20261015_4 修复Manifest编号与改名抗重放校验

docs/usage.md

@@ -86,6 +86,22 @@ An omitted `constraints` field discovers a same-stem file beside the TAL. An
 explicit path must exist and parse. Constraint rules follow the profile in the
 [standards matrix](conformance-matrix.md).
 
+## Manifest history
+
+The unreleased RFC 9981 implementation requires a fresh state directory. It
+directly uses CA public-key history within the TAL public-key namespace; there
+is no old-database migration or fallback. Reuse that new directory on subsequent
+runs to retain replay protection across restarts and CA certificate reissuance.
+
+A manifest filename change can restart the number sequence, but its thisUpdate
+must still advance. Alternative CA SIA entries participate in the filename
+comparison; changing only a directory does not reset the number. A rename is
+reported to the operator, including when the candidate later fails validation.
+The EE signedObject URI must exactly match the actual published rsync URI for
+both RRDP and rsync. Failed manifests do not advance history or emit their
+payloads; they make the CLI result partial and trigger exit code 3 when
+`require-complete = true`.
+
 ## Continuous operation
 
 Daemon configuration keeps the controller and validator settings together: