//
··
Every snapshot manifest carries an RFC 9530 content_digest (sha-256=:base64:) computed over the tarball body before publication. A downstream consumer (mirror instance, archive harvester) can verify byte-identical receipt by recomputing the SHA-256 locally and comparing against the manifest's digest. The mirror copy on s3://rrxiv-snapshots/snapshots/ carries the same bytes as the rrxiv-instance blob endpoint when both are populated.