Hash is strongest here
When both manifests contain SHA-256, matching hashes are strong evidence that the file bytes match. A renamed file with the same hash is still reported under its filename because this diff is organized around delivery identity.