20260401 live recorder 扩展到1+N个delta，完成5个RIR录制，以及三方replay，结果三方均对齐vrps和vaps

src/validation/ca_instance.rs

@@ -3,11 +3,15 @@ use crate::data_model::rc::{ResourceCertKind, ResourceCertificate, SubjectInfoAc
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct CaInstanceUris {
-    /// CA repository base rsync URI (must end with `/`).
+    /// rsync sync base URI used for live/replay publication point fetches (must end with `/`).
+    ///
+    /// This is the parent directory of `manifest_rsync_uri`, not necessarily the full
+    /// `id-ad-caRepository` URI. Using the manifest parent keeps sync scope narrow while
+    /// `publication_point_rsync_uri` preserves the full RFC 9286 publication-point value.
     pub rsync_base_uri: String,
     /// rsync URI for the manifest object (`.mft`).
     pub manifest_rsync_uri: String,
-    /// Publication point rsync URI (RFC 9286 terminology). In v1 this equals `rsync_base_uri`.
+    /// Publication point rsync URI (RFC 9286 terminology).
     pub publication_point_rsync_uri: String,
     /// Optional RRDP notification URI (https).
     pub rrdp_notification_uri: Option<String>,
@@ -104,8 +108,6 @@ pub fn ca_instance_uris_from_ca_certificate(
         publication_point_rsync_uri.push('/');
     }
 
-    let rsync_base_uri = publication_point_rsync_uri.clone();
-
     let manifest_rsync_uri = manifest.ok_or(CaInstanceUrisError::MissingRpkiManifest)?;
     if !manifest_rsync_uri.starts_with(&publication_point_rsync_uri) {
         return Err(CaInstanceUrisError::ManifestNotUnderPublicationPoint {
@@ -113,9 +115,16 @@ pub fn ca_instance_uris_from_ca_certificate(
             publication_point_rsync_uri,
         });
     }
+    let manifest_parent = manifest_rsync_uri
+        .rsplit_once('/')
+        .map(|(parent, _)| format!("{parent}/"))
+        .ok_or_else(|| CaInstanceUrisError::ManifestNotUnderPublicationPoint {
+            manifest_rsync_uri: manifest_rsync_uri.clone(),
+            publication_point_rsync_uri: publication_point_rsync_uri.clone(),
+        })?;
 
     Ok(CaInstanceUris {
-        rsync_base_uri,
+        rsync_base_uri: manifest_parent,
         manifest_rsync_uri,
         publication_point_rsync_uri,
         rrdp_notification_uri: notify,