20261015 实现RRDP失步检测与TA证书择优

docs/configuration.md

@@ -156,10 +156,19 @@ no separate background refresh timer, and no invented HTTPS alternative for an
 rsync-only TAL. Candidates must pass certificate and TAL-binding validation at
 the configured logical validation time.
 
+When a fetched candidate and a revalidated cached certificate are both usable,
+selection follows `draft-ietf-sidrops-rpki-ta-tiebreaker-06` §2: prefer the later
+`notBefore`; if equal, prefer the earlier `notAfter`; if both are equal, use the
+fetched candidate. Comparisons use the signed certificate fields. Selecting a
+preferred cached certificate after a successful fetch is healthy, including
+under `require-fresh`: `trustAnchors[].source` is `cache`, `refreshFailed` is false,
+and `selectionReason` explains the choice. It does not increment
+`taCacheFallbackCount` or make the run partial.
+
 The cache is `<rrdp-state-dir>.ta-cache`, keyed by the TAL public-key SHA-256.
 Download failure permits fallback only under allow-valid-cache with a usable,
 revalidated cached certificate; that makes the result at least partial.
-Require-fresh prohibits fallback. Existing fixed `.cer` files do not seed this
+Require-fresh prohibits fallback after a failed refresh. Existing fixed `.cer` files do not seed this
 cache automatically; switching to automatic mode initially needs reachable URIs.
 One failed TA with others completing yields partial; all TAs failing yields
 failed. A fixed-certificate error found during preflight exits 2 immediately.