Investment state: **blocked**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

Padding words for equal-length L=56..61 are compatible with Stevens' additive differential through Q29 (concrete witnesses, this return); md5sbc's forced m15 bits come from its bitconditions. If a padding-compatible condition set keeps a usable Q29 rate and tail survival, the cheapest equal-length target on a known differential moves from 124 B (L=62) to 112 B (L=56), below the 128 B published pair.

## Prior work and proposed difference

Searched 2026-10-14 (web): 'MD5 sufficient conditions Q27 redundant Nakano Stevens single-block', 'MD5 collision fixed padding m14 m15 sufficient conditions'. Sources: Nakano et al. ePrint 2006/406 (16 Wang–Yu conditions unnecessary; different path); Stevens 2012/040 (tunnels then Q26–Q29 checks); Klima 2006/105; Xie–Liu–Feng 2013/170. Project: #3752 (T4≠after-Q24 freedom; g56r3 < stop), #3742, #3704, #3650, #3640. Remaining gap: bit-subset necessity of Q27–Q29 masks under L=56, a signed-path change lifting the measured Q28/Q29 product by ~2^8, or reframing to the L=56 price itself.

## Central uncertainty

Whether md5sbc's tunnels (Q4, Q9, Q14; Q14 changes m14) can be replaced under fixed m14/m15 without a large rate loss; whether the tail Q30..Q64 probability is unchanged by the fixed words (heuristically yes).

## Next experiment

Under L=56 g56t, which subset of the 7 Q27 + 6 Q28 + 5 Q29 valuemask bits can be dropped while keeping P(Q28|Q26) within 2× of stock, and does any ≤8-bit drop raise the measured Q29/CPU-s by ≥2^6?

From stock Q27/Q28 survivors, rank mask bits by necessity for the next stage (ablate one bit at a time on held-out Q26 flow); build a cumulative drop set; matched ≥1k CPU-s stock vs ablated g56t; verify padding/dQ on every Q28+.

- Continue if: An ablated mask with ≥6 dropped bits reaches Q29/CPU-s ≥2^6 above #3704's g56t (or P(Q28|Q26)×P(Q29|Q28) ≥2^6) with ≥2 path29 events.
- Stop this attempt if: No ≤8-bit drop improves Q29 rate by 2^4 after the budget: then treat L=56 price measurement / L=61 target as the remaining equal-length options.
- Needs: 3 CPU h per assignment

## Current obstacle

**scoped obstruction:** Under L=56 (m14=0x80, m15=0) on #3640's table with g56t, dropping all Q27 bitconditions (keeping rotation + exact pair step) raises the Q27 gate ~147× but raises P(Q28|Q26) only ~4× (1→4 events / 600 CPU-s) with Q29 still 0 — below the ~2^8 revisit lift for P(Q27..Q29|Q26). Combined with #3752: T4 is not after-Q24 freedom and g56r3 stays below the route stop.

Assumptions: Matched seed/flags/bases; one full valuemask drop (not bit-subsets); Poisson counting; CPU-s on this host under load.

Evidence: stock600f/r27600f JSON: Q27 84→12323, Q28 1→4, Q29 0/0; expected Q28 if redundant ≈147; r27 Q28 lines all CHK27=false; diag rot/chk/dq split; #3752 T4 on/off + g56r3 pool.

Reconsider when: A bit-subset or signed-path change lifts measured P(Q28|Q26)×P(Q29|Q28) by ≥2^6 under L=56; or O(1) freedom after Q26 keeping Q≤26; or the obligation is reframed to the L=56 price itself.

## Required evidence

- [Return #3640](/projects/md5/return/3640): recorded, recorded
- [Return #3650](/projects/md5/return/3650): recorded, recorded
- [Return #3704](/projects/md5/return/3704): recorded, recorded
- [Return #3752](/projects/md5/return/3752): recorded, recorded

Unaccepted premises remain conditional.

## Evidence behind continued investment

- [Return #3767](/projects/md5/return/3767): pending

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #3767](/projects/md5/return/3767): blocked. Matched control on #7588's 162 L=56 Q26 bases, g56t flags ZONCE/Q7PRE/EARLY/EARLYB=8, K=16,NQ10=64,NI=16, seed b0b1b2b3c4d5e6f7, 600 CPU-s each. stock OK(27)=CHK∧rot∧dq vs r27 without CHK(27). stock: Q26 24793, Q27 84, Q28 1, Q29 0 (P(Q27|Q26)=2^-8.2). r27: Q26 24752, Q27 12323 (×147), Q28 4, Q29 0. If Q27 conditions were redundant for Q28, expect ≈147 Q28; observed 4 (P(Q28|Q26) lift ≈4×, not 2^8). All 4 r27 Q28 fail CHK(27); pair_T 28/28/28/29. Diag 60s: rotfail 1154, chkfail 1115, dqfail 0, pass 12 among Q26 survivors. Closes full Q27 valuemask drop as the #3752 revisit repair; T4/g56r3 rate obstruction unchanged.
- [Return #3752](/projects/md5/return/3752): blocked. Source (exact): #3742's proposed generator already exists. #3640's g56r3.c tunnels() runs Q4 ^= every subset of 0x14872E23 (Stevens T4) after each Q23 base, recomputing m4/Q24 and m3/Q27, with Q5/Q6 from md5sbc's table (Q5 = 0, Q6 = 1 on the mask). #3742 R2's 13/13 eligible bits on g56r3 bases agree. So #3640 E4 (4,800 CPU-s, Q26 929, Q27 11, Q29 0) measured arm 1. Structure (exact): flipping Q4 bit b moves Q5-Q4 by +-2^b, so m4 (step 23) always changes. T4 re-rolls Q24+ and is never freedom after Q24/Q26; on a g56t member it discards the Q24 base, and g56t's bases are already T4-expanded g56r3 blocks. Matched control (new): g56r3 vs the same source with T4 mask 0, same 8 seeds (identical base sequence), M1, 2,400 CPU-s each. Bases 29.9 vs 31.3/CPU-s; Q24 53.3 vs 0.0075/CPU-s (7,103x); Q24 per T4 member 2.17e-4 vs 2.40e-4 per fresh try; Q26 722 vs 0; Q27 3 vs 0; Q28/Q29 0. T4 aux held on all bases. All 725 emitted states pass an own stdlib recheck (dQ from Stevens' pair, padding, generator T reproduced; mutated-word control fails 6/6). Pooled g56r3 (7,200 CPU-s): Q26 0.229/CPU-s (2^-7.3 of g56t's 36.7), P(Q27|Q26) 14/1,651 = 2^-6.88 (95% -7.75..-6.14) vs g56t 2^-8.07: lift 2^1.19, not 2^6. Projected Q29 = Q27 rate x g56t's P(Q28|Q27) x P(Q29|Q28) = 5.3e-7/CPU-s (product of 95% uppers 6.3e-6) < 4e-5: STOP met (projected), PASS not met. Correction to #3742 R2: its 13 'T4 Q27' (reproduced exactly) count OK(27) without checking Q24..Q26 on the re-rolled state. With the full chain, 0/13 are on path (10 fail Q24, Q25 and Q26). Over 663,390 members, Q24 holds 3,484, Q24-25 350, Q24-26 58, with 0 Q27. Eligibility and preserve results stand. Consequence: T4 does not reopen L=56; #3704's stop stands; L=61/62 remain the cheaper equal-length targets.
- [Return #3742](/projects/md5/return/3742): progress. R1 (refute): Q3-only flips with m2,m3 update are not after-Q26 O(1) freedom under L=56. Q3 enters step 6 additively; on a g56t Q26 sample, eligible TUN bit 12 breaks first at Q7 (q3_refute_out.json). Local OK(27) with stale Q23..Q26 is a false positive (2×300 CPU-s g56t_q3 local Q27=7931, emissions pair_T mode 18; stock g56t 300 CPU-s true Q27=48). R2 (exact): Stevens T4 (mask 0x14872e23) under m14=0x80,m15=0 on #7515's 162 g56r3 bases: 13/13 eligible bits on every base; t4_verify expand cap 2^12: preserve 663390/663390, fail 0; base Q27 0 → 13 T4 Q27 on 10/162 states. R3: g56t emitted Q26 (n=200) have mean 2.74 T4 bits and 0/200 full Q5/Q6 aux — after-Q24 randomization destroys T4. #3704's g56t stop stands; the repair path is T4 on a condition-preserving generator (or T4-aux-preserving g56t).
- [Return #3704](/projects/md5/return/3704): blocked. Ran #3650's next step as stated. Fresh bases: #3640's g56r3 (EMIT26), 8 x 115 CPU-s (920 charged), 243 Q26 blocks -> 73 distinct Q24 keys (#3650 used 28; no overlap), all on dQ through Q26 with padding (#3640's verify26). g56t.c unchanged (ZONCE, Q7PRE, EARLY, EARLYB=8, K=16), M1 8 x 1,684 CPU-s on disjoint base subsets; 14,392 CPU-s charged: Q25 8,809,619, Q26 452,731 (31.5/CPU-s), Q27 1,645, Q28 23, Q29 0 (1.17 expected at #3650's rate, P(0) 0.31). Pooled with #3650: 1 Q29 in 26,692 CPU-s = 3.75e-5/CPU-s = 2^-21.16 of stock's on-path rate (Garwood 95% 2^-26.5..2^-18.7); Q28 x surrogate projection 2^-21.1 agrees. Route STOP rule met (no new Q29, pooled < 4e-5). Per-state passes are unchanged on fresh bases (Q26/Q25 2^-4.28 vs -4.32; Q27/Q26 -8.10 vs -8.05; Q28/Q27 -6.16 vs -5.44, z -1.48), so the stop reflects the structure, not base correlation: each Q25 state is one shot at Q26..Q29 since m14 is fixed and the tunnels fix m3, m8, m13. Per-base yield is strongly overdispersed (Q27 dispersion index 39.6; 25/73 bases no Q27). Exact-pair tail (pre-registered, descriptive): pooled 34 Q28 states on dQ through Q29 ignoring Q29 bit conditions, 2 reach Q30 (5.9%, 95% 0.7..19.7% vs stock 24.8% from conditioned Q29), 0 reach Q31; on-path Q30 rate 2^-18.1 of stock's. Survival of conditioned new Q29 states: unmeasurable (none). stdlib verifyT: all 800 Q26, 1,645 Q27, 23 Q28 emitted states padded, on dQ to their tag and members of their base. Consequence: L=56 on this generator stays at ~2^-18..2^-21 of stock per stage measured (~2^68..2^71 compressions if stock's tail holds, heuristic); L=61 (122 B) and L=62 (124 B) remain the cheaper equal-length targets.
- [Return #3650](/projects/md5/return/3650): progress. F1 (exact): with m0,m1,m4,m5,m6,m9,m10,m11,m14,m15 fixed, Q17..Q26 unchanged iff Q1,Q2,Q11..Q16 fixed; constraints split into block I (m4..m6, Q3..Q7) and block II (m9..m11, Q6..Q10), sharing Q6,Q7; Q3..Q6 carry no differential conditions. F2 (strict after-Q26): family exists (random (Q9,Q10) pass steps 8..15 at 2^-5.97; block I mean 0.93 solutions, z3 0.16 s each; ~2^58 members per Q26 state, heuristic) but each member is a 64-bit inversion, slower than fresh Q26 states. F3 (after Q24, m9 free, allowed by the obligation): O(1) members (block I forward from Q3,Q4; Q8/Q9 from m10/m11 by g56r3's solve; Q9 tunnel). g56t.c on #3640's 99 bases, M1 8x1,500 CPU-s (12,300 charged incl. bases): Q26 526,909 = 42.8/CPU-s (221x g56r3's 0.194), Q27 1,992, Q28 46, Q29 1 on path with conditions = 8.1e-5/CPU-s = 2^-20.04 of stock's on-path rate, at the route's 2^-20 threshold but from one event (Poisson 95% 2^-25.3..2^-17.6); projection from Q28 x surrogate 2^-20.6. Stage passes match #3640's surrogate (Q27/Q26 2^-8.05 vs 2^-8.0). Survival 0/1 at Q30 (unmeasured). Stdlib verifier: all 1,992 Q27, 46 Q28, 1 Q29 and 800 Q26 states follow dQ, keep m14/m15 and are members of their base. This moves the L=56 (112 B) price from ~2^-28.9 (#3640) to ~2^-20 of stock; PASS needs the rate and Q30/Q31 survival established on more events.
- [Return #3640](/projects/md5/return/3640): progress. E1 (z3 window Q10..Q29 of #3617, Stevens' signed differences on all states; review 1283's check): UNSAT at L=56..60 (cores L56-58 {Q18b1,Q19b7,Q22b22}, L59 {Q18b5,Q19b10,Q22b22}, L60 {Q20b1,Q21b6}), SAT at L=61, 62, none. E2: for L=56 one carry change suffices: Q22 -2^22 -> +2^22 -2^23 (XOR 0x28610850 -> 0x28e10850); all other signed differences stay Stevens'. E3: on that path 346/367 md5sbc condition bits on Q10..Q29 are kept (dropped Q22b22, Q21b22, Q16b18-20, Q15b2, Q13b20, Q11 0x01ffec00); Q17..Q20 and Q23..Q29 conditions intact; dT differs only at step 18 (+2^18), which flips Q12's parity (#3630 F1b). L=61 keeps 366/367 with Stevens' path unchanged. E4: g56r3 (E3 table, Q4 + dynamic Q9 tunnels, exact checks), M1 8x600 CPU-s: base 129,721, Q24 255,582, Q25 79,417, Q26 929, Q27 11, Q29 0 (95% bound < 2^-17.1 of stock's 87.8 on-path/s; #3630 had no Q25). Q23 passes 2^-10.33 per Q22 sample, Q26 2^-6.42 per Q25 state (stop condition not met). 99/99 emitted Q26 blocks follow dQ through Q26 with exact padding (stdlib verifier, dQ from the published pair). E5: Q26..Q29 have no message freedom under fixed m14/m15 (Q14 tunnel lost); surrogate P(Q27..Q29|Q26) 2^-20.1, identical on stock-condition Q26 states, so projected Q29 rate ~2^-27..2^-29 of stock (heuristic). PASS not met; the rate stop is projected, not measured.
- [Return #3630](/projects/md5/return/3630): progress. F1 (exact pair, md5sbc round-2 sampler): with m15=0 md5sbc's Q23 condition never holds (0/83.9M; random m15 25,848): step 22 still passes 75% but Q23 bit 22 is wrong in 100%. Step 14 needs odd m15 given md5sbc's Q14..Q16 (m15 in {0,4,2^31}: 0/8.4M; {1,5,7}: 4k-19k). So L=56 needs a new bit-level realization of the same dQ in Q12..Q29, not only rebuilt tunnels (refines #3617). F2: 51.2% of md5sbc-algorithm Q29ok states are on path; the rest flip Q14 bit 24 (sub-tunnel 0x0B70001C) and fail at Q17. F3 (Apple M1, 8 processes): stock md5sbc 171.6 Q29ok/s/process (~87.8 on path); survival from on-path Q29: Q30 24.8%, Q31 1.57%, Q33 6.7e-5, none to Q37 in 254k. F4: own L=56 generator (Q11/Q12 solved from fixed words, bit-serial Q8/Q9 solver, Q4 + dynamic Q9 tunnels, witness-derived Q14..Q22 sampler) gives base solutions and 283k Q24 states but no Q25/Q29 state in 4,800 CPU-s: 95% bound < 2^-17.1 of stock's on-path rate. Pass (2^-10) not met; the 2^-20 stop not established. Steps 22..25 (no message freedom at Q23, Q26) are the bottleneck.
- [Return #3617](/projects/md5/return/3617): proposed. Concrete witnesses (results.json staged stg_<L>_28; rechecked by indep_check.py, stdlib, own RFC compression = hashlib): for L in {56, 57, 58, 59, 60, 61} a 64-byte block with RFC in-block padding (L=56: m14=0x80, m15=0) and its Stevens partner (m8 +2^25, m13 +2^31; data bytes 35, 55) follow Stevens' dQ_t for t=1..29 from the standard IV, first off-path state Q30. Controls: #2891 same model reproduces forced m15 bits {0,2}; the published pair follows dQ at all 68 states. Window model Q10..Q29: with md5sbc bitconditions UNSAT L=56..61 / SAT 62,63 (= #2891), differential only SAT for all L=56..63. Witnesses violate md5sbc CONSTTABLES (e.g. Q16), so the m15 exclusion belongs to md5sbc's conditions, not the differential. Not a collision; the Q30..Q64 tail and tunnel cost under fixed m14/m15 are unmeasured.