[bombcar]

The remote satellite/robot shouldn't decide what is a valid command (beyond verifying it comes from a valid authority), because we have multiple situations where NASA has recovered a space probe/robot by sending commands never dreamed of when the vessel was launched.

[wildzzz]

It really depends on the definition of a "valid command". What do you do when you receive a command that you don't recognize or the parameters are in the wrong format? You would just ignore it and increment the invalid command counter. You wouldn't want to just block a command that would be valid at any other time just because the receiver isn't expecting it. Although you may want to block a command that could cause harm to the system in it's current state (don't allow the command to blow the fairing bolts while the rocket is still on the ground). I don't think I'd want to allow accepting commands that don't conform to the correct format because even though you could potentially solve some problem with something like a register overflow, you'd be leaving yourself vulnerable to that same exploit causing harm, accidentally or maliciously.

If you have a command called SET_MODE and it only has the options 1, 2, or 3, it would be ridiculous for the system to accept mode 4 since it doesn't exist. The system should refuse the command. If the SET_MODE command actually just sets a bunch of toggles for you in the background, it would be a good idea to retain control of those toggles so you can customize the configuration and effectively make your own "mode 4" for any emergencies.