deadline derived from the read timeout and a cap on buffered control frames, returning a timeout or protocol error past those limits. The clock is injected so the deadline case is tested deterministically; the cap case is exercised by flooding control frames.

Audit findings 2 reviewed, not a defect

The finding that a server-seeded OHLCVC bar over-counts its first overlapping trade does not hold against the code. Server bars carry cumulative session volume, but the derive path only advances the accumulator for trades that arrive after the seed, and the only way an already-counted print is re-delivered is the records_back correction handled above. Reconnect clears the accumulators before a fresh seed, so there is no residual over-count. No change made there.

Verification

Full fpss lib suite passes (274 tests, default and __internal features). Format and the CI-exact workspace clippy with all targets are clean.

🤖 Generated with Claude Code