6. Integrity: SHA-256 coverage

The digest D is SHA-256 over the file bytes from offset 257 up to, not including, offset L - 96. That range is, in order: the body, the marker line (when present), the zero padding (when present), and the embedded container (when present). The header line and the footer are excluded, so the header can be rewritten in place after streaming without changing the digest.

D is stored raw in footer bytes 64..96 and, in a final header, as 64 lowercase hex digits. A verifier MUST compare the computed digest with the footer (checksum_mismatch) and, for a final header, the header digest with the footer digest (header_footer_mismatch).

The embedded container carries its own CRC32C checks (§7.3); they are in addition to D, not a replacement.