\section{Formal Results and Negative Findings}
\label{sec:formal}

\input{sections/11a_formal}

\subsection{Negative findings}

The mandate counts a rigorously documented failure as a result (Outcome~D). Table~\ref{tab:negative} collects the
negative findings of this study with the form of evidence behind each.

\begin{table}[htbp]
  \centering\footnotesize
  \begin{threeparttable}
    \caption{Negative findings: candidate shortcuts and why they fail.}
    \label{tab:negative}
    \begin{tabular}{@{}p{4.6cm}p{5.4cm}p{4.4cm}@{}}
      \toprule
      Candidate & Why it fails & Evidence \\
      \midrule
      A further efficiently computable endomorphism of \secp{} & $\End(E)=\Z[\omega]$ is the maximal order; every endomorphism is $u+v\phi$ & Proposition~\ref{prop:end}; exact check $t^2-4p=-3f^2$ \\
      A group structure on the automorphism orbits (DLP of size $n/6$) & the projection would be injective; orbits are not a congruence & Proposition~\ref{prop:noquotient}; $1500/1500$ counterexamples \\
      Index calculus with a factor base $x(P)<p^{1/2}$ over $\F_p$ & decomposition costs $\lvert F\rvert$ per trial without an oracle; with an oracle, relations cost $\ge 2.4\sqrt n$ and linear algebra $\lvert F\rvert^2$ & Table~\ref{tab:ic}; Semaev $S_3$ check S4 \\
      A transfer attack (MOV/Frey--R\"uck, anomalous, twist) & embedding degree 253-bit; $n\ne p$; twist cofactor a 220-bit prime & Table~\ref{tab:secp-params} \\
      A better generic iteration function for rho & no design in a 25-point space beats the random-mapping constant; Shoup's bound is the floor & Figure~\ref{fig:sweep}, Table~\ref{tab:sweep} \\
      Beating $\sqrt n$ in total work by preprocessing & online $1.5\sqrt{n/T}$ after $\sqrt{nT}$ offline; $ST^2=\tilde\Omega(n)$ & Table~\ref{tab:preproc} \\
      A verification shortcut avoiding one scalar multiplication & any predicate equivalent to $[s]G=R+[e]P$ needs a group element depending on both $s$ and $e$ & Section~\ref{sec:signatures} (argument, not a theorem) \\
      An unexplained identity among the \secp{} constants & all 22 identities found follow from $\beta^2+\beta+1\equiv 0$, $\lambda^2+\lambda+1\equiv 0$ and the ideal structure; 0 control hits & \code{identity\_search.json} \\
      A SHA-256 regularity surviving to the full round count & diffusion complete and correlations undetectable within a small number of steps; SAT/SMT searches stall far below the published 31-step records & Section~\ref{sec:results-sha} \\
      \bottomrule
    \end{tabular}
  \end{threeparttable}
\end{table}

Two remarks keep these findings in proportion. First, each negative result is relative to a stated family of
candidates: the endomorphism result is unconditional, the orbit result is a theorem, but the iteration-function and
SAT results are statements about the spaces we searched. Second, none of the findings is surprising to a specialist;
their value is that the pipeline produced them with evidence rather than with citations, and that it produced
\emph{no} positive claim it could not support.