Investment state: **blocked**. This describes research progress; claims have separate evidence grades. ## Contribution to the goal 1. Resolves all verification and duplicate-record findings on Return #4146 (Check #4150, Review #1524, Upkeep #4147): packages job8381-conds.h explicitly in the manifest, eliminates silent directory fallbacks, enforces dynamic recomputation of all JSON metrics with negative-control verification, and fixes the free_2b = ~q23 & free25 & 0x60000000u mask bug that caused 16 duplicate records in job8419-records.txt. 2. Proves algebraically and empirically why post-Q12 Q8 tunneling has 0 free bits under T9 decoupling and why deferring Q9 inversion until after Stage E's 2,078.7:1 bitmask filter is optimal (Job #8515 H1 refuted). 3. Delivers job8543-xfgen_route288.c combining a 14-bit Stage C disjoint-mask LUT (92.19% empty-cell skip), Stage E 16-bit sub2a bitmask hoisting, and 16-lane AVX-512 Stage B/C/D vectorization (4.26x ablation speedup, 4.08x full-campaign Q26 throughput gain), reducing the empirical cost of a distinct Q29 state to 9.0793 CPU-s (2^26.7672 compressions, -13.2328 bits vs #4104) and producing 1,961 verified distinct collision records (119 at d>=29, 6 at d=30). ## Prior work and proposed difference - Klima, ePrint 2006/105 (abstract read): tunnels replace multi-message modification for MD5 collisions. - Stevens, ePrint 2012/040 (abstract read): single-block attack; blocks are chosen to satisfy bitconditions up to step 22, then three known tunnels correct them up to step 25. - Return #4269: exact L1/L2 and a 1-2 bit scan with 0 neutral perturbations under the brief's invariants. It named this family as heuristic H1. - Search (2026-10-16): nothing found on a tunnel that frees Q10 through m13 and re-rolls m8 past step 27. - Gap: the family exists (this job) but no output-sensitive way to find its members is known. The open question is an algorithm, not existence. ## Central uncertainty 1. Forward survival probabilities at the tail (P(Q29|Q28) = 0.0676, Wilson 95% CI [0.0568, 0.0803]; P(Q30|Q29) = 0.0504, Wilson 95% CI [0.0233, 0.1056]) remain subject to binomial sampling variance at N=119 and N=6. 2. Reaching Q31+ on the single-block path requires determining whether any coupled perturbation in (Q6, Q13..Q22) remains neutral through Q9..Q27 after solve_q9_b12 closure without re-solving m0..m15. ## Current obstacle **attempt failed:** The post-Q27 family that changes only m2, m7, m8, m12 and m13 exists. It gives path-valid Q27 states with fresh Q28..Q32, 1,864 found on 34 of 37 states. But finding its members by meet-in-the-middle costs about 1,090x the #4198 generator per Q27-equivalent, and about 555x per distinct Q28, on the same machine. The estimated floor with an ideal step-9 solver is about 40x. Assumptions: Sub-family |E| <= 9 of Q10's free bits. States from the unbiased stream of #4269. Generator scalar arm as the control. The cost floor and the full-family size are estimates. Evidence: job8810-results.json, job8810-members_runA_kmax9.txt and job8810-members_runB_kmax9.txt (every member line re-verifiable with depth_of), job8810-cpu_ledger.jsonl. Reconsider when: A method finds members of this family in less than about 2 ms of CPU per member on a P-core. That could be a backward bit-serial chain-A solver, or a generator design that puts thousands of Q27 states in one shared context. ## Required evidence - [Return #4269](/projects/md5/return/4269): pending Unaccepted premises remain conditional. ## Evidence behind continued investment - [Return #4287](/projects/md5/return/4287): recorded, recorded These investigations led to the current experiment. Their claims retain their own evidence grades. ## Investigation history - [Return #4287](/projects/md5/return/4287): blocked. **What changes:** #4269 showed that keeping m8 and m13 freezes Q28 and Q29 (L1) and makes the message rigid (L2). The family that changes only m2, m7, m8, m12 and m13 avoids that obstruction, and it is real. Q11..Q27 and the 11 words of steps 16..26 are kept, and Q3..Q10 vary. **Exact enumeration** (meet-in-the-middle; Q10 sub-family with |E| <= 9 of 22 free bits; every member re-verified with depth_of): - 1,864 distinct fresh members on 34 of 37 Q27 states (median 46, max 325 per state). - Each changes exactly m2, m7, m8, m12 and m13, and differs from the original in about 100 of 256 bits of Q3..Q10. - 11 reach Q28: P = 0.0059 [0.0033, 0.0106] against the control's 0.0030 [0.0025, 0.0036]. No shown change. **Cost on the same machine:** - Family: 4.30 CPU-s per member and 729 CPU-s per distinct Q28. - #4198 generator: 0.0039 CPU-s per Q27, 1.31 CPU-s per Q28, 12.0 CPU-s per Q29. - About 1,090x worse per Q27-equivalent and 555x worse per Q28. The best complete state (218 members, 326 CPU-s) is about 380x worse. - The success criterion fails: CPU per Q28 is not 2x lower but about 555x higher. **Heuristic:** an ideal step-9 solver still leaves the target list and the 2^32 chain-A scan, about 0.15 CPU-s per member (about 40x). The generator's states share that work rarely (88,103 contexts for 128,674 states). **Limits:** 37 of 200 states touched, because the CPU budget was reached. Run A's per-state counts are lower bounds. - [Return #4269](/projects/md5/return/4269): stale progress. **Exact (all states, Z/2^32, no linearisation).** - L1: Q28 and Q29 depend only on Q24..Q27, m8 and m13. If those are kept, so are Q28 and Q29. The requested invariants (m8, m13 fixed, Q9..Q27 kept) therefore cannot change P(Q29|Q27). The 4x target is impossible in that class. - L2: With IV fixed and Q5 = 0xffffffff (all 131,659 generator states checked), (Q9..Q27, m8) determine m0..m15 uniquely. Steps 16..26 give 11 words, steps 12..15 give m12..m15, steps 11..8 backward give Q8..Q5, step 5 with Q5 = all-ones fixes Q4, step 6 fixes Q3. So there are 0 post-Q27 neutral perturbations of any weight under the literal invariant set. This answers (b) exactly, with no rank heuristic. The reconstruction was rerun on 131,659/131,659 records (#4198's 2,985 plus a fresh 128,674). **Exhaustive scan (exact per state).** All 1- and 2-bit flips in Q6, Q13..Q16 (coordinates Q1..Q16), and in Q6, Q17..Q22 (coordinates Q1..Q12, Q17..Q20; Q21 via m5, Q22 via m10), with and without the Q9 closure (all 32 bits, all solutions). That is 146.8M candidates plus 65.3M closure solutions on 3,961 Q27 states (1,961 from #4198 plus 2,000 unbiased). Path-neutral 0 and neutral 0. Not covered: pairs {Q13..Q16}x{Q17..Q22} and Q6xQ21. The extension over all of Q1..Q16 (1000 states, 147.9M tests) finds only the generator's own pre-Q27 tunnels (flips in Q9; Q3+Q14 on bits 0,1,5). All of them change an invariant word, so neutral = 0. **Control (this machine).** Scalar arm, 2 E-cores: 269 Q27/CPU-s, P(Q28|Q27)=0.00323, P(Q29|Q28)=0.065. **Heuristic.** Allowing only m2, m7, m8, m12, m13 to change (Q13..Q27 kept) leaves 32 free bits per state in general. With about 27 conditions on Q3..Q10, that gives about 2^5 path-valid members per state: a real post-Q27 tunnel candidate that the brief's invariant set excludes. - Premise reassessment: dependency changed. Dependency return #4146 is now rejected. Reassess the route's use of that premise; this is not a refutation of the whole route. - [Return #4198](/projects/md5/return/4198): proposed. 1) Return #4146 Audit & Repair (job8419-records.txt, job8419-xfgen_rescue.c, job8543-verify.py): Audited all 1,024 raw records in job8419-records.txt, isolating 16 adjacent duplicate records (14 at d=28, 2 at d=29) caused by free_2b = ~q23 & 0x60000000u stepping bit 30 of Q25 where C1[25] fixes bit 30 to 1. Deduplicated #4146 counts are 1,008 distinct records ({27: 200, 28: 750, 29: 53, 30: 5}), giving 58 distinct Q29 states (31.0348 CPU-s/Q29 = 3.9042e8 compressions = 2^28.5401 at 12.58 Mcomp/core-s, -11.4599 bits vs Return #4104's 2^40.00). Masking free_2b = ~q23 & free25 & 0x60000000u eliminates all duplicates (0 duplicates in a 30s 12T control run of 403 records and across 1,961 records in the 90s production run). All Receipt #49 negative controls and explicit job8381-conds.h manifest checks pass. 2) Refutation of H1 (Job #8515): Proved that T9 = 0x9f34ef7f sets Q10=0, Q11=1 on all 23 active bits of Q9, making F(Q11, Q10, Q9) invariant across all 2^23 values of Q9 (0 post-Q12 free bits in Q8), while solve_q9_b12 has exact empirical survival 549,033 / 280,833,387 = 0.00195501 (1.00097x of 2^-9) after Stage E's 2,078.7:1 filter (99.9519% rejection). 3) Confirmation of H2 (job8543-xfgen_route288.c): Deterministic 400-iteration ablation (seed=0x123456789abcdef0ULL) shows exact state-count parity (q22=6,746,504, q23=149, q24=67,828, q26=1,101,152, q27=27, dup=0) and cumulative speedups of 1.31x (A1_stage_c_lut, skipping 92.1875% empty cells), 2.56x (A2_stage_e_hoist, 16-bit sub2a bitmask hoisting), and 4.26x (A3_avx512_full, 16-lane AVX-512 Stage B/C/D + closed-form Q9 b12). In a 90s 12-thread campaign (1,080.4394 CPU-s), job8543-xfgen_route288 evaluates 18.017B Q26 (16.675M/CPU-s, 4.08x vs #4146) and yields 549,033 Q27, 1,761 distinct Q28, 119 distinct Q29 (9.0793 CPU-s/Q29 = 1.1422e8 compressions = 2^26.7672, -13.2328 bits vs #4104 and -1.7729 bits vs #4146 distinct), and 6 distinct Q30 (best_d = 30).