20260609 CIR区分fresh和cached验证输入

src/validation/tree_runner.rs

@@ -281,6 +281,19 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
         })
     }
 
+    fn fresh_failure_audit_entries_for_cir(
+        &self,
+        ca: &CaInstanceHandle,
+        fresh_err: &ManifestFreshError,
+    ) -> Vec<ObjectAuditEntry> {
+        if !fresh_err.should_warn_when_current_instance_reused() {
+            return Vec::new();
+        }
+        self.rejected_manifest_audit_entry_for_failed_fetch(ca, fresh_err)
+            .into_iter()
+            .collect()
+    }
+
     pub(crate) fn stage_fresh_publication_point_after_repo_ready(
         &self,
         ca: &CaInstanceHandle,
@@ -955,21 +968,15 @@ impl<'a> PublicationPointRunner for Rpkiv1PublicationPointRunner<'a> {
                     }
                     crate::policy::CaFailedFetchPolicy::ReuseCurrentInstanceVcir => {
                         let projection_started = std::time::Instant::now();
-                        let mut projection = project_current_instance_vcir_on_failed_fetch(
+                        let projection = project_current_instance_vcir_on_failed_fetch(
                             self.store,
                             ca,
                             &fresh_err,
                             self.validation_time,
                         )
                         .map_err(|e| format!("failed fetch VCIR projection failed: {e}"))?;
-                        if matches!(
-                            projection.source,
-                            PublicationPointSource::FailedFetchNoCache
-                        ) && let Some(rejected_manifest) =
-                            self.rejected_manifest_audit_entry_for_failed_fetch(ca, &fresh_err)
-                        {
-                            projection.objects.audit.push(rejected_manifest);
-                        }
+                        let fresh_failure_audits =
+                            self.fresh_failure_audit_entries_for_cir(ca, &fresh_err);
                         self.append_ccr_manifest_projection_from_reuse(&projection)?;
                         let projection_ms = projection_started.elapsed().as_millis() as u64;
                         warnings.extend(projection.warnings.clone());
@@ -986,6 +993,7 @@ impl<'a> PublicationPointRunner for Rpkiv1PublicationPointRunner<'a> {
                             &warnings,
                             &projection.objects,
                             &projection.child_audits,
+                            &fresh_failure_audits,
                         );
                         let audit_build_ms = audit_build_started.elapsed().as_millis() as u64;
                         let result = PublicationPointRunResult {
@@ -1922,7 +1930,9 @@ fn build_publication_point_audit_from_snapshot(
         next_update_rfc3339_utc: pack.next_update.rfc3339_utc.clone(),
         verified_at_rfc3339_utc: pack.verified_at.rfc3339_utc.clone(),
         warnings,
-        objects: objects_out,
+        objects: objects_out.clone(),
+        cir_fresh_objects: objects_out,
+        cir_cached_objects: Vec::new(),
     }
 }
 
@@ -1938,6 +1948,7 @@ fn build_publication_point_audit_from_vcir(
     runner_warnings: &[Warning],
     objects: &crate::validation::objects::ObjectsOutput,
     child_audits: &[ObjectAuditEntry],
+    fresh_failure_audits: &[ObjectAuditEntry],
 ) -> PublicationPointAudit {
     if let Some(pack) = pack {
         return build_publication_point_audit_from_snapshot(
@@ -1977,14 +1988,19 @@ fn build_publication_point_audit_from_vcir(
             next_update_rfc3339_utc: String::new(),
             verified_at_rfc3339_utc: String::new(),
             warnings,
-            objects: Vec::new(),
+            objects: fresh_failure_audits.to_vec(),
+            cir_fresh_objects: fresh_failure_audits.to_vec(),
+            cir_cached_objects: Vec::new(),
         };
     };
 
     if source == PublicationPointSource::FailedFetchNoCache {
-        let mut objects_out = Vec::with_capacity(objects.audit.len() + child_audits.len());
+        let mut objects_out = Vec::with_capacity(
+            objects.audit.len() + child_audits.len() + fresh_failure_audits.len(),
+        );
         objects_out.extend(child_audits.iter().cloned());
         objects_out.extend(objects.audit.iter().cloned());
+        objects_out.extend(fresh_failure_audits.iter().cloned());
         return PublicationPointAudit {
             node_id: None,
             parent_node_id: None,
@@ -2011,7 +2027,9 @@ fn build_publication_point_audit_from_vcir(
                 .clone(),
             verified_at_rfc3339_utc: vcir.last_successful_validation_time.rfc3339_utc.clone(),
             warnings,
-            objects: objects_out,
+            objects: objects_out.clone(),
+            cir_fresh_objects: objects_out,
+            cir_cached_objects: Vec::new(),
         };
     }
 
@@ -2076,6 +2094,9 @@ fn build_publication_point_audit_from_vcir(
         }
     }
 
+    let mut audit_objects = objects_out.clone();
+    audit_objects.extend(fresh_failure_audits.iter().cloned());
+
     PublicationPointAudit {
         node_id: None,
         parent_node_id: None,
@@ -2102,7 +2123,9 @@ fn build_publication_point_audit_from_vcir(
             .clone(),
         verified_at_rfc3339_utc: vcir.last_successful_validation_time.rfc3339_utc.clone(),
         warnings,
-        objects: objects_out,
+        objects: audit_objects,
+        cir_fresh_objects: fresh_failure_audits.to_vec(),
+        cir_cached_objects: objects_out,
     }
 }
 

src/validation/tree_runner/tests.rs

@@ -3324,6 +3324,7 @@ fn build_publication_point_audit_from_vcir_uses_vcir_metadata_and_overlays_child
         &runner_warnings,
         &objects,
         &child_audits,
+        &[],
     );
 
     assert_eq!(audit.source, "vcir_current_instance");
@@ -3413,6 +3414,7 @@ fn build_publication_point_audit_from_vcir_failed_no_cache_keeps_current_reject_
         &[Warning::new("latest VCIR instance_gate expired")],
         &objects,
         &[],
+        &[],
     );
 
     assert_eq!(audit.source, "failed_fetch_no_cache");
@@ -3537,6 +3539,7 @@ fn build_publication_point_audit_from_vcir_without_cached_inputs_returns_empty_l
             roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
         },
         &[],
+        &[],
     );
 
     assert_eq!(audit.source, "failed_fetch_no_cache");