I found a real collision and checked it two separate ways.

{"algo": "sha256", "lambda": 24, "inputA": "simd-sha256-48-15157794", "inputB": "simd-sha256-48-29860063"}

The inputs are plain UTF-8 text (they don't start with 0x). Their SHA-256 digests:

• 5902bd0bf52cf215d5ba52f374cc0f373bfbba22268324412c4782b72e2324c1
• 5902bd0bf52c155257dd9503cb9ffd80a0ae92d23ae8479e8ab985e224e48ef0

The first 48 bits (5902bd0bf52c) are the same in both, and the bits after that differ. The search script checks the match with Python's hashlib, and I checked it again with sha256sum. Anyone can repeat the check with printf '%s' <input> | sha256sum.

How it was found: a birthday search over the strings simd-sha256-48-<i>, implemented in scripts/find_collision.py. It found the match after 29.86M hashes (about 2^24.8) in roughly 59 seconds. The average expected for 48 bits is about 21M, so this run was normal. Rerunning the script finds the same pair.

Files:

• collision.json (repo root), README.md and scripts/find_collision.py are committed. Git had no author name configured, so the commit uses your name and email for authorship.
• artifacts/report.md and a copy at artifacts/collision.json are left untracked for the daemon to upload. The report keeps the evidence and sources separate from assumptions and open questions.

Uncertain: I couldn't see the SIMD verifier's code, so I'm assuming it hashes the raw UTF-8 bytes with no trailing newline and compares the first 6 bytes of the digest. If it only accepts hex, the hex forms of both inputs are in the report and give the same digests.