1\section{Formal Results and Negative Findings}2\label{sec:formal}34\input{sections/11a_formal}56\subsection{Negative findings}78The mandate counts a rigorously documented failure as a result (Outcome~D). Table~\ref{tab:negative} collects the9negative findings of this study with the form of evidence behind each.1011\begin{table}[htbp]12 \centering\footnotesize13 \begin{threeparttable}14 \caption{Negative findings: candidate shortcuts and why they fail.}15 \label{tab:negative}16 \begin{tabular}{@{}p{4.6cm}p{5.4cm}p{4.4cm}@{}}17 \toprule18 Candidate & Why it fails & Evidence \\19 \midrule20 A further efficiently computable endomorphism of \secp{} & $\End(E)=\Z[\omega]$ is the maximal order; every endomorphism is $u+v\phi$ & Proposition~\ref{prop:end}; exact check $t^2-4p=-3f^2$ \\21 A group structure on the automorphism orbits (DLP of size $n/6$) & the projection would be injective; orbits are not a congruence & Proposition~\ref{prop:noquotient}; $1500/1500$ counterexamples \\22 Index calculus with a factor base $x(P)<p^{1/2}$ over $\F_p$ & decomposition costs $\lvert F\rvert$ per trial without an oracle; with an oracle, relations cost $\ge 2.4\sqrt n$ and linear algebra $\lvert F\rvert^2$ & Table~\ref{tab:ic}; Semaev $S_3$ check S4 \\23 A transfer attack (MOV/Frey--R\"uck, anomalous, twist) & embedding degree 253-bit; $n\ne p$; twist cofactor a 220-bit prime & Table~\ref{tab:secp-params} \\24 A better generic iteration function for rho & no design in a 25-point space beats the random-mapping constant; Shoup's bound is the floor & Figure~\ref{fig:sweep}, Table~\ref{tab:sweep} \\25 Beating $\sqrt n$ in total work by preprocessing & online $1.5\sqrt{n/T}$ after $\sqrt{nT}$ offline; $ST^2=\tilde\Omega(n)$ & Table~\ref{tab:preproc} \\26 A verification shortcut avoiding one scalar multiplication & any predicate equivalent to $[s]G=R+[e]P$ needs a group element depending on both $s$ and $e$ & Section~\ref{sec:signatures} (argument, not a theorem) \\27 An unexplained identity among the \secp{} constants & all 22 identities found follow from $\beta^2+\beta+1\equiv 0$, $\lambda^2+\lambda+1\equiv 0$ and the ideal structure; 0 control hits & \code{identity\_search.json} \\28 A SHA-256 regularity surviving to the full round count & diffusion complete and correlations undetectable within a small number of steps; SAT/SMT searches stall far below the published 31-step records & Section~\ref{sec:results-sha} \\29 \bottomrule30 \end{tabular}31 \end{threeparttable}32\end{table}3334Two remarks keep these findings in proportion. First, each negative result is relative to a stated family of35candidates: the endomorphism result is unconditional, the orbit result is a theorem, but the iteration-function and36SAT results are statements about the spaces we searched. Second, none of the findings is surprising to a specialist;37their value is that the pipeline produced them with evidence rather than with citations, and that it produced38\emph{no} positive claim it could not support.39