# Manifest failed-fetch recovery

After a publication point passes validation, Panda keeps its direct VRPs, ASPAs,
router keys, child CA references, audit information and CCR contribution in the
state database. If a later fetch fails, it warns and uses that previously
validated result while it remains usable, following
[RFC 9286 section 6.6](https://www.rfc-editor.org/rfc/rfc9286.html#section-6.6).
This is automatic and independent of whether CCR output is enabled.

Results belong to a CA public key within its TAL namespace. Reuse additionally
requires the same CA certificate, publication locations, effective resources,
validation policy and TA resource constraints. A different certificate or policy
requires a fresh successful validation before a result can be reused.

The cache ends at the earliest relevant deadline: manifest nextUpdate, CRL
nextUpdate, CA/manifest EE validity, or validity of an accepted payload or child
certificate. Panda uses a conservative deadline for the whole instance. At the
boundary it stops reusing the result; repeated failures never extend this time.
A validation time preceding the cached validation time also prevents reuse.

When an instance fails, its cached descendants use cached results only: they do
not request another repository sync or validate newly downloaded objects. A
missing, expired or mismatched descendant cache stops that branch. Normal tree
limits still apply. Successful fresh parents can delete or revoke child CAs;
those children are not restored from an earlier cache. A successful empty result
supersedes the previous payloads.

The manifest anti-rollback history and result cache commit atomically. Reuse
never advances that history. Cache corruption, an inconsistent history, or a
storage/issuer failure cannot authorize reuse. Transport state is separate from
validated results, so a mutable repository view cannot silently replace cached
payloads or cached child certificates.

A cache hit preserves the fetch failure. `summary.json` includes
`failed_fetch_cached`, and the result remains `partial` with exit 3 when
`require-complete` is enabled. Publication to `publish-dir/latest` still requires
a complete success. Structured logs use `failed_fetch_cache_reused` with the
original verification time and effective deadline; publication-point audits use
`failed_fetch_cached` and terminal state `failed_cached`.

Keep the state database between invocations or daemon cycles to retain these
results. This does not require serializing RRDP objects to a filesystem mirror,
and does not change the current RRDP/rsync storage architecture.