fix(protocol): resolve 0xC511_0004 magic collision (closes #928)

[ruvnet]

Summary

Closes #928. 0xC511_0004 was double-assigned in firmware (ADR-063 fused-vitals AND ADR-040 WASM output) and both packet types were transmitted. The sensing-server only knew the WASM shape, so on the C6+mmWave config the 48-byte fused-vitals packet was being silently misparsed as malformed WASM events — fused vitals were lost, spurious WASM events leaked to subscribers.

Approach

Per the issue's recommended direction (smaller blast radius — the registry already treats 0xC511_0004 as fused-vitals canonical):

1. Reassign WASM_OUTPUT_MAGIC from 0xC511_0004 → 0xC511_0007 (next free slot per rv_feature_state.h registry). Firmware-side change in wasm_runtime.h.
2. Add parse_edge_fused_vitals + EdgeFusedVitalsPacket on the server. Byte layout mirrors edge_fused_vitals_pkt_t from edge_processing.h:129 exactly, gated by the firmware's _Static_assert(sizeof(...) == 48).
3. Dispatch arm added to the UDP receive loop, tried before the WASM parser so stale firmware (old WASM on 0004) fails to parse as both and gets dropped — deliberate fail-loud rather than the pre-fix silent garbage.
4. Registry comment update in rv_feature_state.h documenting the new 0x...0007 row.
5. 5 new tests in issue_928_magic_collision_tests mod guarding both halves of the swap.

Test plan

• cargo test -p wifi-densepose-sensing-server --no-default-features --bin sensing-server → 122 passed / 0 failed (5 new + 117 existing, unchanged).
• parse_edge_fused_vitals round-trips a synthetic 48-byte packet — every field including breathing/100, heartrate/10000, mmWave block.
• parse_wasm_output rejects the legacy 0xC511_0004.
• parse_wasm_output accepts the new 0xC511_0007.
• Hardware validation deferred — issue notes it can't run in CI without a real C6+MR60BHA2 board.

WebSocket schema

New broadcast type: {\"type\": \"edge_fused_vitals\", \"node_id\": ..., \"breathing_rate_bpm\": ..., \"heartrate_bpm\": ..., \"mmwave\": {\"hr_bpm\": ..., \"br_bpm\": ..., \"distance_cm\": ..., \"targets\": ..., \"confidence\": ..., \"type\": ...}, ...}.

Additive — existing subscribers gain a new branch; none break.

Deployment

⚠ Wire-protocol change. Firmware older than this commit emits WASM output on 0xC511_0004; updated hosts will drop those frames. Operators running C6+mmWave should reflash firmware concurrent with the host upgrade. The pre-fix silent misparsing is the worse failure mode; this is the right tradeoff.

🤖 Generated with claude-flow

[ruvnet]

Verified this end-to-end (I filed #928) — the protocol fix is correct and complete. 👍

Offsets match the firmware struct byte-for-byte. Checked parse_edge_fused_vitals against edge_fused_vitals_pkt_t (edge_processing.h, __attribute__((packed)), 48 bytes):

field	firmware offset	parser
node_id	[4]	buf[4] ✓
flags	[5]	buf[5] ✓
breathing (×100)	[6..8)	buf[6..8] ✓
heartrate (×10000)	[8..12)	buf[8..12] ✓
rssi	[12]	buf[12] as i8 ✓
n_persons	[13]	buf[13] ✓
mmwave_type	[14]	buf[14] ✓
fusion_confidence	[15]	buf[15] ✓
motion_energy	[16..20)	✓
presence_score	[20..24)	✓
timestamp_ms	[24..28)	✓
mmwave_hr/br/distance	[28..40)	✓
mmwave_targets/confidence	[40]/[41]	✓

Note that [14]/[15] correctly use what's reserved[2] in the 32-byte edge_vitals_pkt_t — the fused variant repurposes them for mmwave_type/fusion_confidence, and the parser gets that right.

• Dispatch wiring ✓ — if let Some(fused) = parse_edge_fused_vitals(&buf[..len]) is present, so fused packets are actually consumed (not just parseable).
• Tests ✓ — well-formed parse + 47-byte short-packet rejection.
• Magic reassignment ✓ — WASM_OUTPUT_MAGIC → 0xC5110007 in both firmware (wasm_runtime.h) and both server copies (csi.rs + main.rs), and the registry updated. Right call per the issue (registry treats 0xC5110004 as canonical fused-vitals).

Two things before merge:

1. security-scan.yml is now redundant — this PR includes the same SAST path/semgrep fix that just merged as fix(ci): SAST actually scans the code + drop deprecated flaky semgrep action #930. Rebase on main and drop that file from the diff (it'll conflict otherwise).
2. Backward-compat (worth a line in the PR/changelog): a still-deployed node running pre-Wire-protocol magic collision: 0xC5110004 used for BOTH fused-vitals and WASM output — C6+mmWave vitals misparsed #928 firmware sends WASM as 0xC5110004; the updated server now reads that as fused-vitals. That's unavoidable with any reassignment and acceptable (WASM on 0xC5110004 was already broken by the collision), but flashing nodes + host together is the clean upgrade path.

Nice work — closes #928 correctly. LGTM after the rebase.