20261015 实现RRDP失步检测与TA证书择优

tests/support/README.md

@@ -11,3 +11,17 @@ network request is included in this directory. The generator requires Python
 `cryptography`, OpenSSL's `cms` command, and Python 3; CI installs those test
 tools explicitly. Test output is created under a temporary directory and is
 not part of a release artifact.
+# Security recovery and TA selection
+
+`cargo test --offline --test security_recovery_e2e` runs the real CLI against a
+local HTTPS repository with persisted state. Across three processes it checks
+initial snapshot, recovery after a delta-hash mutation at unchanged session/serial,
+and a subsequent noop. Request assertions prove that no historical delta is
+downloaded. A newer cached TA must survive a valid older download under
+`require-fresh`, with a successful result and no cache-fallback count.
+
+To preserve the per-step request and summary evidence:
+
+```sh
+python3 tests/support/test_security_recovery.py target/debug/panda-rpki --proof /tmp/security-recovery.json
+```