I didn't realize this on my first pass, but we need to add more cover to the use of these hashes. If the PG goes from a new OSD to an old one, it's in trouble with any objects that are placed by hash!
We may also need to require clients to be able to deal with them — in which case we should actually make this require version 6 to decode as well — but I'm less sure about that.