Content hashing of sources is off by default #159

Finding (as written in the restart doc, "Post-release issue list"): content hashing of sources is off by default.

Suggested fix: decide whether content hashing should be on by default (it is needed to detect edited sources under the same name); if yes, turn it on and benchmark the cost; if no, document the risk and make the manifest record that hashing was off.

Source: restart doc "Post-release issue list" (2026-11-04).