P5: explicit trusted-SCL identity health and broad-mismatch gate #94

Goal

Turn trusted-SCL online synchronization evidence into an explicit, typed identity/health decision instead of allowing every completed synchronization to appear as a generic Connected state.

P5 follows P2/P3 trusted-SCL initial synchronization and P4 SCL-derived association addressing. The empirical SCL-assisted profile already requires explicit mismatch handling: preserve trusted SCL identity for partial evidence, never silently merge unknown online structure, and stop or explicitly fall back when the online model is broadly incompatible.

Health classes

matched

• every expected SCL MMS domain is online;
• no extra online domain is silently merged;
• no skipped FC roots;
• no AccessResult/read failure;
• no structural FC-root mapping failure.

degraded

At least one mismatch exists, but available evidence does not prove a different/incompatible model. Examples:

• some expected domains missing;
• extra online domains;
• FC root access denied/read failed;
• a subset of readable FC roots does not match the local SCL structure while other roots still map successfully.

The trusted SCL semantic identity remains authoritative. Missing/failed values remain unavailable and diagnostics must show exact counts.

incompatible

Fail closed on clear broad mismatch evidence:

• expected SCL domain set is non-empty and none of those domains exists online; or
• FC roots return MMS Data, but every readable root fails structural mapping to the trusted SCL tree, with no access-denied/read-failure evidence masking the decision.

Do not label access-policy failure alone as an incompatible IED/model.

Product policy

• matched -> normal trusted-SCL ONLINE state.
• degraded -> remain online with explicit degraded health; preserve local SCL topology and unavailable values.
• incompatible -> stop trusted-SCL product synchronization and surface a fault with exact evidence.
• Never silently invoke full live discovery while a trusted SCL is armed.
• Existing explicit user fallback remains: clear/unarm trusted SCL, then reconnect using live discovery.

Acceptance gates

• Core classifier exposes typed matched/degraded/incompatible state and deterministic evidence counts.
• Exact domain/root evidence classifies matched.
• Missing/extra domain and mixed root failures classify degraded.
• Access-denied-only evidence remains degraded, not incompatible.
• No expected domain online classifies incompatible.
• All readable roots structurally mismatch classifies incompatible.
• Workbench exposes trusted-SCL health and refuses to publish an incompatible synchronization as Connected.
• Diagnostics include domain/root/access/mapping counts and the explicit policy outcome.
• Workbench QA proves matched path, degraded path, incompatible fail-closed path, and explicit user-controlled live-discovery fallback.
• Retained SCL-assisted, IED Simulator Qt, Release Hardening, Embedded and C++ workflows remain green.

Boundaries

• This is an internal/reference interoperability gate, not proof of vendor external IEC 61850 client or field-device interoperability.
• No automatic discovery fallback is added.
• PR feat: lightweight IEC 61850 engineering simulator workspace #82 remains OPEN + DRAFT until explicitly changed by the user.