20261015_4 修复Manifest编号与改名抗重放校验

docs/conformance-matrix.md

@@ -4,6 +4,7 @@
 
 | Behaviour | Standard reference | Implementation | Evidence |
 | --- | --- | --- | --- |
+| CA-key manifest history across filename changes, monotonic thisUpdate, exact EE SIA location matching, rename warnings and coordinated commits | [RFC 9981 §§2–4](https://www.rfc-editor.org/rfc/rfc9981.html) | `src/validation/manifest/`, `src/repository/storage/store_manifest.rs`, `src/validation/tree_runner/` | `history_tests.rs`, storage history fault tests, `tests/manifest_history_e2e.rs` |
 | Detect changed hashes for overlapping delta serials within a session, warn and recover with a snapshot | [RFC 9697 §§3–5](https://www.rfc-editor.org/rfc/rfc9697.html) | `src/repository/sync/rrdp/`, `src/repository/storage/models_summary.rs` | `tests_parts/desynchronization.rs`; `tests/security_recovery_e2e.rs` |
 | Choose between valid fetched and cached TA certificates by later notBefore, earlier notAfter, then freshly fetched | [TA tiebreaker draft -06 §2](https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ta-tiebreaker-06) | `src/cli/anchors.rs` | `anchors_tiebreaker_tests.rs`; `tests/security_recovery_e2e.rs` |
 

docs/usage.md

@@ -86,6 +86,22 @@ An omitted `constraints` field discovers a same-stem file beside the TAL. An
 explicit path must exist and parse. Constraint rules follow the profile in the
 [standards matrix](conformance-matrix.md).
 
+## Manifest history
+
+The unreleased RFC 9981 implementation requires a fresh state directory. It
+directly uses CA public-key history within the TAL public-key namespace; there
+is no old-database migration or fallback. Reuse that new directory on subsequent
+runs to retain replay protection across restarts and CA certificate reissuance.
+
+A manifest filename change can restart the number sequence, but its thisUpdate
+must still advance. Alternative CA SIA entries participate in the filename
+comparison; changing only a directory does not reset the number. A rename is
+reported to the operator, including when the candidate later fails validation.
+The EE signedObject URI must exactly match the actual published rsync URI for
+both RRDP and rsync. Failed manifests do not advance history or emit their
+payloads; they make the CLI result partial and trigger exit code 3 when
+`require-complete = true`.
+
 ## Continuous operation
 
 Daemon configuration keeps the controller and validator settings together: