Looked over the other hashing functions in scf/hash.clj. They all appear to sort incoming values when differences in ordering would cause a different hash to be calculated. When the storage of package inventory was introduced it looks like the order of packages was taken into account in the package-similarity-hash function but not in facts-identity-hash function. See this commit for more detail. I believe the issue found in PDB-5021 is isolated and the other hashing seems correct.