Notable changes:

- Collision checks are faster: detection now costs 14–23% of throughput, down from 19–32%.
- The recompression step now uses the SHA-1 hardware instructions where available (#13).
- The two recompression chains now run interleaved (#9).
- The message schedule is stored backwards on x86 to save a shuffle per group (#8).
- The tail checks are table-based (#11), and vector groups can have gaps (#10).
- CI covers more CPU variants (#12), and property tests use QuickCheck (#14).