…PaymentRequest message that is fetched via the "r" parameter.
The hash is meant to link the trust anchor (e.g. the QR code) to the payment request message in a secure way. This will solve the problem several apps are comparing address+amount fields as a workaround instead, preventing some advanced BIP70 usecases. When these apps read a matching hash, they need not compare any of the other fields.
Thanks to Julian Haight for helping with the standard.