rvf: ADR-009 declares a 4096-byte root manifest normative, but the shipped writer never emits one

Found while building an independent RVF parser for rvQR against ADR-009 as the normative spec.

What I observed

A container produced by the shipped CLI (rvf create -d 16 -m cosine + rvf ingest, 24 vectors, 2304 bytes) contains:

• segment magic 53 46 56 52 at offsets 0, 162, 1960, 2092 (4 segments: MANIFEST, VEC, WITNESS, MANIFEST)
• root manifest magic 30 4D 56 52: zero occurrences
• the final 16 bytes are all zero

Why this matters

ADR-009 §2.1 states the Level-0 root manifest "is exactly 4096 bytes and occupies the final 4096 bytes of the latest manifest payload," and acceptance criterion 3 is "Tail scanning locates a valid manifest without reading a fixed header at offset zero." An independent implementor reading ADR-009 as normative — which §2.4 explicitly instructs — will write a reader that finds nothing in a real CLI-produced file.

The cause looks structural: there are two writer paths in the tree.

• rvf-wire + rvf-manifest own the 4096-byte Level0Root codec (manifest_codec.rs:172 write_root_manifest), tail discovery, and the golden vectors added in #769.
• rvf-runtime — the crate behind rvf-cli, which produces actual files — has its own write_manifest (store.rs:3582) emitting MANIFEST segments, and its Cargo.toml does not depend on rvf-wire or rvf-manifest at all. It has its own find_latest_manifest (read_path.rs:49) that scans for manifest segments, not a Level-0 root.

Both paths agree on the segment magic and 64-byte alignment, so they aren't in conflict there — but only one produces the root manifest ADR-009 describes as the source of truth.

Note a 2304-byte container is smaller than a single 4096-byte root manifest, so small files can't carry one by construction. That itself deserves to be stated in the spec.

Suggested resolution

Either:

1. Amend ADR-009 to describe both layouts — say plainly that the Level-0 root manifest is optional/absent in runtime-produced containers, that rvf-runtime is also a normative source, and how a reader should behave when no root manifest exists (fall back to the newest MANIFEST segment); or
2. Make rvf-runtime emit a root manifest so the shipped writer matches the declared contract.

(1) is cheaper and reflects reality; (2) makes the format uniform. Either way the ADR and the shipped writer should stop disagreeing — that inconsistency is precisely what ADR-009 was written to eliminate.

Golden vectors from #769 are unaffected: they test rvf-wire's codec, which is correct on its own terms.

🤖 Generated with claude-flow

Read ADR-009 §2.1–§2.4, then compare rvf-manifest’s manifest_codec.rs:172 and rvf-runtime’s store.rs:3582 and read_path.rs:49. Confirm how the CLI-produced layout differs from the declared root-manifest contract and review the #769 golden-vector context. Done means the ADR and shipped writer agree, including behavior when no root manifest exists.