The instancing identity hash covered positions and indices but not normals; normals derived in f64 can differ while f32 positions stay byte-identical, so two items shared a key, got grouped, and every occurrence shipped the template's normals. The same-shape guard and verify_pairing both missed it, and the doc claimed a 128-bit hash made collisions impossible, which was true only for the fields it hashed.