@cwebber

many details I don't know and would take me long time to understand in detail.

The problem with collisions because of shortened hashes I know from another system too, it's indeed a bad idea and leads to problems.
Fun-fact is that different content can lead to the same hashes even in full length, when md5 is used. In general I'd assume that problem exists with sha256 or sha256d too, just with lower probability, but I'm not sure.