Abstract—Repeated payloads and collection-specific regular ities can inflate offline anomaly-detection results. We formu late smart-grid message screening under an empirical false alarm budget and propose risk-constrained hierarchical screening (RCHS): histogram gradient boosting with support-aware prefix backoff and explicit abstention for invalid syntax. Canonical payloads are separated across fitting, calibration, threshold de velopment, selection, and testing, then evaluated under identity, structural, temporal, and source shifts. On two utility commu nication exports, RCHS automatically decides 99.93% of the payload-group test and attains 99.98% abnormal-class F1 with no observed false positives among accepted mixed-source inputs. Its largest paired structural-holdout gain is 23.64 points, yet a chronology-respecting model produces 75.99% false positives on a normal source excluded from development. Thus, abstention and hierarchy address distinct failure modes

anomaly detection,data acquisition,distribution shift,measurement integrity,smart grid,trustworthy evaluation