20261016 修复 Manifest failed-fetch 缓存与子树恢复

docs/failed-fetch.md

@@ -0,0 +1,43 @@
+# Manifest failed-fetch recovery
+
+After a publication point passes validation, Panda keeps its direct VRPs, ASPAs,
+router keys, child CA references, audit information and CCR contribution in the
+state database. If a later fetch fails, it warns and uses that previously
+validated result while it remains usable, following
+[RFC 9286 section 6.6](https://www.rfc-editor.org/rfc/rfc9286.html#section-6.6).
+This is automatic and independent of whether CCR output is enabled.
+
+Results belong to a CA public key within its TAL namespace. Reuse additionally
+requires the same CA certificate, publication locations, effective resources,
+validation policy and TA resource constraints. A different certificate or policy
+requires a fresh successful validation before a result can be reused.
+
+The cache ends at the earliest relevant deadline: manifest nextUpdate, CRL
+nextUpdate, CA/manifest EE validity, or validity of an accepted payload or child
+certificate. Panda uses a conservative deadline for the whole instance. At the
+boundary it stops reusing the result; repeated failures never extend this time.
+A validation time preceding the cached validation time also prevents reuse.
+
+When an instance fails, its cached descendants use cached results only: they do
+not request another repository sync or validate newly downloaded objects. A
+missing, expired or mismatched descendant cache stops that branch. Normal tree
+limits still apply. Successful fresh parents can delete or revoke child CAs;
+those children are not restored from an earlier cache. A successful empty result
+supersedes the previous payloads.
+
+The manifest anti-rollback history and result cache commit atomically. Reuse
+never advances that history. Cache corruption, an inconsistent history, or a
+storage/issuer failure cannot authorize reuse. Transport state is separate from
+validated results, so a mutable repository view cannot silently replace cached
+payloads or cached child certificates.
+
+A cache hit preserves the fetch failure. `summary.json` includes
+`failed_fetch_cached`, and the result remains `partial` with exit 3 when
+`require-complete` is enabled. Publication to `publish-dir/latest` still requires
+a complete success. Structured logs use `failed_fetch_cache_reused` with the
+original verification time and effective deadline; publication-point audits use
+`failed_fetch_cached` and terminal state `failed_cached`.
+
+Keep the state database between invocations or daemon cycles to retain these
+results. This does not require serializing RRDP objects to a filesystem mirror,
+and does not change the current RRDP/rsync storage architecture.