t1ha2-64 (t1ha2_atonce, 64-bit output, 64-bit seed): fixed message pairs under random seeds
validation: upstream KAT 81/81 ok; SMHasher3 verification 0x8F16C948 (want 0x8F16C948) ok
rng: xoshiro256** seeded by splitmix64(1 + pair index)

pair F60 (selected pair)
  m1 (13 bytes) = c4c0cc2284cd239ede36a18fa6
  m2 (16 bytes) = fbc31866049ec02dea0c4e2be580d3cf
  mechanism: 13-byte vs 16-byte messages: 5-digit route +2^60+2^54-2^48-2^9-2^1; 24 fixed bits of L, measured carry cancellation
  uniform seeds: N = 2^20.00 (1048576): 0 collisions, rate unestimated (zero observed in 2^20.00 trials)  (expected at the published 2^-28.19: 0.003)
  seed class: (L & a5845081f808f44a) == 2080000118003408, L = lo(((seed ^ l0) + t) * P1), density 2^-24
  conditional: N = 2^20.00 seeds in the class: 57150 collisions, rate 2^-4.20
  => estimated class contribution = 2^-24 * 2^-4.20 = 2^-28.20  (published 2^-28.19)
  first class colliding seed: 62287e4a66a54435
  explicit seed 4c240c2749cd4915: H(m1) = c35b49165b1a4480  H(m2) = c35b49165b1a4480  COLLIDE (L = 60980e4d1a6137ac, in class: yes)

pair A (historical control)
  m1 (16 bytes) = 406b68c281a55e00158ed10a0d96f8ff
  m2 (11 bytes) = d1d86241d24d9f990323e0
  mechanism: 16-byte vs 11-byte messages: a signed-digit difference in word 0 (public
    (len+w0)*P2 shift) is cancelled by the tail word's carry pattern through P1;
    only 26 bits of L and 4 carry signs depend on the seed
  uniform seeds: N = 2^20.00 (1048576): 0 collisions, rate unestimated (zero observed in 2^20.00 trials)  (expected at the published 2^-30.00: 0.001)
  seed class: (L & 7f868a5066451822) == 16808a1062000020, L = lo(((seed ^ l0) + t) * P1), density 2^-26
  conditional: N = 2^20.00 seeds in the class: 65785 collisions, rate 2^-3.99
  => estimated class contribution = 2^-26 * 2^-3.99 = 2^-29.99  (published 2^-30.00)
  first class colliding seed: 496126831f847b53
  explicit seed 3c805cc67a687f30: H(m1) = f2a1196d24fddaab  H(m2) = f2a1196d24fddaab  COLLIDE (L = 96b1df91fb0202ed, in class: yes)

pair B (same mechanism, second digit route)
  m1 (13 bytes) = 9858cabfcf20f692468be82bd3
  m2 (16 bytes) = 95589a09e664a742a4ac26262cc7fdfc
  mechanism: 13-byte vs 16-byte messages: 4-digit route +2^56-2^46-2^20+2^50 on the
    word-0 product, tail difference chosen so the P1 carries cancel it;
    27 bits of L and 4 carry signs fixed
  uniform seeds: N = 2^20.00 (1048576): 0 collisions, rate unestimated (zero observed in 2^20.00 trials)  (expected at the published 2^-31.01: 0.000)
  seed class: (L & 4d4ce1e6964c5012) == 4c408040000c1012, L = lo(((seed ^ l0) + t) * P1), density 2^-27
  conditional: N = 2^20.00 seeds in the class: 65084 collisions, rate 2^-4.01
  => estimated class contribution = 2^-27 * 2^-4.01 = 2^-31.01  (published 2^-31.01)
  first class colliding seed: e8b3965dc46f5b7a
  explicit seed d870b802f1050157: H(m1) = 63cf67ba079a2997  H(m2) = 63cf67ba079a2997  COLLIDE (L = de608850619f1396, in class: yes)