Just had the case in Eijebong/Archipelago-index#833 that someone had broken an URL for an older version. Because that did not get considered as a change (rightfully so), it didn't get redownloaded. I think on diff we should at least verify that the checksum before/after is the same if the download URL changes. Most likely that change is a mistake and that will catch it. And if it's not a mistake then it'll make sure that the index still matches the lockfile. (which would also break updating apworlds from nothing since the checksum wouldn't match)