20260501 修复CurrentRepoIndex完整性并优化replay guard

src/validation/objects.rs

@@ -19,7 +19,7 @@ use crate::validation::cert_path::{CertPathError, validate_signed_object_ee_cert
 use crate::validation::manifest::PublicationPointData;
 use crate::validation::publication_point::PublicationPointSnapshot;
 use std::sync::{Arc, Mutex};
-use std::time::Duration;
+use std::time::{Duration, Instant};
 use x509_parser::prelude::FromDer;
 use x509_parser::x509::SubjectPublicKeyInfo;
 
@@ -118,6 +118,9 @@ pub(crate) struct RoaTaskOk {
 pub(crate) struct RoaTaskResult {
     pub(crate) publication_point_id: u64,
     pub(crate) index: usize,
+    pub(crate) worker_index: usize,
+    pub(crate) queue_wait_ms: u64,
+    pub(crate) worker_ms: u64,
     pub(crate) rsync_uri: String,
     pub(crate) sha256_hex: String,
     pub(crate) outcome: Result<RoaTaskOk, ObjectValidateError>,
@@ -736,14 +739,15 @@ pub(crate) struct OwnedRoaTask {
     issuer_effective_as: Option<crate::data_model::rc::AsResourceSet>,
     validation_time: time::OffsetDateTime,
     collect_vcir_local_outputs: bool,
+    pub(crate) submitted_at: Option<Instant>,
 }
 
 #[derive(Clone)]
 struct RoaTaskExecutor;
 
 impl ObjectTaskExecutor<OwnedRoaTask, RoaTaskResult> for RoaTaskExecutor {
-    fn execute(&self, _worker_index: usize, task: OwnedRoaTask) -> RoaTaskResult {
-        validate_owned_roa_task(task)
+    fn execute(&self, worker_index: usize, task: OwnedRoaTask) -> RoaTaskResult {
+        validate_owned_roa_task(worker_index, task)
     }
 }
 
@@ -787,7 +791,13 @@ impl ParallelRoaWorkerPool {
     }
 }
 
-fn validate_owned_roa_task(task: OwnedRoaTask) -> RoaTaskResult {
+fn validate_owned_roa_task(worker_index: usize, task: OwnedRoaTask) -> RoaTaskResult {
+    let worker_started = Instant::now();
+    let queue_wait_ms = task
+        .submitted_at
+        .map(|submitted_at| worker_started.saturating_duration_since(submitted_at))
+        .map(|duration| duration.as_millis() as u64)
+        .unwrap_or(0);
     let sha256_hex = sha256_hex_from_32(&task.file.sha256);
     let issuer_spki = match SubjectPublicKeyInfo::from_der(task.issuer_spki_der.as_ref()) {
         Ok((rem, spki)) if rem.is_empty() => spki,
@@ -795,6 +805,9 @@ fn validate_owned_roa_task(task: OwnedRoaTask) -> RoaTaskResult {
             return RoaTaskResult {
                 publication_point_id: task.publication_point_id,
                 index: task.index,
+                worker_index,
+                queue_wait_ms,
+                worker_ms: worker_started.elapsed().as_millis() as u64,
                 rsync_uri: task.file.rsync_uri,
                 sha256_hex,
                 outcome: Err(ObjectValidateError::CertPath(
@@ -806,6 +819,9 @@ fn validate_owned_roa_task(task: OwnedRoaTask) -> RoaTaskResult {
             return RoaTaskResult {
                 publication_point_id: task.publication_point_id,
                 index: task.index,
+                worker_index,
+                queue_wait_ms,
+                worker_ms: worker_started.elapsed().as_millis() as u64,
                 rsync_uri: task.file.rsync_uri,
                 sha256_hex,
                 outcome: Err(ObjectValidateError::CertPath(
@@ -837,6 +853,9 @@ fn validate_owned_roa_task(task: OwnedRoaTask) -> RoaTaskResult {
     RoaTaskResult {
         publication_point_id: task.publication_point_id,
         index: task.index,
+        worker_index,
+        queue_wait_ms,
+        worker_ms: worker_started.elapsed().as_millis() as u64,
         rsync_uri: task.file.rsync_uri,
         sha256_hex,
         outcome,
@@ -888,6 +907,7 @@ impl ParallelObjectsStage {
                 issuer_effective_as: self.issuer_effective_as.clone(),
                 validation_time: self.validation_time,
                 collect_vcir_local_outputs: self.collect_vcir_local_outputs,
+                submitted_at: None,
             })
             .collect()
     }
@@ -895,6 +915,14 @@ impl ParallelObjectsStage {
     pub(crate) fn roa_task_count(&self) -> usize {
         self.stats.roa_total
     }
+
+    pub(crate) fn aspa_task_count(&self) -> usize {
+        self.stats.aspa_total
+    }
+
+    pub(crate) fn locked_file_count(&self) -> usize {
+        self.locked_files.len()
+    }
 }
 
 pub(crate) fn prepare_publication_point_for_parallel_roa<P: PublicationPointData>(
@@ -1408,6 +1436,9 @@ pub(crate) fn validate_roa_task_serial(
     RoaTaskResult {
         publication_point_id: 0,
         index: task.index,
+        worker_index: 0,
+        queue_wait_ms: 0,
+        worker_ms: 0,
         rsync_uri: task.file.rsync_uri.clone(),
         sha256_hex,
         outcome,