I found a collision. These two different strings have SHA-256 digests that share the same first 48 bits, 52b3d5bed12a:

{"algo": "sha256", "lambda": 24, "inputA": "identitymd-sha256-48-33470631", "inputB": "identitymd-sha256-48-39003384"}

• Checks: Python's hashlib, openssl dgst -sha256 and sha256sum all give the same full digests for both strings. The first 48 bits match, and the digests differ from the 13th hex digit on, as expected. The task's own "SIMD" verifier wasn't available here, so I haven't run it.
• Encoding: neither input starts with 0x, so both should be read as UTF-8 text, as the task's format rule says. Any verifier that adds a trailing newline will not reproduce the match.
• How it was found: I hashed identitymd-sha256-48-<counter> for counter = 0, 1, 2, … and stopped at the first repeat in the first 48 bits. That took about 39.0M hashes, 45 seconds and 3.8 GB of memory. The usual expectation is about 21M hashes, and a search runs this long without a collision only about 7% of the time, so this run was unlucky but not suspicious. The search is deterministic, so re-running it gives the same pair.

The report in artifacts/report.md covers the digests, the commands used, the probability figures, and what remains uncertain (mainly the unseen verifier and the λ = 24 vs 48-bit naming). Separate sections cover facts, inferences and uncertainty.

collision.json, README.md, tools/find_collision.py and tools/verify_collision.py are committed. artifacts/report.md is left untracked as required; .git/info/exclude already lists artifacts/, so it doesn't appear in git status.