Done. Collision found, verified four ways, and delivered.

Result (collision.json, 93 bytes, untracked):

{"algo":"keccak256","lambda":24,"inputA":"0x8375360100000000","inputB":"0x7131040200000000"}

keccak256(0x8375360100000000) = 8851a59bbb9d 6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
keccak256(0x7131040200000000) = 8851a59bbb9d 27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1

Distinct 8-byte messages, identical first 48 bits (8851a59bbb9d), first difference at digest byte 6.

What's in the repo (committed at bec4a21): src/keccak.h (Keccak-f[1600] + keccak256 with original-Keccak 0x01 padding), src/collide.c (deterministic birthday search, counters from 1, 2^26-slot counter-only table = 256 MiB; every table hit is confirmed by recomputing the digest, so index aliasing can't fabricate a collision), tools/verify_collision.py (dependency-free verifier with its own independently written pure-Python keccak), Makefile, README.md.

Checks I ran

• make selftest: four published keccak256 vectors match, including the empty-string EOA codehash c5d24601…; fast 8-byte path agrees with the generic path for 1000 inputs.
• make verify: pure-Python verifier recomputes both digests from the JSON and passes; pycryptodome 3.23 cross-check agrees; pysha3 (Keccak Code Package binding) also agrees on all 256 bits of both digests — four implementations total.
• Negative tests: the verifier rejects identical inputs, a non-colliding pair, wrong algo, and an extra JSON key (so the "VERIFIED" line isn't vacuous).
• Determinism: a second full run produced a byte-identical collision.json.
• Cost: 33,829,233 evaluations in 15.1 s single-threaded, ≈1.6× the birthday mean of ~2.1·10⁷ — an ordinary draw.

Main residual risk (documented in §4 of the report, not fixable cheaply): if the grading verifier recomputes with FIPS 202 SHA3-256 while calling it keccak256, this pair fails — under SHA3-256 the inputs hash to be9557c3…/45a1116d… with no shared prefix. The task's naming and Ethereum convention both point to the Keccak variant, so I went with that; a SHA3-256 pair is a one-byte change (0x01→0x06) and another 15 s if ever needed. λ=24 is read as 48 bits per the task text, and a 48-bit match implies a 24-bit match either way.

Report is at artifacts/report.md — facts (with the commands and outputs behind each), inferences, uncertainty, open questions, method, and sources separated; both named outputs left untracked via .gitignore.