Manifest.

§5.1 — Magic + format header (16 bytes)

The first 16 bytes of every .lim manifest:

offset  size  field                  meaning
0       4     magic                  'LMFS' (0x4C 0x4D 0x46 0x53)
4       2     drop_store_version     u16 LE — drop store layer version
6       2     metadata_version       u16 LE — metadata layer version
8       2     manifest_version       u16 LE — manifest layer version
10      4     reserved               MUST be zero

The three version fields are independent (per-layer versioning). A reader declaring spec vX.Y MUST accept any image whose versions are each ≤ its declared maximum for that layer.

§5.2 – §5.9 — The nine sections

Sections appear in the order they’re hashed into the Merkle root. Optional sections (EC params, DMS policy, delta linkage) may be absent; readers detect by section presence. Required sections MUST be present.

§5.10 — Merkle root construction

Flat construction (not a deep tree). Each section is verifiable individually without loading siblings — important for HTTP range streaming and partial verification.

ManifestRoot = BLAKE3(
"limnifs/v1"                // domain separator
|| H(metadata)              // layer-2 metadata blob hash
|| H(format_header)         // §5.1
|| H(feature_flags)         // §5.2
|| H(metadata_reference)    // §5.3
|| H(slab_index)            // §5.4
|| H(crypto_params)         // §5.5
|| H(ec_params)             // §5.6 (or empty hash if absent)
|| H(dms_policy)            // §5.7 (or empty hash if absent)
|| H(delta_linkage)         // §5.8 (or empty hash if absent)
|| H(history)               // §5.9
)