20261015 实现RRDP失步检测与TA证书择优

docs/configuration.md

@@ -156,10 +156,19 @@ no separate background refresh timer, and no invented HTTPS alternative for an
 rsync-only TAL. Candidates must pass certificate and TAL-binding validation at
 the configured logical validation time.
 
+When a fetched candidate and a revalidated cached certificate are both usable,
+selection follows `draft-ietf-sidrops-rpki-ta-tiebreaker-06` §2: prefer the later
+`notBefore`; if equal, prefer the earlier `notAfter`; if both are equal, use the
+fetched candidate. Comparisons use the signed certificate fields. Selecting a
+preferred cached certificate after a successful fetch is healthy, including
+under `require-fresh`: `trustAnchors[].source` is `cache`, `refreshFailed` is false,
+and `selectionReason` explains the choice. It does not increment
+`taCacheFallbackCount` or make the run partial.
+
 The cache is `<rrdp-state-dir>.ta-cache`, keyed by the TAL public-key SHA-256.
 Download failure permits fallback only under allow-valid-cache with a usable,
 revalidated cached certificate; that makes the result at least partial.
-Require-fresh prohibits fallback. Existing fixed `.cer` files do not seed this
+Require-fresh prohibits fallback after a failed refresh. Existing fixed `.cer` files do not seed this
 cache automatically; switching to automatic mode initially needs reachable URIs.
 One failed TA with others completing yields partial; all TAs failing yields
 failed. A fixed-certificate error found during preflight exits 2 immediately.

docs/conformance-matrix.md

@@ -1,5 +1,22 @@
 # v0.1.0 conformance matrix
 
+## Unreleased additions
+
+| Behaviour | Standard reference | Implementation | Evidence |
+| --- | --- | --- | --- |
+| Detect changed hashes for overlapping delta serials within a session, warn and recover with a snapshot | [RFC 9697 §§3–5](https://www.rfc-editor.org/rfc/rfc9697.html) | `src/repository/sync/rrdp/`, `src/repository/storage/models_summary.rs` | `tests_parts/desynchronization.rs`; `tests/security_recovery_e2e.rs` |
+| Choose between valid fetched and cached TA certificates by later notBefore, earlier notAfter, then freshly fetched | [TA tiebreaker draft -06 §2](https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ta-tiebreaker-06) | `src/cli/anchors.rs` | `anchors_tiebreaker_tests.rs`; `tests/security_recovery_e2e.rs` |
+
+The RRDP hash window is the last successfully processed notification's delta
+references, retained across restarts. An old database without this window learns
+it on its next successful sync. Failed recovery keeps the previous baseline.
+No historical delta download is required for comparison. TA selection compares
+revalidated DER certificates; fixed TA inputs retain their explicit selection.
+The tiebreaker is a draft implementation. Failed-refresh fallback still follows
+`ta-refresh-policy`; see [configuration](configuration.md#5-anchor-fields).
+
+## Released v0.1.0 baseline
+
 | Behaviour | Standard reference | Implementation | Evidence |
 | --- | --- | --- | --- |
 | TAL syntax and TA public-key binding | RFC 8630 §2 | `src/validation/from_tal.rs`, `src/model/ta.rs` | parser and synthetic integration tests |
@@ -29,6 +46,6 @@ revalidation of the entire trust chain by another relying party.
 
 The worker pool and interval index are implementation mechanisms, not new wire
 protocols; their tests must also prove deterministic output and unchanged
-validation decisions. Only the table entries above are in v0.1.0 scope.
+validation decisions. Only the released baseline table is in v0.1.0 scope.
 Adding a new source file or protocol feature requires a new row with a document
 revision, section, test, and reviewer decision.

docs/usage.md

@@ -36,6 +36,14 @@ TAL public-key hash. Refresh failures may use that cache under
 `allow-valid-cache` and produce `partial`; use `require-fresh` to reject the
 fallback.
 
+Automatic TA refresh compares usable fetched and cached certificates using the
+[TA tiebreaker rules](configuration.md#5-anchor-fields). A preferred cached
+certificate after a successful fetch keeps the run successful. RRDP also checks
+the previous notification's delta hashes (RFC 9697); a changed hash within the
+same session emits `rrdp_session_desynchronized` and triggers a fresh snapshot,
+including when the notification serial has not advanced. This check uses stored
+hashes and does not fetch old deltas.
+
 ## Multiple anchors and constraints
 
 Use one named `[[anchors]]` table per RIR. There is no positional TAL/TA pairing: