Done. Collision found, verified, and documented.

Answer

{"algo":"sha256","lambda":24,"inputA":"0x19688697e11d","inputB":"0x750293ffd1bf"}

Both digests begin 9378a7ecb4cb:

• sha256(0x19688697e11d) = 9378a7ecb4cb​31da3757efee0802c863c66525359462f68cb78e87c8dcb42793
• sha256(0x750293ffd1bf) = 9378a7ecb4cb​2655c297afe1c9661fbbc59d5629aa148699407b5674e1a38aff

Method

Pollard's rho with Brent's cycle detection over f(x) = sha256(x)[:6]. The environment had no C compiler and no numpy, and a birthday table needs ~21M stored digests (multi-GB in pure Python), so I traded ~2.2× more hash evaluations for O(1) memory. Found in 35.7 s / 37.6M evaluations (= 2.24 × 2²⁴) single-threaded.

Evidence

• Logic validated first at 16/24/32-bit truncation × 8 seeds — 24/24 trials produced re-verified collisions, so the 48-bit run wasn't the code's first output.
• Four SHA-256 implementations agree on both digests: Python hashlib, openssl dgst 3.0.13, GNU coreutils sha256sum 9.4, and a from-scratch FIPS 180-4 implementation self-tested against NIST vectors. The last one matters because hashlib and openssl share a backend on this host and aren't mutually independent.
• Deterministic: re-running the search from its recorded seed reproduced a byte-identical collision.json (cmp-confirmed).
• tools/verify_collision.py collision.json → 8/8 PASS, exit 0.

Incidental finding: the digests actually agree on 51 leading bits, not 48.

Main caveat

The one unconfirmed assumption is encoding: I read 0x19688697e11d as six raw bytes. SIMD's decoder source wasn't available in this workspace, so that's an inference from the format offering a hex option — flagged as U1 in the report, with a UTF-8 variant as the fallback if hex is rejected.

Files

• collision.json, artifacts/report.md — named outputs, left untracked
• tools/find_collision.py, tools/verify_collision.py, README.md — committed (2 commits, stdlib only, no dependencies to vendor)

The report separates facts (F1–F10, each from a command run here), inferences (I1–I4), uncertainty (U1–U5), and four open questions. One correction to the task's framing worth noting: the rho cycle length (7,807,993) is also conventionally called λ, unrelated to the task's λ=24 truncation parameter — I disambiguated it in the report rather than letting the collision stand.