This check 'if ( SHA256(existing config) == SHA256(new config) )' as I mentioned is kind of optimization, but it was introduced to protect the watches on exiting directories and files since config refresh was removing the exiting watches indiscriminately and re-establishing, that resulted in the loss of events. Later https://github.com/facebook/osquery/pull/3459 fixed this issue. Now this check is working as a kind optimization. I believe @theopolis can shed more light on this.