20261016 修复 Manifest failed-fetch 缓存与子树恢复

docs/command-line-reference.md

@@ -135,3 +135,9 @@ TA certificate on each cycle; providing `ta` selects fixed mode. TOML is read
 once at process start. Put `log-format = "text"` and `ta-refresh-policy` at the
 top level, before any `[[anchors]]` tables. See [Docker reload steps](docker.md#graceful-stop-edit-and-reload)
 and [complete container TOML examples](../docker/examples/README.md).
+
+Manifest failed-fetch can retain still-valid, previously validated results from
+persistent state. `summary.json.failed_fetch_cached` counts publication points
+using those results. Such a run remains partial; it does not advance
+`publish-dir/latest`. See [failed-fetch recovery](failed-fetch.md) for validity
+bounds, policy changes and cached-subtree behaviour.

docs/conformance-matrix.md

@@ -4,6 +4,7 @@
 
 | Behaviour | Standard reference | Implementation | Evidence |
 | --- | --- | --- | --- |
+| Retain still-valid per-CA results on failed-fetch, persist them across restarts, and traverse descendants using cached results only | [RFC 9286 §6.6](https://www.rfc-editor.org/rfc/rfc9286.html#section-6.6) | `src/validation/failed_fetch.rs`, `tree_runner/`, `tree_parallel/`, atomic history/result storage | `tests/failed_fetch_e2e.rs`, cache/expiry/context/storage tests; [behaviour and limits](failed-fetch.md) |
 | CA-key manifest history across filename changes, monotonic thisUpdate, exact EE SIA location matching, rename warnings and coordinated commits | [RFC 9981 §§2–4](https://www.rfc-editor.org/rfc/rfc9981.html) | `src/validation/manifest/`, `src/repository/storage/store_manifest.rs`, `src/validation/tree_runner/` | `history_tests.rs`, storage history fault tests, `tests/manifest_history_e2e.rs` |
 | Detect changed hashes for overlapping delta serials within a session, warn and recover with a snapshot | [RFC 9697 §§3–5](https://www.rfc-editor.org/rfc/rfc9697.html) | `src/repository/sync/rrdp/`, `src/repository/storage/models_summary.rs` | `tests_parts/desynchronization.rs`; `tests/security_recovery_e2e.rs` |
 | Choose between valid fetched and cached TA certificates by later notBefore, earlier notAfter, then freshly fetched | [TA tiebreaker draft -06 §2](https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ta-tiebreaker-06) | `src/cli/anchors.rs` | `anchors_tiebreaker_tests.rs`; `tests/security_recovery_e2e.rs` |

docs/failed-fetch.md

@@ -0,0 +1,43 @@
+# Manifest failed-fetch recovery
+
+After a publication point passes validation, Panda keeps its direct VRPs, ASPAs,
+router keys, child CA references, audit information and CCR contribution in the
+state database. If a later fetch fails, it warns and uses that previously
+validated result while it remains usable, following
+[RFC 9286 section 6.6](https://www.rfc-editor.org/rfc/rfc9286.html#section-6.6).
+This is automatic and independent of whether CCR output is enabled.
+
+Results belong to a CA public key within its TAL namespace. Reuse additionally
+requires the same CA certificate, publication locations, effective resources,
+validation policy and TA resource constraints. A different certificate or policy
+requires a fresh successful validation before a result can be reused.
+
+The cache ends at the earliest relevant deadline: manifest nextUpdate, CRL
+nextUpdate, CA/manifest EE validity, or validity of an accepted payload or child
+certificate. Panda uses a conservative deadline for the whole instance. At the
+boundary it stops reusing the result; repeated failures never extend this time.
+A validation time preceding the cached validation time also prevents reuse.
+
+When an instance fails, its cached descendants use cached results only: they do
+not request another repository sync or validate newly downloaded objects. A
+missing, expired or mismatched descendant cache stops that branch. Normal tree
+limits still apply. Successful fresh parents can delete or revoke child CAs;
+those children are not restored from an earlier cache. A successful empty result
+supersedes the previous payloads.
+
+The manifest anti-rollback history and result cache commit atomically. Reuse
+never advances that history. Cache corruption, an inconsistent history, or a
+storage/issuer failure cannot authorize reuse. Transport state is separate from
+validated results, so a mutable repository view cannot silently replace cached
+payloads or cached child certificates.
+
+A cache hit preserves the fetch failure. `summary.json` includes
+`failed_fetch_cached`, and the result remains `partial` with exit 3 when
+`require-complete` is enabled. Publication to `publish-dir/latest` still requires
+a complete success. Structured logs use `failed_fetch_cache_reused` with the
+original verification time and effective deadline; publication-point audits use
+`failed_fetch_cached` and terminal state `failed_cached`.
+
+Keep the state database between invocations or daemon cycles to retain these
+results. This does not require serializing RRDP objects to a filesystem mirror,
+and does not change the current RRDP/rsync storage architecture.