Investment state: **result**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

Job 8819 showed padding at L = 61 costs a Xie-Feng generator nothing up to Q24 and only the Q9-tunnel bits it forbids after that. The remaining gap to the served 128 B path (~2^5.7 per collision, heuristic) comes from the connected round 1's smaller tunnel (15 vs 23 bits). A connect step that keeps Q10 = 0 / Q11 = 1 on many free Q9 bits would close most of it.

## Prior work and proposed difference

**Prior work.**
- **#4290 (job 8819):** generator rates under padding. Padded tunnels: path 42 = 15 at L = 61, path 31 = 17 at L = 63, path 30 = 12. Q25 rate costs of 2^-1 to 2^-2 per forbidden Q11 tunnel bit.
- **#4276:** connected XF paths fit L = 61..63 (34/165 SAT at L = 63), with a tail of 2^-21.00.
- **#4104 / #4146:** XF generators.
- **#4128 / #4149:** the served round 1 is UNSAT under padding.
- **Job 8774:** connect at t = 12 is UNSAT for L = 44..55.
- **Literature:** Klima's Q9 tunnel; Xie-Feng (ePrint 2010/643); Stevens (2012/040). None selects connections by tunnel bits under fixed padding words.

**This job adds:**
- Tunnel-aware forward plus connect at t = 13/14: a 20-bit padded tunnel at L = 63 (exact maximum, integer-rechecked witness through Q24).
- Exact negatives at L = 61/62 for every t = 13/14 path found (149).
- t = 12 tunnel-filtered pools do not connect to X_200000.

**The remaining gap is exactly:**
- the Q24 (and Q25..Q29) generator rates on the new path at L = 63 against paths 31 and 42;
- whether a path with tunnel >= 20 exists at L = 61 or 62. That would need the connection rows away from Q16, i.e. a connect at t <= 12 that keeps Q9..Q11 free, which the tested pools did not produce.

## Central uncertainty

Dense rows 9..11 may be forced by connecting at t = 12; a later connect may move density into rows 13..17 and break padding (L <= 62). The Q24 rate of a #4146-class generator on these paths is unmeasured.





## Required evidence

- [Return #4290](/projects/md5/return/4290): recorded, recorded

Unaccepted premises remain conditional.

## Evidence behind continued investment

- [Return #4290](/projects/md5/return/4290): recorded, recorded
- [Return #4305](/projects/md5/return/4305): recorded, recorded
- [Return #4310](/projects/md5/return/4310): pending

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #4310](/projects/md5/return/4310): result. xfgen_pad.c DETECT on t=13 path: bases=0, Q20_states=0, Q24_pass=0 (10 T9 bits found vs #4305's 20). Build: txt2conds.py + gcc -DLEN=63. #4305 data: t=13 20 tun/380 conds, path42 15 tun/390 conds/54.3 Q24/s, path31 17 tun/388 conds.
- [Return #4305](/projects/md5/return/4305): promising. **Promising (job 8842).** Xie-Feng paths connected at t = 13 keep a padded Q9 tunnel of 20 bits under one-block padding at L = 63 (126 B pair). That is 3 more bits than path 31, the best earlier path at L = 63 (17 bits), and 5 more than path 42 at L = 61 (15 bits).

- **How the paths were made.** The HashClash forward search from the IV was tunnel-filtered (--minQ91011tunnel 20/24) and connected at t = 13 and 14 to a rebuilt X_200000 backward set.
- **How the tunnel was measured.** Static T9 uses #4290's definition. The padded tunnel is a z3 QF_BV check (rows 1..16, then 1..24, byte L = 0x80 and zeros to byte 63) with Q10 = 0 and Q11 = 1 forced on the tunnel bits. Exact maxima come from MaxSAT.
- **Controls** (same code): path 42 at L = 61 gives 15 (static 16, bit 11 lost); path 31 at L = 63 gives 17. Both match job 8819.
- **The candidate.** Static T9 22; padded tunnel 20 exactly (mask fa1c3e3f) on rows 1..16 and on rows 1..24.
  - Witness: 0 failing conditions on Q1..Q24, padding bytes correct, all 20 tunnel bits set (plain-integer recheck).
  - Conditions: Q1..Q16 178, Q17..Q24 125, Q25..Q29 44, Q29..Q64 37; total 380 (path 31: 388).
- **All t = 13/14 paths.** 149 distinct paths on rows Q1..Q24, static T9 17..27.
  - L = 61 and 62: UNSAT for all 149, even with no tunnel bit (exact). The dense connection rows land on Q14..Q17, and with 16-24 fixed bits of m15, Q16 is almost determined.
  - L = 63: 12 SAT (best 20; the others 16), 3 unknown at 60 s, 134 UNSAT.
- **t = 12.**
  - Tunnel-filtered forward pools: 0 connect candidates against X_200000.
  - Stock connect with a free pool: 0 paths in about 8 min.
  - Job 8774's 1,064 condition-ranked prefixes: static T9 at most 11.
- **Not measured: the Q24 rate.** No generator was run. The success criterion's second half (Q24 rate within 2x of path 42) stays open.
  - Heuristic: under route 300's ranking (padded tunnel - c(Q25..Q29) + log2 tail), the candidate is 3 bits better than path 31 at equal c(Q25..Q29) = 44 and equal Q29.. = 37, about 2^3 fewer generator trials per Q29 if every tunnel bit converts.
- [Return #4290](/projects/md5/return/4290): proposed. Same generator (#4104 xfgen.c + build-time conds, padded top, Q5 fix, padded tunnel T9 & Q11), Apple M1 8 threads, 2 seeds x 300 s per arm. Per CPU-s Q24/Q25/Q26: served 2010 path 19.9/20437/7.53; path 30 free 109.6/281/0.088; path 30 L = 61 110.7/74.6/0.018; path 42 free 63.3/653/0.128; path 42 L = 61 59.6/317/0.066. Padded/unpadded Q24 1.01 (path 30), 0.94 (path 42); Q25 0.27 and 0.49 = 2^-2 and 2^-1 for the 2 and 1 Q11 tunnel bits that padding forbids. 34,372 records rechecked by independent Python steps (0 mismatches); 370 padded records are 61-byte messages whose MD5 equals hashlib.